Function at 0x649fe8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x294], edx
mov dword [ebp - 0x290], edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b558
lea eax, [ebp - 0x278]
mov edx, dword [0x41f398]
call fcn.0040c7ac
xor eax, eax
push ebp
push 0x64a2dd
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x27c]
mov eax, dword [ebp - 4]
call fcn.00431278
mov edx, dword [ebp - 0x27c]
lea eax, [ebp - 4]
call fcn.0040b89c
lea eax, [ebp - 0x280]
mov ecx, 0x64a2f8
mov edx, dword [ebp - 4]
call fcn.0040c260
mov eax, dword [ebp - 0x280]
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
call fcn.00428f58
test eax, eax
jne 0x64a27a
mov eax, dword [ebp - 0x264]
mov edx, 0x64a310
call fcn.0040c398
je 0x64a25c
mov eax, dword [ebp - 0x264]
mov edx, 0x64a320
call fcn.0040c398
je 0x64a25c
mov eax, dword [ebp - 0x268]
and eax, 0x10
cmp eax, 0x10
je 0x64a233
xor eax, eax
push ebp
push 0x64a227
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 4]
push 0x64a334
push dword [ebp - 0x264]
lea eax, [ebp - 0x284]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x284]
call fcn.00428fe8
test al, al
jne 0x64a21d
mov eax, dword [ebp - 0x264]
mov edx, 0x64a344
call fcn.0040c398
jne 0x64a149
push 0
push 0
push 0x64a35c
push 0x64a3a0
push 0
push 0
call sub.shell32.dll_ShellExecuteW
push 0x7d0
call sub.kernel32.dll_Sleep
jmp 0x64a185
mov eax, dword [ebp - 0x268]
and eax, 1
dec eax
jne 0x64a185
push dword [ebp - 4]
push 0x64a334
push dword [ebp - 0x264]
lea eax, [ebp - 0x288]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x288]
mov cl, 1
mov edx, 0x80
call fcn.00428dd4
push dword [ebp - 4]
push 0x64a334
push dword [ebp - 0x264]
lea eax, [ebp - 0x28c]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x28c]
call fcn.00428fe8
test al, al
jne 0x64a21d
cmp dword [0x68a270], 0
je 0x64a21d
mov dl, 1
mov eax, dword [0x68a270]
call fcn.00428a24
test al, al
je 0x64a21d
xor ebx, ebx
jmp 0x64a208
mov eax, dword [0x6823c8]
mov eax, dword [eax]
call fcn.0060c280
push 0x1f4
call sub.kernel32.dll_Sleep
inc ebx
mov eax, dword [0x68a270]
call fcn.0040bffc
mov edx, eax
lea eax, [ebp - 0x290]
call fcn.0040c05c
mov eax, dword [ebp - 0x290]
call fcn.00428fe8
mov dl, 1
mov eax, dword [0x68a270]
call fcn.00428a24
test al, al
je 0x64a21d
cmp ebx, 4
jl 0x64a1cf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64a25c
push dword [ebp - 4]
push 0x64a334
push dword [ebp - 0x264]
lea eax, [ebp - 0x294]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x294]
call fcn.00649fe8
lea eax, [ebp - 0x278]
call fcn.00428fa8
test eax, eax
je 0x64a097
lea eax, [ebp - 0x278]
call fcn.00428fcc
xor eax, eax
push ebp
push 0x64a29a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004295fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64a2a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64a2e4
lea eax, [ebp - 0x294]
mov edx, 7
call fcn.0040b4c4
lea eax, [ebp - 0x278]
mov edx, dword [0x41f398]
call fcn.0040cb78
lea eax, [ebp - 4]
call fcn.0040b464
pop eax
jmp eax