Function at 0x40c7d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0
lea eax, [ebp - 0x7c]
mov ecx, eax
lea eax, [ebp - 0x94]
mov edx, eax
mov eax, 1
call fcn.00405e00
call fcn.00405f00
push eax
test eax, eax
jne 0x40ca70
mov edx, dword [0x4251f0]
test edx, edx
je 0x40c83e
mov eax, dword [0x426ba0]
call edx
jmp 0x40c843
mov eax, 0x426ba4
mov word [eax], 0
mov cl, 0
mov eax, 0x44
lea ebx, [ebp - 0x50]
mov edx, eax
mov eax, ebx
call fcn.00408390
mov dword [ebp - 0x50], 0x44
mov word [ebp - 0x20], 1
mov edx, dword [ebp - 4]
mov al, 0x22
call fcn.00417f00
test eax, eax
jne 0x40c8b4
mov ebx, dword [0x41d150]
lea edx, [ebp - 0x9c]
mov eax, edx
call fcn.00405f60
mov edx, dword [ebp - 4]
mov eax, dword [0x41d160]
call fcn.00405fa0
mov dword [ebp - 0x9c], eax
mov edx, ebx
call fcn.00405fa0
mov ebx, eax
lea edx, [ebp - 0x6c]
mov eax, edx
call fcn.00405f60
mov dword [ebp - 0x6c], ebx
jmp 0x40c8cc
mov eax, dword [ebp - 4]
call fcn.00405dd0
lea edx, [ebp - 0x6c]
mov eax, edx
call fcn.00405f60
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x40c92f
mov ebx, dword [0x41d170]
lea edx, [ebp - 0x9c]
mov eax, edx
call fcn.00405f60
mov esi, dword [ebp - 8]
lea edx, [ebp - 0xa0]
mov eax, edx
call fcn.00405f60
mov edx, dword [0x41d180]
mov eax, dword [ebp - 0x6c]
call fcn.00405fa0
mov dword [ebp - 0xa0], eax
mov edx, esi
call fcn.00405fa0
mov dword [ebp - 0x9c], eax
mov edx, ebx
call fcn.00405fa0
mov ebx, eax
lea edx, [ebp - 0x6c]
mov eax, edx
call fcn.00405f60
mov dword [ebp - 0x6c], ebx
jmp 0x40c939
mov dl, 0
lea eax, [ebp - 0x6c]
call fcn.00406290
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0x20
push dword [0x41f900]
push 0
push 0
mov eax, dword [ebp - 0x6c]
test eax, eax
jne 0x40c95d
mov eax, 0x4254a0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x40c9cc
push 1
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xb0], 0xb
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa8], 0
lea eax, [ebp - 0xb0]
push eax
mov ecx, dword [0x41faf8]
mov edx, 0x41d190
mov eax, 0
call fcn.0040cb90
mov dword [ebp - 0x70], eax
call sub.kernel32.dll_GetLastError_2
mov edx, dword [ebp - 0x70]
mov dword [edx + 0xc], eax
mov ecx, ebp
mov edx, 0x40c9bd
mov eax, dword [ebp - 0x70]
call fcn.00417f60
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
push dword [ebp - 0x5c]
call sub.kernel32.dll_CloseHandle_1
push 0xffffffffffffffff
push dword [ebp - 0x64]
call sub.kernel32.dll_WaitForSingleObject_1
cmp eax, 0xffffffff
je 0x40ca05
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x64]
call sub.kernel32.dll_GetExitCodeProcess
push dword [ebp - 0x64]
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xc], eax
jmp 0x40ca70
push 1
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xb0], 0xb
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa8], 0
lea eax, [ebp - 0xb0]
push eax
mov ecx, dword [0x41faf8]
mov edx, 0x41d190
mov eax, 0
call fcn.0040cb90
mov dword [ebp - 0x70], eax
call sub.kernel32.dll_GetLastError_2
mov edx, dword [ebp - 0x70]
mov dword [edx + 0xc], eax
push dword [ebp - 0x64]
call sub.kernel32.dll_CloseHandle_1
mov ecx, ebp
mov edx, 0x40ca61
mov eax, dword [ebp - 0x70]
call fcn.00417f60
call fcn.004062e0
lea edx, [ebp - 0xa0]
mov eax, edx
call fcn.00405f60
mov dword [ebp - 0xa0], 0
lea edx, [ebp - 0x9c]
mov eax, edx
call fcn.00405f60
mov dword [ebp - 0x9c], 0
mov edx, str._t_nAnsiString
lea eax, [ebp - 0x6c]
call fcn.00406370
pop eax
test eax, eax
je 0x40caba
call fcn.00406430
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0xb8]
mov esi, dword [ebp - 0xb4]
leave
ret