Function at 0x405ca0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x9c
push ebx
mov ebx, dword [esp + 0xa4]
push ebp
push esi
mov esi, ecx
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov ebp, dword [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebp
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.__s___s
add edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [edx + ecx + 0x104]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push ebp
push ebx
push str.__s___s
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x78]
add esp, 0x10
rep stosd dword es:[edi], eax
lea edx, [esp + 0x1c]
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x68]
mov cx, word [esp + 0xb8]
push edx
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push edi
push 0
mov dword [esp + 0x90], 0x44
mov dword [esp + 0xbc], 1
mov word [esp + 0xc0], cx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405f1b
push edi
push str.The_process_initiated
mov ecx, esi
call fcn.00406f70
mov eax, dword [esp + 0xbc]
test eax, eax
je 0x405eda
mov ebx, dword [sym.imp.USER32.dll_PeekMessageA]
mov dword [esp + 0x14], 0
mov ebp, dword [esi + 0x304]
xor edi, edi
push 1
push edi
push edi
lea ecx, [esp + 0x38]
or ebp, 0x8000000
push edi
push ecx
mov dword [esi + 0x304], ebp
call ebx
test eax, eax
je 0x405ddb
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
lea ecx, [esp + 0x38]
push 0
push ecx
call ebx
test eax, eax
jne 0x405db2
mov edx, dword [esp + 0x1c]
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, eax
cmp ebp, 0x102
jne 0x405e56
mov eax, dword [esp + 0x24]
push eax
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x405e56
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x14], 0x14
jbe 0x405e56
mov ecx, dword [esp + 0x10]
push ecx
push str.The_process_executing
mov ecx, esi
call fcn.00406f70
push edi
lea edx, [esp + 0x4c]
push str._08lX
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x48]
mov ecx, esi
push eax
push str.Process_Handle
call fcn.00406f70
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
inc ecx
cmp ebp, 0x102
mov dword [esp + 0x14], ecx
jne 0x405e6f
test edi, edi
jne 0x405d8e
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x405e8b
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0xc0]
test eax, eax
je 0x405e9c
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
mov edx, dword [esp + 0x10]
mov ecx, esi
push edx
push str.The_process_terminates
call fcn.00406f70
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x48]
push eax
push str.0x_08lX
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x48]
mov ecx, esi
push edx
push str.The_process_exit_code
call fcn.00406f70
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
mov ecx, dword [esp + 0x20]
push ecx
call ebx
mov edx, dword [esi + 0x304]
and edx, 0xf7ffffff
mov eax, edx
mov dword [esi + 0x304], edx
test eax, 0x10000000
je 0x405f1b
mov edx, dword [esi]
and eax, 0xefffffff
mov ecx, esi
mov dword [esi + 0x304], eax
call dword [edx + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x9c
ret 0x14