Function at 0x403910
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x10158
call fcn.00415f60
sub rsp, rax
mov rax, qword [0x00429008]
xor rax, rsp
mov qword [rsp + 0x10110], rax
mov qword [rsp + 0x10150], rbx
mov qword [rsp + 0x10148], rbp
mov qword [rsp + 0x10130], r12
mov qword [rsp + 0x10128], r13
mov r12, r8
mov r13, rcx
mov rbx, rdx
mov qword [rsp + 0x10120], r15
xor r15d, r15d
lea rcx, [rsp + 0x70]
lea r8d, [r15 + 0x68]
xor edx, edx
mov rbp, r9
mov dword [rsp + 0x50], r15d
call fcn.00407340
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
movzx eax, byte [r13 + 6]
or ax, word [rsp + 0xb0]
je 0x4039af
mov word [rsp + 0xb0], 5
jmp 0x4039c5
movzx eax, byte [r13 + 8]
neg al
sbb cx, cx
and cx, 6
mov word [rsp + 0xb0], cx
or dword [rsp + 0xac], 1
add rbx, 0x3e80
mov qword [rsp + 0x10138], rdi
xor eax, eax
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
add rcx, 0x13
cmp rcx, 0xfa0
jae 0x403a4a
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str.Attempting_to_run:__]
mov qword [rdi - 2], rax
mov rax, qword [0x004168f0]
mov qword [rdi + 6], rax
mov rax, qword [0x004168f8]
mov qword [rdi + 0xe], rax
mov rax, qword [0x00416900]
mov qword [rdi + 0x16], rax
mov rax, qword [0x00416908]
mov qword [rdi + 0x1e], rax
movzx eax, word [0x00416910]
mov word [rdi + 0x26], ax
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasw ax, word [rdi]
mov rdi, rbx
not rcx
lea rdx, [rcx - 1]
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
add rdx, rcx
cmp rdx, 0xfa0
jae 0x403aa3
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
xor ecx, ecx
nop
movzx eax, word [r12 + rcx]
add rcx, 2
test ax, ax
mov word [rdi + rcx - 4], ax
jne 0x403a90
cmp byte [r13 + 7], r15b
mov qword [rsp + 0x10140], rsi
jne 0x403af2
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
add rcx, 0x28
cmp rcx, 0xfa0
jae 0x403b31
mov rdi, rbx
mov rcx, 0xffffffffffffffff
lea rsi, str._.__Blocking_until_child_thread_returns._n
repne scasw ax, word [rdi]
mov ecx, 0x2a
sub rdi, 2
rep movsw word [rdi], word [rsi]
jmp 0x403b31
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
add rcx, 0x2c
cmp rcx, 0xfa0
jae 0x403b31
mov rdi, rbx
mov rcx, 0xffffffffffffffff
lea rsi, str._.__Not_blocking_until_child_thread_returns._n
repne scasw ax, word [rdi]
mov ecx, 0x2e
sub rdi, 2
rep movsw word [rdi], word [rsi]
test rbp, rbp
je 0x403c12
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
add rcx, 0x27
cmp rcx, 0xfa0
jae 0x403b79
mov rdi, rbx
mov rcx, 0xffffffffffffffff
lea rsi, str.Using_the_following_working_directory:__
repne scasw ax, word [rdi]
mov ecx, 0x29
sub rdi, 2
rep movsw word [rdi], word [rsi]
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
mov rdi, rbx
not rcx
lea rdx, [rcx - 1]
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
add rdx, rcx
cmp rdx, 0xfa0
jae 0x403bd2
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
xor ecx, ecx
nop
movzx eax, word [rcx + rbp]
add rcx, 2
test ax, ax
mov word [rdi + rcx - 4], ax
jne 0x403bc0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
add rcx, 1
cmp rcx, 0xfa0
jae 0x403c12
