Function at 0x403b39
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x88
push ebx
xor ebx, ebx
xor ecx, ecx
cmp dword [ebp + 0x78], ebx
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x58], ebx
je 0x403e9e
push esi
mov esi, dword [ebp + 0x7c]
cmp esi, ebx
je 0x403e9d
mov al, byte [esi]
cmp al, 0x77
je 0x403b72
cmp al, 0x72
jne 0x403e9d
mov al, byte [esi + 1]
cmp al, 0x74
jne 0x403b80
mov ecx, 0x4000
jmp 0x403b89
cmp al, 0x62
jne 0x403b89
mov ecx, 0x8000
or ecx, 0x80
push ecx
lea eax, [ebp + 0x40]
push 0x400
push eax
call fcn.00406745
add esp, 0xc
cmp eax, 0xffffffff
je 0x403e9d
push edi
xor edi, edi
cmp byte [esi], 0x77
jne 0x403bbd
xor esi, esi
inc esi
mov dword [ebp + 0x68], ebx
mov dword [ebp + 0x60], esi
jmp 0x403bc7
inc edi
xor esi, esi
mov dword [ebp + 0x68], edi
mov dword [ebp + 0x60], ebx
inc esi
mov dword [ebp + 0x50], esi
mov dword [ebp + 0x4c], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push esi
shl edi, 2
push ebx
lea ecx, [ebp + edi + 0x40]
mov dword [ebp + 0x48], ecx
mov ecx, dword [ecx]
lea edx, [ebp + 0x5c]
push edx
mov edx, ecx
sar edx, 5
mov edx, dword [edx*4 + 0x411800]
push eax
and ecx, 0x1f
push dword [edx + ecx*8]
mov dword [ebp + 0x3c], edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x403e75
mov eax, dword [ebp + 0x48]
push dword [eax]
call fcn.004064e7
push dword [ebp + 0x7c]
mov eax, dword [ebp + 0x60]
push dword [ebp + eax*4 + 0x40]
mov dword [ebp + edi + 0x4c], ebx
call fcn.00404523
add esp, 0xc
cmp eax, ebx
mov dword [ebp + 0x64], eax
je 0x403e75
xor edi, edi
call fcn.00403ae6
cmp eax, ebx
mov dword [ebp + 0x54], eax
je 0x403e5f
push str.COMSPEC
call fcn.00406466
cmp eax, ebx
pop ecx
mov dword [ebp + 0x6c], eax
jne 0x403c81
mov eax, dword [0x411174]
cmp eax, 2
je 0x403c6a
cmp eax, 0xd
jne 0x403c81
test byte [0x411185], 0x80
mov dword [ebp + 0x6c], str.command.com
jne 0x403c81
mov dword [ebp + 0x6c], str.cmd.exe
push 0x44
pop edi
push edi
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.004039d0
mov eax, dword [0x411800]
add esp, 0xc
cmp dword [ebp + 0x68], ebx
mov dword [ebp - 0x18], edi
mov dword [ebp + 0x14], 0x100
jne 0x403cae
mov ecx, dword [ebp + 0x5c]
mov dword [ebp + 0x20], ecx
jmp 0x403cbb
cmp dword [ebp + 0x68], esi
mov ecx, dword [eax]
mov dword [ebp + 0x20], ecx
mov ecx, dword [ebp + 0x5c]
je 0x403cbe
mov ecx, dword [eax + 8]
push dword [ebp + 0x6c]
mov dword [ebp + 0x24], ecx
mov eax, dword [eax + 0x10]
mov dword [ebp + 0x28], eax
call fcn.00404870
push dword [ebp + 0x78]
mov edi, eax
call fcn.00404870
mov esi, str.__c
push esi
add edi, eax
call fcn.00404870
lea eax, [edi + eax + 1]
push eax
call fcn.00404f7a
mov edi, eax
add esp, 0x10
cmp edi, ebx
mov dword [ebp + 0x68], edi
je 0x403e5f
push dword [ebp + 0x6c]
push edi
call fcn.00404e10
push esi
push edi
call fcn.00404e20
push dword [ebp + 0x78]
push edi
call fcn.00404e20
push ebx
push dword [ebp + 0x6c]
call fcn.00406287
add esp, 0x20
cmp eax, 0xffffffff
je 0x403d4b
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp + 0x58], eax
jmp 0x403e31
push str.PATH
call fcn.00406466
mov edi, eax
mov dword [esp], 0x104
call fcn.00404f7a
mov esi, eax
cmp esi, ebx
pop ecx
jne 0x403d78
push dword [ebp + 0x68]
call fcn.0040624f
pop ecx
jmp 0x403e5f
push 0x103
push esi
push edi
jmp 0x403df6
cmp byte [esi], bl
je 0x403e27
push esi
call fcn.00404870
lea edi, [eax + esi - 1]
mov al, byte [edi]
cmp al, 0x5c
pop ecx
jne 0x403da8
push 0x5c
push esi
call fcn.004061f9
pop ecx
pop ecx
cmp edi, eax
jmp 0x403daa
cmp al, 0x2f
je 0x403db9
push 0x40c4dc
push esi
call fcn.00404e20
pop ecx
pop ecx
push dword [ebp + 0x6c]
call fcn.00404870
push esi
mov edi, eax
call fcn.00404870
add edi, eax
cmp edi, 0x104
pop ecx
pop ecx
jae 0x403e27
push dword [ebp + 0x6c]
push esi
call fcn.00404e20
push ebx
push esi
call fcn.00406287
add esp, 0x10
cmp eax, 0xffffffff
jne 0x403e0b
push 0x103
push esi
push dword [ebp + 0x78]
call fcn.0040618a
add esp, 0xc
cmp eax, ebx
mov dword [ebp + 0x78], eax
jne 0x403d81
jmp 0x403e27
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp + 0x68]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp + 0x58], eax
push esi
call fcn.0040624f
mov edi, dword [ebp + 0x68]
pop ecx
push edi
call fcn.0040624f
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
push dword [ebp + 0x5c]
call esi
push dword [ebp + 0x30]
call esi
cmp dword [ebp + 0x58], ebx
mov eax, dword [ebp + 0x54]
je 0x403e5d
mov ecx, dword [ebp + 0x2c]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0x64]
mov dword [eax], ecx
jmp 0x403e9c
mov dword [eax], ebx
push dword [ebp + 0x64]
call fcn.00406134
mov eax, dword [ebp + 0x60]
mov edi, dword [ebp + 0x3c]
pop ecx
mov dword [ebp + eax*4 + 0x4c], ebx
mov dword [ebp + 0x64], ebx
cmp dword [ebp + edi + 0x4c], ebx
je 0x403e86
mov eax, dword [ebp + 0x48]
push dword [eax]
call fcn.004064e7
pop ecx
mov eax, dword [ebp + 0x60]
shl eax, 2
cmp dword [ebp + eax + 0x4c], ebx
je 0x403e9c
push dword [ebp + eax + 0x40]
call fcn.004064e7
pop ecx
pop edi
pop esi
mov eax, dword [ebp + 0x64]
pop ebx
add ebp, 0x70
leave
ret