Function at 0x406b74
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x7c
push 0
push 0
dec ecx
jne 0x406750
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00402b14
lea eax, [ebp - 0x348]
mov edx, dword [0x403dc8]
call fcn.00402d7c
xor eax, eax
push ebp
push 0x406ecd
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00404804
mov edx, dword [ebp - 4]
mov eax, 0x406ee4
call fcn.00402c64
mov esi, eax
test si, si
jbe 0x406812
lea eax, [ebp - 0x350]
push eax
movzx edx, si
inc edx
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.00402b80
mov ecx, dword [ebp - 0x350]
lea eax, [ebp - 0x34c]
mov edx, 0x406ef0
call fcn.00402978
mov eax, dword [ebp - 0x34c]
xor edx, edx
call fcn.00403ee4
mov ebx, eax
movzx edi, si
mov edx, edi
lea eax, [ebp - 4]
mov ecx, 3
call fcn.00402bc0
lea eax, [ebp - 0x354]
mov edx, ebx
call fcn.00402868
mov eax, dword [ebp - 0x354]
mov ecx, edi
lea edx, [ebp - 4]
call fcn.00402c08
test si, si
jne 0x406792
lea eax, [ebp - 0x1c]
call fcn.0040268c
lea eax, [ebp - 0x18]
call fcn.0040268c
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00406624
mov eax, dword [ebp - 0x20]
call fcn.0040292c
mov edx, dword [ebp - 0x20]
cmp byte [edx + eax - 1], 0x5c
jne 0x406bdc
lea eax, [ebp - 0x358]
call fcn.00406508
lea eax, [ebp - 0x358]
push eax
lea edx, [ebp - 0x35c]
mov ax, 0x50
call fcn.00404b48
mov edx, dword [ebp - 0x35c]
pop eax
call fcn.00402934
mov edx, dword [ebp - 0x358]
lea eax, [ebp - 0x1f0]
call fcn.004017bc
lea eax, [ebp - 0x1f0]
call fcn.00401558
call fcn.004012bc
lea edx, [ebp - 0x360]
mov ax, 0x51
call fcn.00404b48
mov edx, dword [ebp - 0x360]
lea eax, [ebp - 0x1f0]
call fcn.00402d10
call fcn.00401ddc
call fcn.004012bc
lea edx, [ebp - 0x364]
mov ax, 0x52
call fcn.00404b48
mov edx, dword [ebp - 0x364]
lea eax, [ebp - 0x1f0]
call fcn.00402d10
call fcn.00401ddc
call fcn.004012bc
lea edx, [ebp - 0x368]
mov ax, 0x53
call fcn.00404b48
mov edx, dword [ebp - 0x368]
lea eax, [ebp - 0x1f0]
call fcn.00402d10
call fcn.00401ddc
call fcn.004012bc
lea edx, [ebp - 0x36c]
mov ax, 0x54
call fcn.00404b48
mov edx, dword [ebp - 0x36c]
lea eax, [ebp - 0x1f0]
call fcn.00402d10
call fcn.00401ddc
call fcn.004012bc
lea edx, [ebp - 0x370]
mov ax, 0x55
call fcn.00404b48
mov edx, dword [ebp - 0x370]
lea eax, [ebp - 0x1f0]
call fcn.00402d10
call fcn.00401ddc
call fcn.004012bc
lea edx, [ebp - 0x378]
mov ax, 0x56
call fcn.00404b48
push dword [ebp - 0x378]
push dword [ebp - 0x10]
lea edx, [ebp - 0x37c]
mov ax, 0x5a
call fcn.00404b48
push dword [ebp - 0x37c]
lea eax, [ebp - 0x374]
mov edx, 3
call fcn.004029ec
mov edx, dword [ebp - 0x374]
lea eax, [ebp - 0x1f0]
call fcn.00402d10
call fcn.00401ddc
call fcn.004012bc
lea edx, [ebp - 0x384]
mov ax, 0x2c
call fcn.00404b48
push dword [ebp - 0x384]
push dword [ebp - 0x10]
lea edx, [ebp - 0x388]
mov ax, 0x2b
call fcn.00404b48
push dword [ebp - 0x388]
lea eax, [ebp - 0x380]
mov edx, 3
call fcn.004029ec
mov edx, dword [ebp - 0x380]
lea eax, [ebp - 0x1f0]
call fcn.00402d10
call fcn.00401ddc
call fcn.004012bc
mov edx, 0x406efc
lea eax, [ebp - 0x1f0]
call fcn.00402d10
call fcn.00401ddc
call fcn.004012bc
lea eax, [ebp - 0x38c]
mov ecx, 0x406f0c
mov edx, dword [ebp - 0x20]
call fcn.00402978
mov eax, dword [ebp - 0x38c]
lea ecx, [ebp - 0x348]
mov edx, 0x3f
call fcn.004040dc
mov ebx, eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00402724
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0x2f
jne 0x406a86