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x004167c4]
mov dword [rdi - 2], eax
movzx eax, word [0x004167c8]
mov word [rdi + 2], ax
cmp byte [r13 + 1], r15b
je 0x403c51
lea r8, str.Debug_Information
xor r9d, r9d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [0x004165e4]
mov rcx, rbx
sub rcx, rdx
nop
nop
movzx eax, word [rdx]
add rdx, 2
test ax, ax
mov word [rcx + rdx - 2], ax
jne 0x403c40
lea rax, [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rdx, r12
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r15
xor ecx, ecx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r12, qword [rsp + 0x10130]
test eax, eax
jne 0x403d01
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
add rcx, 0x10
cmp rcx, 0xfa0
jae 0x403cfa
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str.Execution_Failed_]
mov qword [rdi - 2], rax
mov rax, qword [0x004167a8]
mov qword [rdi + 6], rax
mov rax, qword [0x004167b0]
mov qword [rdi + 0xe], rax
mov rax, qword [0x004167b8]
mov qword [rdi + 0x16], rax
mov eax, dword [0x004167c0]
mov dword [rdi + 0x1e], eax
xor eax, eax
jmp 0x403ed4
cmp byte [r13 + 7], r15b
jne 0x403ecf
mov edx, dword [0x00429000]
test edx, edx
jne 0x403d1c
mov edx, 0xffffffff
jmp 0x403d22
imul edx, edx, 0x3e8
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x00429000], r15d
je 0x403e56
mov rax, qword [str.TASKKILL.exe__F__T__PID]
lea rcx, [rsp + 0x110]
xor edx, edx
mov qword [rcx], rax
mov rax, qword [0x00416770]
mov r8d, 0xffcc
mov qword [rcx + 8], rax
mov rax, qword [0x00416778]
mov qword [rcx + 0x10], rax
mov rax, qword [0x00416780]
mov qword [rcx + 0x18], rax
mov rax, qword [0x00416788]
mov qword [rcx + 0x20], rax
mov rax, qword [0x00416790]
mov qword [rcx + 0x28], rax
movzx eax, word [0x00416798]
mov word [rcx + 0x30], ax
lea rcx, [rsp + 0x142]
call fcn.00407340
xor eax, eax
mov word [rsp + 0xf8], r15w
mov qword [rsp + 0xfa], rax
mov qword [rsp + 0x102], rax
mov word [rsp + 0x10a], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0xf8]
mov r8d, 0xa
mov ecx, eax
call fcn.00407210
lea rdi, [rsp + 0x110]
mov rcx, 0xffffffffffffffff
mov rsi, rax
xor eax, eax
repne scasw ax, word [rdi]
xor edx, edx
nop
nop
movzx ecx, word [rsi + rdx]
add rdx, 2
test cx, cx
mov word [rdi + rdx - 4], cx
jne 0x403e00
lea rax, [rsp + 0xe0]
lea rdx, [rsp + 0x110]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r15
xor ecx, ecx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
add rcx, 0x12
cmp rcx, 0xfa0
jae 0x403ec9
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str.Execution_complete.]
mov qword [rdi - 2], rax
mov rax, qword [0x00416748]
mov qword [rdi + 6], rax
mov rax, qword [0x00416750]
mov qword [rdi + 0xe], rax
mov rax, qword [0x00416758]
mov qword [rdi + 0x16], rax
mov rax, qword [0x00416760]
mov qword [rdi + 0x1e], rax
mov eax, dword [rsp + 0x50]
jmp 0x403ed4
mov eax, 1
mov r15, qword [rsp + 0x10120]
mov r13, qword [rsp + 0x10128]
mov rdi, qword [rsp + 0x10138]
mov rsi, qword [rsp + 0x10140]
mov rbp, qword [rsp + 0x10148]
mov rbx, qword [rsp + 0x10150]
mov rcx, qword [rsp + 0x10110]
xor rcx, rsp
call fcn.00407310
add rsp, 0x10158
ret