Function at 0x408b70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1d
push 0
push 0
dec ecx
jne 0x408b78
push ecx
mov eax, 0x408b30
call fcn.00404f54
xor eax, eax
push ebp
push 0x4094ab
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402700
dec eax
jne 0x408c15
lea eax, [ebp - 0x10]
call fcn.00405e38
mov edx, dword [ebp - 0x10]
mov eax, 0x40b604
call fcn.00403314
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00402760
mov eax, dword [ebp - 0x14]
mov edx, 0x4094c0
call fcn.004035ac
jne 0x408bf0
push 1
push 0
push 0
mov eax, dword [0x40b604]
call fcn.00403650
push eax
push 0x4094c8
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x408c15
push 1
push 0
push 0
lea edx, [ebp - 0x18]
mov eax, 1
call fcn.00402760
mov eax, dword [ebp - 0x18]
call fcn.00403650
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00402700
cmp eax, 2
jne 0x408c58
push 1
push 0
push 0
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.00402760
mov eax, dword [ebp - 0x1c]
call fcn.00403650
push eax
lea edx, [ebp - 0x20]
mov eax, 1
call fcn.00402760
mov eax, dword [ebp - 0x20]
call fcn.00403650
push eax
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00402700
cmp eax, 3
jne 0x408caf
push 1
push 0
lea edx, [ebp - 0x24]
mov eax, 2
call fcn.00402760
mov eax, dword [ebp - 0x24]
call fcn.00403650
push eax
lea edx, [ebp - 0x28]
mov eax, 3
call fcn.00402760
mov eax, dword [ebp - 0x28]
call fcn.00403650
push eax
lea edx, [ebp - 0x2c]
mov eax, 1
call fcn.00402760
mov eax, dword [ebp - 0x2c]
call fcn.00403650
push eax
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00402700
cmp eax, 4
jne 0x408cdc
lea edx, [ebp - 0x30]
mov eax, 3
call fcn.00402760
mov eax, dword [ebp - 0x30]
mov edx, 0x4094d8
call fcn.004035ac
jne 0x408cdc
xor eax, eax
call fcn.004087e4
lea edx, [ebp - 0x34]
mov eax, 3
call fcn.00402760
mov eax, dword [ebp - 0x34]
mov edx, 0x4094e8
call fcn.004035ac
jne 0x408d02
mov eax, 3
call fcn.004087e4
lea edx, [ebp - 0x38]
mov eax, 3
call fcn.00402760
mov eax, dword [ebp - 0x38]
mov edx, 0x4094f8
call fcn.004035ac
jne 0x408d28
mov eax, 6
call fcn.004087e4
lea edx, [ebp - 0x3c]
mov eax, 3
call fcn.00402760
mov eax, dword [ebp - 0x3c]
mov edx, 0x409508
call fcn.004035ac
jne 0x408d4e
mov eax, 9
call fcn.004087e4
lea edx, [ebp - 0x40]
mov eax, 3
call fcn.00402760
mov eax, dword [ebp - 0x40]
mov edx, 0x40951c
call fcn.004035ac
jne 0x408d74
mov eax, 5
call fcn.004087e4
lea edx, [ebp - 0x44]
mov eax, 3
call fcn.00402760
mov eax, dword [ebp - 0x44]
mov edx, 0x40952c
call fcn.004035ac
jne 0x408d9a
mov eax, 0xa
call fcn.004087e4
lea edx, [ebp - 0x48]
mov eax, 3
call fcn.00402760
mov eax, dword [ebp - 0x48]
mov edx, 0x40953c
call fcn.004035ac
jne 0x408dc0
mov eax, 3
call fcn.004087e4
lea edx, [ebp - 0x4c]
mov eax, 3
call fcn.00402760
mov eax, dword [ebp - 0x4c]
mov edx, 0x40954c
call fcn.004035ac
jne 0x408de6
mov eax, 2
call fcn.004087e4
lea edx, [ebp - 0x50]
mov eax, 3
call fcn.00402760
mov eax, dword [ebp - 0x50]
mov edx, 0x40955c
call fcn.004035ac
jne 0x408e0c
mov eax, 7
call fcn.004087e4
lea edx, [ebp - 0x54]
mov eax, 3
call fcn.00402760
mov eax, dword [ebp - 0x54]
mov edx, 0x40956c
