Function at 0x606bf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x606bf8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
lea eax, [ebp - 4]
call fcn.004058f8
xor eax, eax
push ebp
push 0x606eef
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4946e0]
call fcn.00495798
mov esi, eax
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [0x6e5858]
mov eax, dword [eax]
call fcn.005d1e94
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [0x6e60d0]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xf
lea edx, [ebp - 0x20]
mov ecx, 1
pop eax
call fcn.0040bc78
push dword [ebp - 0xc]
push 0x606f04
push 0x606f04
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040561c
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, edi
and eax, 1
dec eax
jne 0x606cae
lea eax, [ebp - 0x24]
mov edx, dword [0x6e3620]
mov edx, dword [edx]
call fcn.004054bc
mov edx, dword [ebp - 0x24]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, edi
and eax, 2
cmp eax, 2
jne 0x606cd2
lea eax, [ebp - 0x28]
mov edx, dword [0x6e4e1c]
mov edx, dword [edx]
call fcn.004054bc
mov edx, dword [ebp - 0x28]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, edi
and eax, 4
cmp eax, 4
jne 0x606cf6
lea eax, [ebp - 0x2c]
mov edx, dword [0x6e43d8]
mov edx, dword [edx]
call fcn.004054bc
mov edx, dword [ebp - 0x2c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, edi
and eax, 8
cmp eax, 8
jne 0x606d1a
lea eax, [ebp - 0x30]
mov edx, dword [0x6e62c8]
mov edx, dword [edx]
call fcn.004054bc
mov edx, dword [ebp - 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
and edi, 0x10
cmp edi, 0x10
jne 0x606d3c
lea eax, [ebp - 0x34]
mov edx, dword [0x6e588c]
mov edx, dword [edx]
call fcn.004054bc
mov edx, dword [ebp - 0x34]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov ecx, dword [0x6e3f1c]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x5d5910]
call fcn.00486bf4
mov edx, dword [0x6e3294]
mov dword [edx], eax
mov eax, dword [0x6e3f1c]
mov eax, dword [eax]
call fcn.00488598
call fcn.0048be30
mov ebx, eax
mov eax, dword [0x6e3294]
mov eax, dword [eax]
sub ebx, dword [eax + 0x48]
sar ebx, 1
jns 0x606d7c
adc ebx, 0
mov eax, dword [0x6e3f1c]
mov eax, dword [eax]
call fcn.00488598
call fcn.0048bde4
add ebx, eax
mov edx, ebx
mov eax, dword [0x6e3294]
mov eax, dword [eax]
call fcn.0046cb04
mov eax, dword [0x6e3f1c]
mov eax, dword [eax]
call fcn.00488598
call fcn.0048bdfc
mov ebx, eax
mov eax, dword [0x6e3294]
mov eax, dword [eax]
sub ebx, dword [eax + 0x4c]
sar ebx, 1
jns 0x606dc1
adc ebx, 0
mov eax, dword [0x6e3f1c]
mov eax, dword [eax]
call fcn.00488598
call fcn.0048be18
add ebx, eax
mov edx, ebx
mov eax, dword [0x6e3294]
mov eax, dword [eax]
call fcn.0046cb28
lea eax, [ebp - 0x38]
mov edx, dword [0x6e3e34]
mov edx, dword [edx]
mov ecx, dword [0x6e64a0]
mov edx, dword [ecx + edx*4]
call fcn.00404e54
mov edx, dword [ebp - 0x38]
mov eax, dword [0x6e3294]
mov eax, dword [eax]
call fcn.0046d3c4
lea edx, [ebp - 0x3c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x6e3294]
mov eax, dword [eax]
mov eax, dword [eax + 0x2fc]
call fcn.004a1eb8
lea edx, [ebp - 0x40]
mov eax, dword [0x6e43a4]
mov eax, dword [eax]
call fcn.005d1e94
mov edx, dword [ebp - 0x40]
mov eax, dword [0x6e3294]
mov eax, dword [eax]
mov eax, dword [eax + 0x304]
call fcn.004a20c0
mov eax, dword [0x6e6230]
mov eax, dword [eax]
mov edx, dword [0x6e403c]
mov edx, dword [edx + eax*4]
mov eax, dword [0x6e3294]
mov eax, dword [eax]
mov eax, dword [eax + 0x300]
call fcn.004a20c0
mov eax, dword [0x6e3294]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xec]
dec eax
jne 0x606eab
push 0
push 0
push 0
mov eax, dword [0x6e5570]
mov eax, dword [eax]
call fcn.0040508c
push eax
push 0x606f0c
mov eax, dword [0x6e3f1c]
mov eax, dword [eax]
call fcn.00473d08
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, esi
call fcn.00403c70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x606ef6
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.004052f0
lea eax, [ebp - 0x38]
call fcn.00404ba0
lea eax, [ebp - 0x34]
mov edx, 5
call fcn.004052f0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004052f0
ret