Function at 0x4027ff
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
sub esp, 0x24
mov eax, esp
mov edx, eax
add edx, 0x24
mov dword [eax], 0
add eax, 4
cmp eax, edx
jne 0x40280b
mov ebx, dword [esp + 0x30]
mov eax, 0x410a0c
call fcn.00412170
cmp ebx, eax
jge 0x402855
push dword [esp + 0x30]
mov eax, 0x410a0c
call fcn.00412180
mov ebp, dword [0x410a10]
push dword [ebp + 8]
mov edx, 0x40f0cc
pop ecx
call fcn.004122c0
jne 0x402855
mov dword [esp], 1
mov ebx, dword [esp]
and ebx, ebx
jne 0x402866
mov eax, 3
jmp 0x402c09
push dword [0x410f54]
mov ebp, dword [0x410a10]
push dword [ebp + 0xc]
call fcn.00406580
sub esp, 4
lea ecx, [esp + 8]
pop edx
call fcn.00406000
push dword [0x410f54]
push dword [0x410f54]
push 0x40f0af
push 1
push dword [esp + 0x14]
call fcn.00406710
sub esp, 4
mov edx, dword [0x40f3c8]
add dword [esp], edx
call fcn.004018d5
lea ecx, [esp + 0xc]
pop edx
call fcn.00406000
push dword [0x410f54]
push dword [0x410f54]
push 0x40f0af
push 2
push dword [esp + 0x14]
call fcn.00406710
sub esp, 4
mov edx, dword [0x40f3c8]
add dword [esp], edx
call fcn.004018d5
lea ecx, [esp + 0x10]
pop edx
call fcn.00406000
push dword [0x410f54]
push dword [0x410f54]
push 0x40f0af
push 3
push dword [esp + 0x14]
call fcn.00406710
sub esp, 4
mov edx, dword [0x40f3c8]
add dword [esp], edx
call fcn.004018d5
lea ecx, [esp + 0x14]
pop edx
call fcn.00406000
mov dword [esp + 0x14], 2
push dword [0x410f54]
push dword [esp + 0xc]
call fcn.004064f0
sub esp, 4
lea ecx, [esp + 0x1c]
pop edx
call fcn.00406000
push dword [esp + 0x18]
mov edx, str.setup
pop ecx
call fcn.004122c0
je 0x402977
mov dword [esp + 0x14], 1
jmp 0x402b5d
push dword [esp + 0x18]
mov edx, str.popsel
pop ecx
call fcn.004122c0
je 0x402a4f
push 1
call fcn.0040b830
mov ebx, eax
and ebx, ebx
jne 0x4029c4
mov edx, dword [esp + 0xc]
push dword [0x410f54]
call fcn.0040d6a0
lea ecx, [0x4109d4]
pop edx
call fcn.00406000
mov dword [esp + 0x14], 0
jmp 0x402a4a
mov edx, dword [0x4109a0]
push dword [0x410f54]
call fcn.0040d6a0
lea ecx, [esp + 0xc]
pop edx
call fcn.00406000
mov edx, dword [esp + 0xc]
push dword [0x410f54]
call fcn.0040d6a0
mov edx, 0x40f0db
call fcn.0040d6a0
push dword [0x410f54]
push 1
call fcn.0040b610
mov ebx, eax
add ebx, 0x1e
push ebx
call fcn.00406620
sub esp, 4
pop eax
mov edx, 0x40f0a3
call fcn.0040d6a0
push dword [0x410f54]
push 1
call fcn.0040b6a0
mov ebx, eax
add ebx, 0x1e
push ebx
call fcn.00406620
sub esp, 4
pop eax
lea ecx, [esp + 0x10]
pop edx
call fcn.00406000
jmp 0x402b5d
push dword [0x410f54]
push dword [esp + 0x1c]
call fcn.00407370
sub esp, 4
inc dword [0x410f54]
mov edx, str.explorer.exe
pop ecx
mov dword [0x410f54], ecx
add ecx, dword [0x40f3c8]
call fcn.004122c0
je 0x402abf
mov edx, dword [esp + 0xc]
push dword [0x410f54]
call fcn.0040d6a0
mov edx, 0x40f0ec
call fcn.0040d6a0
mov edx, dword [esp + 0x14]
call fcn.0040d6a0
lea ecx, [esp + 0x10]
pop edx
call fcn.00406000
mov edx, 0x40f00e
lea ecx, [esp + 0x10]
call fcn.00406010
jmp 0x402b5d
push dword [0x410f54]
push dword [esp + 0x1c]
call fcn.004073e0
sub esp, 4
inc dword [0x410f54]
mov edx, 0x40f0ee
pop ecx
mov dword [0x410f54], ecx
add ecx, dword [0x40f3c8]
call fcn.004122c0
je 0x402b00
mov edx, 0x40f00e
lea ecx, [esp + 0x10]
call fcn.00406010
jmp 0x402b5d
push 1
push 0x40f00c
push dword [esp + 0x10]
call fcn.00406410
and eax, eax
je 0x402b5d
push dword [0x410f54]
push dword [esp + 0xc]
call fcn.004019dd
lea ecx, [esp + 0xc]
pop edx
call fcn.00406000
push dword [esp + 0x10]
mov edx, 0x40f00e
pop ecx
call fcn.004122c0
je 0x402b5d
push dword [0x410f54]
push dword [esp + 0xc]
call fcn.00407460
sub esp, 4
lea ecx, [esp + 0x14]
pop edx
call fcn.00406000
mov ebx, dword [esp + 0x14]
cmp ebx, 2
jne 0x402c01
mov dword [esp + 0x1c], 1
push dword [0x410f54]
push 0x40f0af
push 4
push dword [esp + 0x10]
call fcn.00406710
sub esp, 4
lea ecx, [esp + 8]
pop edx
call fcn.00406000
push dword [esp + 4]
mov edx, 0x40f0f2
pop ecx
call fcn.004122c0
je 0x402bb3
mov dword [esp + 0x1c], 3
jmp 0x402bcc
push dword [esp + 4]
mov edx, 0x40f0f6
pop ecx
call fcn.004122c0
je 0x402bcc
mov dword [esp + 0x1c], 2
push dword [esp + 0x1c]
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x14]
push 0
push dword [0x4109a4]
call sub.SHELL32.DLL_ShellExecuteA
mov dword [esp + 0x20], eax
mov ebx, dword [esp + 0x20]
cmp ebx, 0x20
jg 0x402c01
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 0x14]
jmp 0x402c09
push dword [esp + 8]
call fcn.0040d700
push dword [esp + 0x10]
call fcn.0040d700
push dword [esp + 0x18]
call fcn.0040d700
push dword [esp + 0xc]
call fcn.0040d700
push dword [esp + 4]
call fcn.0040d700
add esp, 0x24
pop ebx
pop ebp
ret 4