Function at 0x40cfa0
Capabilities:
Create process on windows
Create thread
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e8ca3
mov eax, dword fs:[0]
push eax
sub esp, 0x65c
mov eax, dword [0x529474]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x117]
push ebx
push eax
mov byte [ebp - 0x118], bl
call fcn.00416190
push 0x103
lea ecx, [ebp - 0x21b]
push ebx
push ecx
mov byte [ebp - 0x21c], bl
call fcn.00416190
push 0x103
lea edx, [ebp - 0x31f]
push ebx
push edx
mov byte [ebp - 0x320], bl
call fcn.00416190
push 0x103
lea eax, [ebp - 0x423]
push ebx
push eax
mov byte [ebp - 0x424], bl
call fcn.00416190
add esp, 0x30
lea ecx, [ebp - 0x64c]
push ecx
call fcn.0040f9d0
lea esi, [ebp - 0x660]
mov dword [ebp - 4], ebx
mov byte [ebp - 0x64d], 1
call fcn.004051a0
mov dword [ebp - 0x668], ebx
mov dword [ebp - 0x664], ebx
mov byte [ebp - 4], 2
call fcn.004049a0
call fcn.00407030
test al, al
jne 0x40d0f2
mov byte [ebp - 4], bl
mov dword [ebp - method.Thread.virtual_0], vtable.Thread.0
cmp byte [ebp - 0x654], bl
je 0x40d09e
mov ecx, esi
mov byte [ebp - 0x653], 1
call dword [0x5259e0]
call fcn.00404340
mov eax, dword [0x539890]
inc eax
mov dword [0x539890], eax
cmp eax, 0x22dc
jbe 0x40d0b7
xor eax, eax
mov dword [0x539890], eax
and eax, 0x189
or eax, 0x24
mov dword [0x53e928], eax
mov eax, dword [ebp - 0x65c]
cmp eax, ebx
je 0x40d0d5
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea edx, [ebp - 0x64c]
push edx
mov dword [ebp - 4], 0xffffffff
call fcn.0040d870
mov eax, 1
jmp 0x40d846
call fcn.00408f40
mov edi, dword [ebp - 0x664]
mov dword [0x53e928], 0x3ff1
cmp byte [0x53e92d], bl
jne 0x40d46b
cmp byte [ebp - 0x64d], bl
jne 0x40d12c
push 0x493e0
mov byte [ebp - 0x64d], bl
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x104
lea eax, [ebp - 0x118]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
cmp eax, ebx
jbe 0x40d465
push ebx
push ebx
push 0x104
lea ecx, [ebp - 0x424]
push ecx
push 0x104
lea edx, [ebp - 0x21c]
push edx
push 0x104
lea eax, [ebp - 0x320]
push eax
lea ecx, [ebp - 0x118]
push ecx
call fcn.00413cf2
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x320]
push eax
push str._s_s
lea edx, [ebp - 0x118]
call fcn.0040e860
add esp, 0x30
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
test eax, eax
je 0x40d465
cmp edi, ebx
jne 0x40d22f
lea edx, [ebp - 0x424]
push edx
push 1
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov edi, eax
mov dword [ebp - 0x664], edi
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp edi, ebx
je 0x40d209
cmp eax, 0xb7
jne 0x40d22f
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0x660]
mov byte [ebp - 4], bl
call fcn.00405240
lea eax, [ebp - 0x64c]
push eax
mov dword [ebp - 4], 0xffffffff
call fcn.0040d870
jmp 0x40d844
lea eax, [ebp - 0x660]
mov byte [ebp - 4], bl
call fcn.00405240
lea ecx, [ebp - 0x64c]
push ecx
mov dword [ebp - 4], 0xffffffff
call fcn.0040d870
jmp 0x40d844
call fcn.0040c780
mov eax, dword [0x539a8c]
inc eax
mov dword [0x539a8c], eax
cmp eax, 0x22dc
jbe 0x40d24d
xor eax, eax
mov dword [0x539a8c], eax
and eax, 0x189
or eax, 0x24
mov dword [0x53e928], eax
call fcn.0040c820
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d262
sub eax, edx
cmp eax, 1
jb 0x40d46b
mov eax, dword [0x539a90]
inc eax
mov dword [0x539a90], eax
cmp eax, 0x22dc
jbe 0x40d28d
xor eax, eax
mov dword [0x539a90], eax
and eax, 0x189
or eax, 0x24
mov dword [0x53e928], eax
call fcn.0040c850
mov dword [0x534fe0], eax
call fcn.0040cec0
test al, al
jne 0x40d46b
call fcn.0040c710
call fcn.0040af40
push ebx
call fcn.0041413d
push eax
call fcn.004140d4
add esp, 8
call fcn.004140e6
cdq
mov ecx, 3
idiv ecx
movzx eax, dl
sub eax, ebx
je 0x40d2ef
dec eax
je 0x40d2e8
push 0x5376b4
jmp 0x40d2f4
push 0x537690
jmp 0x40d2f4
push 0x537668
push 0x104
push 0x53e998
call fcn.00412f5b
add esp, 0xc
push 0x537650
push 0x53e980
push 0x53e97c
push ebx
push 0x537120
push 0x53e998
call fcn.004d89d0
add esp, 0x18
cmp al, bl
je 0x40d107
mov eax, dword [0x539a94]
inc eax
mov dword [0x539a94], eax
cmp eax, 0x22dc
jbe 0x40d349
xor eax, eax
mov dword [0x539a94], eax
push 0x537650
push 0x53e988
push 0x53e984
push ebx
and eax, 0x189
or eax, 0x24
push 0x537130
push 0x53e998
mov dword [0x53e928], eax
call fcn.004d89d0
add esp, 0x18
cmp al, bl
je 0x40d107
push 0x537650
push 0x53e990
push 0x53e98c
push ebx
push 0x537140
push 0x53e998
mov dword [0x53e928], 0x3ff1
call fcn.004d89d0
add esp, 0x18
cmp al, bl
je 0x40d107
mov eax, dword [0x539a98]
inc eax
mov dword [0x539a98], eax
cmp eax, 0x22dc
jbe 0x40d3cd
xor eax, eax
mov dword [0x539a98], eax
and eax, 0x189
or eax, 0x24
lea esi, [ebp - 0x64c]
mov dword [0x53e928], eax
call fcn.004111f0
cmp al, bl
je 0x40d107
lea esi, [ebp - 0x660]
mov dword [0x53e928], 0x3ff1
call fcn.004087a0
test al, al
je 0x40d107
push ebx
push ebx
push 0x40c920
call fcn.00413a8a
mov ecx, eax
mov eax, dword [0x539a9c]
inc eax
add esp, 0xc
mov dword [ebp - 0x668], ecx
mov dword [0x539a9c], eax
cmp eax, 0x22dc
jbe 0x40d43a
xor eax, eax
mov dword [0x539a9c], eax
and eax, 0x189
or eax, 0x24
mov dword [0x53e928], eax
cmp ecx, 0xffffffff
je 0x40d46b
lea esp, [esp]
cmp byte [0x53e92d], bl
jne 0x40d46b
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x40d450
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov eax, dword [0x53e978]
mov byte [0x53e92d], 1
cmp eax, ebx
je 0x40d490
push eax
call fcn.00412a19
add esp, 4
mov dword [0x53e978], ebx
mov dword [0x53e974], ebx
mov edx, dword [ebp - 0x64c]
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x64c]
call eax
mov eax, dword [0x539b40]
inc eax
mov dword [0x539b40], eax
cmp eax, 0x22dc
jbe 0x40d4ba
xor eax, eax
mov dword [0x539b40], eax
mov esi, dword [sym.imp.KERNEL32.DLL_Sleep]
and eax, 0x189
or eax, 0x24
mov dword [0x53e928], eax
lea ecx, [ecx]
cmp byte [ebp - 0x640], bl
je 0x40d4de
push 0xa
call esi
jmp 0x40d4d0
mov eax, dword [ebp - 0x648]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov byte [ebp - 0x63f], bl
cmp eax, ebx
je 0x40d4f7
push eax
call edi
mov eax, dword [0x539894]
inc eax
mov dword [ebp - 0x648], ebx
mov dword [0x539894], eax
cmp eax, 0x22dc
jbe 0x40d515
mov dword [0x539894], ebx
mov eax, dword [0x5398fc]
inc eax
mov dword [0x5398fc], eax
cmp eax, 0x22dc
jbe 0x40d52e
xor eax, eax
mov dword [0x5398fc], eax
mov edx, dword [ebp - 0x660]
and eax, 0x189
or eax, 0x24
mov dword [0x53e928], eax
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x660]
call eax
lea esp, [esp]
cmp byte [ebp - 0x654], bl
je 0x40d562
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x40d550
mov eax, dword [ebp - 0x65c]
mov byte [ebp - 0x653], bl
cmp eax, ebx
je 0x40d575
push eax
call edi
mov eax, dword [0x539894]
inc eax
mov dword [ebp - 0x65c], ebx
mov dword [0x539894], eax
cmp eax, 0x22dc