call fcn.004035ac
jne 0x408e32
mov eax, 8
call fcn.004087e4
lea edx, [ebp - 0x58]
mov eax, 3
call fcn.00402760
mov eax, dword [ebp - 0x58]
mov edx, 0x40957c
call fcn.004035ac
jne 0x408e58
mov eax, 4
call fcn.004087e4
lea edx, [ebp - 0x5c]
mov eax, 3
call fcn.00402760
mov eax, dword [ebp - 0x5c]
mov edx, 0x40958c
call fcn.004035ac
jne 0x408e7e
mov eax, 1
call fcn.004087e4
call fcn.00402700
cmp eax, 5
jne 0x408eab
lea edx, [ebp - 0x60]
mov eax, 4
call fcn.00402760
mov eax, dword [ebp - 0x60]
mov edx, 0x4094d8
call fcn.004035ac
jne 0x408eab
xor eax, eax
call fcn.00408878
lea edx, [ebp - 0x64]
mov eax, 4
call fcn.00402760
mov eax, dword [ebp - 0x64]
mov edx, 0x4094e8
call fcn.004035ac
jne 0x408ed1
mov eax, 3
call fcn.00408878
lea edx, [ebp - 0x68]
mov eax, 4
call fcn.00402760
mov eax, dword [ebp - 0x68]
mov edx, 0x4094f8
call fcn.004035ac
jne 0x408ef7
mov eax, 6
call fcn.00408878
lea edx, [ebp - 0x6c]
mov eax, 4
call fcn.00402760
mov eax, dword [ebp - 0x6c]
mov edx, 0x409508
call fcn.004035ac
jne 0x408f1d
mov eax, 9
call fcn.00408878
lea edx, [ebp - 0x70]
mov eax, 4
call fcn.00402760
mov eax, dword [ebp - 0x70]
mov edx, 0x40951c
call fcn.004035ac
jne 0x408f43
mov eax, 5
call fcn.00408878
lea edx, [ebp - 0x74]
mov eax, 4
call fcn.00402760
mov eax, dword [ebp - 0x74]
mov edx, 0x40952c
call fcn.004035ac
jne 0x408f69
mov eax, 0xa
call fcn.00408878
lea edx, [ebp - 0x78]
mov eax, 4
call fcn.00402760
mov eax, dword [ebp - 0x78]
mov edx, 0x40953c
call fcn.004035ac
jne 0x408f8f
mov eax, 3
call fcn.00408878
lea edx, [ebp - 0x7c]
mov eax, 4
call fcn.00402760
mov eax, dword [ebp - 0x7c]
mov edx, 0x40954c
call fcn.004035ac
jne 0x408fb5
mov eax, 2
call fcn.00408878
lea edx, [ebp - 0x80]
mov eax, 4
call fcn.00402760
mov eax, dword [ebp - 0x80]
mov edx, 0x40955c
call fcn.004035ac
jne 0x408fdb
mov eax, 7
call fcn.00408878
lea edx, [ebp - 0x84]
mov eax, 4
call fcn.00402760
mov eax, dword [ebp - 0x84]
mov edx, 0x40956c
call fcn.004035ac
jne 0x409007
mov eax, 8
call fcn.00408878
lea edx, [ebp - 0x88]
mov eax, 4
call fcn.00402760
mov eax, dword [ebp - 0x88]
mov edx, 0x40957c
call fcn.004035ac
jne 0x409033
mov eax, 4
call fcn.00408878
lea edx, [ebp - 0x8c]
mov eax, 4
call fcn.00402760
mov eax, dword [ebp - 0x8c]
mov edx, 0x40958c
call fcn.004035ac
jne 0x40905f
mov eax, 1
call fcn.00408878
call fcn.00402700
cmp eax, 6
jne 0x409092
lea edx, [ebp - 0x90]
mov eax, 5
call fcn.00402760
mov eax, dword [ebp - 0x90]
mov edx, 0x4094d8
call fcn.004035ac
jne 0x409092
xor eax, eax
call fcn.0040893c
lea edx, [ebp - 0x94]
mov eax, 5
call fcn.00402760
mov eax, dword [ebp - 0x94]
mov edx, 0x4094e8
call fcn.004035ac
jne 0x4090be
mov eax, 3
call fcn.0040893c
lea edx, [ebp - 0x98]
mov eax, 5
call fcn.00402760
mov eax, dword [ebp - 0x98]
mov edx, 0x4094f8
call fcn.004035ac
jne 0x4090ea
mov eax, 6
call fcn.0040893c
lea edx, [ebp - 0x9c]
mov eax, 5
call fcn.00402760
mov eax, dword [ebp - 0x9c]
mov edx, 0x409508
call fcn.004035ac
jne 0x409116
mov eax, 9
call fcn.0040893c
lea edx, [ebp - 0xa0]
mov eax, 5
call fcn.00402760
mov eax, dword [ebp - 0xa0]
mov edx, 0x40951c
call fcn.004035ac
jne 0x409142
mov eax, 5
call fcn.0040893c
lea edx, [ebp - 0xa4]
mov eax, 5
call fcn.00402760
mov eax, dword [ebp - 0xa4]
mov edx, 0x40952c
call fcn.004035ac
jne 0x40916e
mov eax, 0xa
call fcn.0040893c
lea edx, [ebp - 0xa8]
mov eax, 5
call fcn.00402760
mov eax, dword [ebp - 0xa8]
mov edx, 0x40953c
call fcn.004035ac
jne 0x40919a
mov eax, 3
call fcn.0040893c
lea edx, [ebp - 0xac]
mov eax, 5
call fcn.00402760
mov eax, dword [ebp - 0xac]
mov edx, 0x40954c
call fcn.004035ac
jne 0x4091c6
mov eax, 2
call fcn.0040893c
lea edx, [ebp - 0xb0]
mov eax, 5
call fcn.00402760
mov eax, dword [ebp - 0xb0]
mov edx, 0x40955c
call fcn.004035ac
jne 0x4091f2
mov eax, 7
call fcn.0040893c
lea edx, [ebp - 0xb4]
mov eax, 5
call fcn.00402760
mov eax, dword [ebp - 0xb4]
mov edx, 0x40956c
call fcn.004035ac
jne 0x40921e
mov eax, 8
call fcn.0040893c
lea edx, [ebp - 0xb8]
mov eax, 5
call fcn.00402760
mov eax, dword [ebp - 0xb8]
mov edx, 0x40957c
call fcn.004035ac
jne 0x40924a
mov eax, 4
call fcn.0040893c
lea edx, [ebp - 0xbc]
mov eax, 5
call fcn.00402760
mov eax, dword [ebp - 0xbc]
mov edx, 0x40958c
call fcn.004035ac
jne 0x409276
mov eax, 1
call fcn.0040893c
call fcn.00402700
cmp eax, 7
jne 0x4092a9
lea edx, [ebp - 0xc0]
mov eax, 6
call fcn.00402760
mov eax, dword [ebp - 0xc0]
mov edx, 0x4094d8
call fcn.004035ac
jne 0x4092a9
xor eax, eax
call fcn.00408a18
lea edx, [ebp - 0xc4]
mov eax, 6
call fcn.00402760
mov eax, dword [ebp - 0xc4]
mov edx, 0x4094e8
call fcn.004035ac
jne 0x4092d5
mov eax, 3
call fcn.00408a18
lea edx, [ebp - 0xc8]
mov eax, 6
call fcn.00402760
mov eax, dword [ebp - 0xc8]
mov edx, 0x4094f8
call fcn.004035ac
jne 0x409301
mov eax, 6
call fcn.00408a18
lea edx, [ebp - 0xcc]
mov eax, 6
call fcn.00402760
mov eax, dword [ebp - 0xcc]
mov edx, 0x409508
call fcn.004035ac
jne 0x40932d
mov eax, 9
call fcn.00408a18
lea edx, [ebp - 0xd0]
mov eax, 6
call fcn.00402760
mov eax, dword [ebp - 0xd0]
mov edx, 0x40951c
call fcn.004035ac
jne 0x409359
mov eax, 5
call fcn.00408a18
lea edx, [ebp - 0xd4]
mov eax, 6
call fcn.00402760
mov eax, dword [ebp - 0xd4]
mov edx, 0x40952c
call fcn.004035ac
jne 0x409385
mov eax, 0xa
call fcn.00408a18
lea edx, [ebp - 0xd8]
mov eax, 6
call fcn.00402760
mov eax, dword [ebp - 0xd8]
mov edx, 0x40953c
call fcn.004035ac
jne 0x4093b1
mov eax, 3
call fcn.00408a18
lea edx, [ebp - 0xdc]
mov eax, 6
call fcn.00402760
mov eax, dword [ebp - 0xdc]
mov edx, 0x40954c
call fcn.004035ac
jne 0x4093dd
mov eax, 2
call fcn.00408a18
lea edx, [ebp - 0xe0]
mov eax, 6
call fcn.00402760
mov eax, dword [ebp - 0xe0]
mov edx, 0x40955c
call fcn.004035ac
jne 0x409409
mov eax, 7
call fcn.00408a18
lea edx, [ebp - 0xe4]
mov eax, 6
call fcn.00402760
mov eax, dword [ebp - 0xe4]
mov edx, 0x40956c
call fcn.004035ac
jne 0x409435
mov eax, 8
call fcn.00408a18
lea edx, [ebp - 0xe8]
mov eax, 6
call fcn.00402760
mov eax, dword [ebp - 0xe8]
mov edx, 0x40957c
call fcn.004035ac
jne 0x409461
mov eax, 4
call fcn.00408a18
lea edx, [ebp - 0xec]
mov eax, 6
call fcn.00402760
mov eax, dword [ebp - 0xec]
mov edx, 0x40958c
call fcn.004035ac
jne 0x40948d
mov eax, 1
call fcn.00408a18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4094b2
lea eax, [ebp - 0xec]
mov edx, 0x38
call fcn.004032e4
ret