Function at 0x40e830
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
cmp byte [0x4822c1], 0
jne 0x40e851
push 0x8001
mov byte [0x4822c1], 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x14
call fcn.00406760
add esp, 4
mov dword [ebp - 0x24], eax
test eax, eax
je 0x40e886
mov dword [eax], 0x474f64
mov dword [eax + 4], 1
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0xffffffff
mov dword [eax + 0x10], 0xffffffff
jmp 0x40e88b
xor eax, eax
mov dword [ebp - 0x24], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov byte [ebp - 1], 1
mov dword [ebp - 0x18], edi
test ebx, ebx
je 0x40ea3d
mov eax, dword [ebx]
xor esi, esi
test eax, eax
je 0x40e8c4
lea ebx, [ebx]
push eax
call fcn.0040cb40
inc esi
inc eax
add edi, eax
add esp, 4
mov eax, dword [ebx + esi*4]
test eax, eax
jne 0x40e8b0
inc esi
lea eax, [edi + esi*2]
lea eax, [eax*2 + 2]
push eax
call fcn.0042c6bd
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x40ea3a
lea ecx, [esi*4]
push ecx
push dword [ebp + 0xc]
lea eax, [ecx + ebx]
push ebx
mov dword [ebp - 0x18], eax
call fcn.00422560
add esp, 0xc
cmp esi, 1
jbe 0x40e9b6
mov edi, dword [ebx + 4]
xor ecx, ecx
mov dword [ebp - 0x10], ecx
test edi, edi
je 0x40e9b6
lea eax, [ebx + ecx*4]
mov ebx, dword [eax]
mov dword [ebp - 0x28], eax
xor eax, eax
push 0x3d
mov dword [ebp - 0xc], ebx
cmp word [ebx], 0x3d
setne al
dec eax
and eax, 2
add eax, ebx
push eax
call fcn.004085e0
mov esi, eax
add esp, 8
test esi, esi
je 0x40e94c
sub esi, ebx
add esi, 2
sar esi, 1
jmp 0x40e957
push ebx
call fcn.0040cb40
add esp, 4
mov esi, eax
xor ecx, ecx
cmp word [edi], 0x3d
push 0x3d
setne cl
dec ecx
and ecx, 2
add ecx, edi
push ecx
call fcn.004085e0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40e980
sub ebx, edi
add ebx, 2
sar ebx, 1
jmp 0x40e98b
push edi
call fcn.0040cb40
add esp, 4
mov ebx, eax
cmp esi, ebx
jae 0x40e9f9
push esi
push edi
push dword [ebp - 0xc]
call fcn.0040cd10
add esp, 0xc
test eax, eax
jne 0x40ea1c
mov ecx, dword [ebp - 0x10]
inc ecx
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov edi, dword [ebx + ecx*4 + 4]
test edi, edi
jne 0x40e918
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov esi, dword [edi]
test esi, esi
je 0x40e9f2
push esi
call fcn.0040cb40
add esp, 4
mov dword [ebp - 0x28], eax
test eax, eax
je 0x40e9e5
push esi
push ebx
call fcn.004099d0
mov eax, dword [ebp - 0x28]
add esp, 8
lea ebx, [ebx + eax*2]
add ebx, 2
mov esi, dword [edi + 4]
add edi, 4
test esi, esi
jne 0x40e9c2
mov edi, dword [ebp - 0x14]
xor eax, eax
mov word [ebx], ax
jmp 0x40ea3d
push ebx
push edi
push dword [ebp - 0xc]
call fcn.0040cd10
add esp, 0xc
test eax, eax
jne 0x40ea1c
cmp esi, ebx
ja 0x40ea1e
push edi
push dword [ebp - 0xc]
call fcn.00406e40
add esp, 8
test eax, eax
jle 0x40e9a0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov dword [ecx + 4], eax
xor eax, eax
mov dword [ecx], edi
mov ecx, dword [ebp - 0x10]
test ecx, ecx
setne al
sub ecx, eax
jmp 0x40e9a4
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp + 0x14]
or ecx, 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
test ebx, ebx
je 0x40ea74
cmp ebx, ecx
je 0x40ea74
push 2
push 1
push 0
lea eax, [ebp - 8]
push eax
call esi
push eax
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp + 0x18]
test ebx, ebx
je 0x40ea9a
cmp ebx, 0xffffffff
je 0x40ea9a
push 2
push 1
push 0
lea eax, [ebp - 0x1c]
push eax
call esi
push eax
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp + 0x1c]
test ebx, ebx
je 0x40eac0
cmp ebx, 0xffffffff
je 0x40eac0
push 2
push 1
push 0
lea eax, [ebp - 0x20]
push eax
call esi
push eax
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x40ebd5
cmp dword [ebp + 8], 0
je 0x40ebd5
cmp dword [ebp - 0x18], 0
jne 0x40eaeb
cmp dword [ebp + 0xc], 0
jne 0x40ebd5
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x7c], 0x44
mov dword [ebp - 0x50], 0x100
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], edx
cmp ecx, 0xffffffff
jne 0x40eb75
push 0xfffffffffffffff6
call eax
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp edx, 0xffffffff
jne 0x40eb81
push 0xfffffffffffffff5
call eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x3c], 0xffffffff
jne 0x40eb92
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x18]
push 0
push 1
push 0
push 0
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40ebc8
push dword [ebp - 0x34]
call esi
mov eax, dword [ebp - 0x30]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x38]
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 8]
neg eax
sbb al, al
and byte [ebp - 1], al
test edi, edi
je 0x40ebe5
push edi
call fcn.0042c6a2
mov ecx, dword [ebp - 8]
add esp, 4
test ecx, ecx
je 0x40ebf1
cmp ecx, 0xffffffff
je 0x40ebf1
push ecx
call esi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40ec00
cmp eax, 0xffffffff
je 0x40ec00
push eax
call esi
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x40ec0f
cmp eax, 0xffffffff
je 0x40ec0f
push eax
call esi
cmp byte [ebp - 1], 0
jne 0x40ec40
test ebx, ebx
je 0x40ec40
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 4]
cmp eax, fcn.00410570
jne 0x40ec35
call fcn.00410570
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret