Function at 0x403b80
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4611d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov eax, dword [0x46f42c]
push ebx
push esi
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x58], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x60]
lea ecx, [esp + 0x60]
mov bl, 1
push eax
push ecx
mov byte [esp + 0x60], bl
call fcn.00404030
add esp, 8
mov esi, eax
mov eax, dword [esi]
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp ecx, eax
mov byte [esp + 0x58], 2
je 0x403c1f
mov edx, dword [ecx - 0xc]
test edx, edx
jge 0x403bf3
mov edx, dword [0x46f430]
add ecx, 0xfffffff4
cmp ecx, edx
jne 0x403bfa
mov ecx, dword [eax - 0xc]
test ecx, ecx
jge 0x403c0a
mov edx, dword [eax - 8]
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.004080a0
jmp 0x403c1f
lea ecx, [esp + 0x10]
call fcn.004083e0
mov esi, dword [esi]
mov dword [esp + 0x10], esi
add esi, 0xfffffff4
push esi
call edi
mov eax, dword [esp + 0x60]
mov edx, dword [0x46f430]
mov byte [esp + 0x58], bl
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x403c54
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x403c54
mov edx, dword [esp + 0x60]
lea eax, [edx - 0xc]
push eax
call fcn.004535f0
add esp, 4
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0x60]
push eax
push ecx
call fcn.00404030
add esp, 8
mov esi, eax
mov eax, dword [esi]
mov ecx, dword [esp + 0xc]
cmp ecx, eax
mov byte [esp + 0x58], 3
je 0x403cb7
mov edx, dword [ecx - 0xc]
test edx, edx
jge 0x403c8b
mov edx, dword [0x46f430]
add ecx, 0xfffffff4
cmp ecx, edx
jne 0x403c92
mov ecx, dword [eax - 0xc]
test ecx, ecx
jge 0x403ca2
mov edx, dword [eax - 8]
push eax
push edx
lea ecx, [esp + 0x14]
call fcn.004080a0
jmp 0x403cb7
lea ecx, [esp + 0xc]
call fcn.004083e0
mov eax, dword [esi]
mov dword [esp + 0xc], eax
add eax, 0xfffffff4
push eax
call edi
mov eax, dword [esp + 0x60]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x403ce2
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x403ce2
mov edx, dword [esp + 0x60]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x14]
mov edx, dword [esp + 0x68]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x14]
and eax, 0xffff
push ecx
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], 0x440
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x403da1
mov eax, dword [esp + 0xc]
mov ecx, dword [0x46f430]
mov esi, dword [esp + 0x4c]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x403d62
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x403d62
mov eax, dword [esp + 0xc]
add eax, 0xfffffff4
push eax
call fcn.004535f0
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x403d8d
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x403d8d
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
add esp, 0x50
ret
mov eax, dword [esp + 0xc]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x403dcc
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x403dcc
mov edx, dword [esp + 0xc]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x403df7
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x403df7
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov ecx, dword [esp + 0x50]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret