Function at 0x4088c0
Capabilities:
Create process on windows
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x164
mov eax, dword [0x4762c4]
xor eax, esp
mov dword [esp + 0x160], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x174]
push edi
mov ecx, esi
xor edi, edi
call fcn.004080a0
test eax, eax
jbe 0x408b93
xor ebx, ebx
jmp 0x408900
cmp dword [0x47780c], 0
mov eax, dword [esi + 4]
jne 0x408a1b
test eax, eax
je 0x408930
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x408935
call fcn.00440a0f
mov eax, dword [esi + 4]
test eax, eax
lea ecx, [ebx + eax]
mov dword [esp + 0x24], ecx
je 0x40895f
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x408964
call fcn.00440a0f
mov eax, dword [esi + 4]
mov ebp, 0x10
cmp dword [ebx + eax + 0x50], ebp
jb 0x40897c
mov edx, dword [ebx + eax + 0x3c]
mov dword [esp + 0x10], edx
jmp 0x408984
lea ecx, [ebx + eax + 0x3c]
mov dword [esp + 0x10], ecx
test eax, eax
je 0x4089a4
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x4089a9
call fcn.00440a0f
mov eax, dword [esi + 4]
cmp dword [ebx + eax + 0x34], ebp
jb 0x4089b8
mov ebp, dword [ebx + eax + 0x20]
jmp 0x4089bc
lea ebp, [ebx + eax + 0x20]
test eax, eax
je 0x4089dc
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x4089e1
call fcn.00440a0f
mov eax, dword [esi + 4]
add eax, ebx
cmp dword [eax + 0x18], 0x10
jb 0x4089f1
mov eax, dword [eax + 4]
jmp 0x4089f4
add eax, 4
mov edx, dword [esp + 0x24]
movzx ecx, byte [edx + 0x70]
mov edx, dword [esp + 0x10]
push ecx
push edx
push ebp
push eax
call fcn.0042d7c0
add esp, 0x10
test al, al
jne 0x408b03
xor al, al
jmp 0x408b95
test eax, eax
je 0x408a3b
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x408a40
call fcn.00440a0f
mov eax, dword [esi + 4]
cmp dword [eax + ebx + 0x50], 0x10
lea eax, [eax + ebx + 0x38]
jb 0x408a53
mov eax, dword [eax + 4]
jmp 0x408a56
add eax, 4
push str._install
push eax
push str._s__s
lea ecx, [esp + 0x78]
push 0x104
push ecx
call fcn.00408310
add esp, 0x14
call fcn.00406560
test eax, eax
je 0x408b03
push 0x40
lea edx, [esp + 0x30]
push 0
push edx
call fcn.00440b30
add esp, 0xc
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x8c]
push edx
push 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x50], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x408a14
mov eax, dword [esp + 0x14]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call ebp
mov edx, dword [esp + 0x18]
push edx
call ebp
call fcn.00406580
mov eax, dword [esi + 4]
test eax, eax
je 0x408b26
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x408b2b
call fcn.00440a0f
mov eax, dword [esi + 4]
cmp byte [ebx + eax + 0x70], 0
je 0x408b7e
test eax, eax
je 0x408b55
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x408b5a
call fcn.00440a0f
mov eax, dword [esi + 4]
add eax, ebx
cmp dword [eax + 0x18], 0x10
jb 0x408b6a
mov eax, dword [eax + 4]
jmp 0x408b6d
add eax, 4
push eax
call fcn.0042d830
add esp, 4
test al, al
je 0x408a14
mov ecx, esi
add edi, 1
add ebx, 0x74
call fcn.004080a0
cmp edi, eax
jb 0x408900
mov al, 1
mov ecx, dword [esp + 0x170]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00440494
add esp, 0x164
ret 4