jbe 0x40d594
xor eax, eax
mov dword [0x539894], eax
mov ecx, dword [ebp - 0x668]
and eax, 0x189
push 0xffffff
or eax, 0x24
push ecx
mov dword [0x53e928], eax
call dword [0x53e944]
mov eax, dword [0x53e930]
cmp eax, ebx
je 0x40d629
push eax
mov dword [0x53e934], ebx
mov dword [0x53e938], ebx
mov dword [0x53e93c], ebx
mov dword [0x53e940], ebx
mov dword [0x53e944], ebx
mov dword [0x53e948], ebx
mov dword [0x53e94c], ebx
mov dword [0x53e950], ebx
mov dword [0x53e954], ebx
mov dword [0x53e958], ebx
mov dword [0x53e95c], ebx
mov dword [0x53e960], ebx
mov dword [0x53e964], ebx
mov dword [0x53e968], ebx
mov dword [0x53e96c], ebx
mov dword [0x53e970], ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov dword [0x53e930], ebx
mov eax, dword [0x53e97c]
cmp eax, ebx
je 0x40d649
cmp dword [0x53e980], ebx
je 0x40d649
push eax
call fcn.00412a19
add esp, 4
mov dword [0x53e980], ebx
mov eax, dword [0x53e984]
cmp eax, ebx
je 0x40d669
cmp dword [0x53e988], ebx
je 0x40d669
push eax
call fcn.00412a19
add esp, 4
mov dword [0x53e988], ebx
mov eax, dword [0x53e98c]
cmp eax, ebx
je 0x40d689
cmp dword [0x53e990], ebx
je 0x40d689
push eax
call fcn.00412a19
add esp, 4
mov dword [0x53e990], ebx
cmp byte [0x53e92e], bl
je 0x40d6b2
push 0x104
lea edx, [ebp - 0x118]
push edx
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push ebx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.DLL_WinExec]
mov dword [ebp - 4], 1
jmp 0x40d6d0
mov eax, dword [ebp - 0x664]
cmp eax, ebx
je 0x40d6dd
push eax
call edi
mov byte [ebp - 4], bl
mov esi, vtable.Thread.0
mov dword [ebp - 0x660], esi
cmp byte [ebp - 0x654], bl
je 0x40d755
lea ecx, [ebp - 0x660]
mov byte [ebp - 0x653], 1
call dword [0x5259e0]
cmp byte [ebp - 0x654], bl
je 0x40d720
mov edi, edi
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp byte [ebp - 0x654], bl
jne 0x40d710
mov eax, dword [ebp - 0x65c]
mov byte [ebp - 0x653], bl
cmp eax, ebx
je 0x40d733
push eax
call edi
mov eax, dword [0x539894]
inc eax
xor ecx, ecx
mov dword [ebp - 0x65c], ecx
mov dword [0x539894], eax
cmp eax, 0x22dc
jbe 0x40d75b
mov dword [0x539894], ebx
jmp 0x40d75b
mov ecx, dword [ebp - 0x65c]
mov eax, dword [0x539890]
inc eax
mov dword [0x539890], eax
cmp eax, 0x22dc
jbe 0x40d774
xor eax, eax
mov dword [0x539890], eax
and eax, 0x189
or eax, 0x24
mov dword [0x53e928], eax
cmp ecx, ebx
je 0x40d788
push ecx
call edi
lea ecx, [ebp - 0x638]
mov dword [ebp - 4], 4
call fcn.004d87b0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x64c], esi
cmp byte [ebp - 0x640], bl
je 0x40d811
lea ecx, [ebp - 0x64c]
mov byte [ebp - 0x63f], 1
call dword [0x5259e0]
cmp byte [ebp - 0x640], bl
je 0x40d7dc
mov esi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xa
call esi
cmp byte [ebp - 0x640], bl
jne 0x40d7d0
mov eax, dword [ebp - 0x648]
mov byte [ebp - 0x63f], bl
cmp eax, ebx
je 0x40d7ef
push eax
call edi
mov eax, dword [0x539894]
inc eax
xor ecx, ecx
mov dword [ebp - 0x648], ecx
mov dword [0x539894], eax
cmp eax, 0x22dc
jbe 0x40d817
mov dword [0x539894], ebx
jmp 0x40d817
mov ecx, dword [ebp - 0x648]
mov eax, dword [0x539890]
inc eax
mov dword [0x539890], eax
cmp eax, 0x22dc
jbe 0x40d830
xor eax, eax
mov dword [0x539890], eax
and eax, 0x189
or eax, 0x24
mov dword [0x53e928], eax
cmp ecx, ebx
je 0x40d844
push ecx
call edi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004123d1
mov esp, ebp
pop ebp
ret