Function at 0x66c9a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x66c9a8
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x66cc11
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov ecx, 0x66cc2c
mov edx, 0x66cc48
mov eax, dword [0x6868ec]
mov esi, dword [eax]
call dword [esi + 0x14]
test al, al
je 0x66cab1
push 0
mov ecx, 0x66cc60
mov edx, 0x66cc78
mov eax, dword [0x6868ec]
mov esi, dword [eax]
call dword [esi + 0x14]
test al, al
je 0x66cab1
push 0x124
push 0x66cc84
push 0x66ccbc
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x66ccf0
mov edx, 0x66cd10
mov eax, dword [0x6868ec]
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00646cac
mov eax, dword [ebp - 8]
call fcn.0040a13c
push eax
mov eax, ebx
call fcn.0054ab5c
push eax
call sub.user32.dll_MessageBoxW
cmp eax, 6
jne 0x66cab1
push 1
push 0
push 0
push 0x66cd28
lea eax, [ebp - 0x14]
call fcn.0066c900
push dword [ebp - 0x14]
push 0x66cd6c
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x66cda0
mov edx, 0x66cdb8
mov eax, dword [0x6868ec]
mov esi, dword [eax]
call dword [esi + 4]
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040a418
mov eax, dword [ebp - 0x10]
call fcn.0040a13c
push eax
push 0x66cdc4
mov eax, dword [0x68056c]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.shell32.dll_ShellExecuteW
cmp dword [0x6868e8], 0xa
jne 0x66cba7
mov esi, dword [ebx + 0x3ec]
cmp byte [esi + 0x69], 0
je 0x66cb20
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x104]
test al, al
je 0x66cb20
push 0
mov ecx, 0x66cddc
mov edx, 0x66ce08
mov eax, dword [0x6868ec]
mov esi, dword [eax]
call dword [esi + 0x14]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x66ce20
mov edx, 0x66ce4c
mov eax, dword [0x6868ec]
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00646cac
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
xor edx, edx
call fcn.00650d84
mov esi, dword [ebx + 0x454]
cmp byte [esi + 0x69], 0
je 0x66cb8d
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x104]
test al, al
je 0x66cb8d
push 0
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x66ce64
mov edx, 0x66ce98
mov eax, dword [0x6868ec]
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00652fbc
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 4]
call fcn.00646cac
push 0
mov ecx, 0x66ceb0
mov edx, 0x66cee0
mov eax, dword [0x6868ec]
mov esi, dword [eax]
call dword [esi + 0x14]
push eax
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00650d84
mov eax, dword [ebx + 0x3f0]
cmp byte [eax + 0x69], 0
je 0x66cba7
cmp dword [eax + 0x2a0], 0
jne 0x66cba7
call fcn.00648d04
xor eax, eax
push ebp
push 0x66cbe7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6868f0]
call fcn.004078f0
mov eax, dword [0x6868ec]
call fcn.004078f0
mov eax, dword [0x686950]
call fcn.004078f0
mov eax, dword [0x686958]
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x66cbf1
call fcn.00648110
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66cc18
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.004095cc
ret