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, 1
call fcn.00402bc0
test ebx, ebx
jne 0x406bcc
test dword [ebp - 0x340], 0x10
jle 0x406b1f
lea edx, [ebp - 0x394]
mov ax, 0x5d
call fcn.00404b48
push dword [ebp - 0x394]
push dword [ebp - 0x10]
push 0x406f18
push dword [0x40a65c]
push 0x406f24
push dword [ebp - 0x14]
push dword [ebp - 0x33c]
push 0x406f30
push dword [ebp - 0x33c]
lea edx, [ebp - 0x398]
mov ax, 0x62
call fcn.00404b48
push dword [ebp - 0x398]
lea eax, [ebp - 0x390]
mov edx, 0xa
call fcn.004029ec
mov edx, dword [ebp - 0x390]
lea eax, [ebp - 0x1f0]
call fcn.00402d10
call fcn.00401ddc
call fcn.004012bc
jmp 0x406bb7
lea edx, [ebp - 0x3a0]
mov ax, 0x6d
call fcn.00404b48
push dword [ebp - 0x3a0]
push dword [ebp - 0x10]
push 0x406f18
push dword [0x40a65c]
push 0x406f24
push dword [ebp - 0x14]
push dword [ebp - 0x33c]
push 0x406f3c
push dword [ebp - 0x33c]
push 0x406f48
lea edx, [ebp - 0x3a4]
mov eax, dword [ebp - 0x344]
call fcn.00403e60
push dword [ebp - 0x3a4]
lea edx, [ebp - 0x3a8]
mov ax, 0x1c
call fcn.00404b48
push dword [ebp - 0x3a8]
lea eax, [ebp - 0x39c]
mov edx, 0xc
call fcn.004029ec
mov edx, dword [ebp - 0x39c]
lea eax, [ebp - 0x1f0]
call fcn.00402d10
call fcn.00401ddc
call fcn.004012bc
lea eax, [ebp - 0x348]
call fcn.0040412c
mov ebx, eax
test ebx, ebx
je 0x406a8e
lea eax, [ebp - 0x1f0]
call fcn.0040192c
call fcn.004012bc
lea ecx, [ebp - 0x3ac]
mov edx, dword [ebp - 4]
mov eax, 0x406f24
call fcn.00406598
mov edx, dword [ebp - 0x3ac]
lea eax, [ebp - 4]
call fcn.00402724
cmp dword [ebp - 4], 0
jne 0x406c11
lea edx, [ebp - 4]
mov ax, 0x50
call fcn.00404b48
jmp 0x406c1c
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x20]
call fcn.00402724
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [0x40a688]
mov eax, dword [eax]
call eax
test eax, eax
jne 0x406c3d
mov eax, dword [ebp - 0x20]
call fcn.00404978
test al, al
je 0x406e89
lea edx, [ebp - 0x3b0]
mov ax, 0x50
call fcn.00404b48
mov eax, dword [ebp - 0x3b0]
mov edx, dword [ebp - 4]
call fcn.00402c64
test eax, eax
jle 0x406c99
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x3b4]
mov ecx, dword [ebp - 4]
mov edx, dword [0x40c7d8]
call fcn.00402978
mov eax, dword [ebp - 0x3b4]
call fcn.00402b24
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
jmp 0x406cbb
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00402b24
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov esi, eax
lea ecx, [ebp - 0x3b8]
mov edx, dword [ebp - 4]
mov eax, 0x406f58
call fcn.00406598
mov eax, dword [ebp - 0x3b8]
push eax
lea edx, [ebp - 0x3bc]
mov ax, 0x6b
call fcn.00404b48
mov edx, dword [ebp - 0x3bc]
pop eax
call fcn.00402a70
je 0x406d33
lea ecx, [ebp - 0x3c0]
mov edx, dword [ebp - 4]
mov eax, 0x406f58
call fcn.00406598
mov eax, dword [ebp - 0x3c0]
push eax
lea edx, [ebp - 0x3c4]
mov ax, 0x6c
call fcn.00404b48
mov edx, dword [ebp - 0x3c4]
pop eax
call fcn.00402a70
jne 0x406d3f
lea edx, [ebp - 0x18]
mov ax, 0x75
call fcn.00404b48
lea edx, [ebp - 0x3c8]
mov ax, 0x6e
call fcn.00404b48
push dword [ebp - 0x3c8]
push 0x406f64
lea edx, [ebp - 0x3cc]
mov ax, 0x6f
call fcn.00404b48
push dword [ebp - 0x3cc]
push 0x406f64
lea edx, [ebp - 0x3d0]
mov ax, 0x70
call fcn.00404b48
push dword [ebp - 0x3d0]
lea edx, [ebp - 0x3d4]
mov eax, esi
call fcn.00403e60
push dword [ebp - 0x3d4]
push 0x406f64
lea edx, [ebp - 0x3d8]
mov ax, 0x71
call fcn.00404b48
push dword [ebp - 0x3d8]
push 0x406f70
lea edx, [ebp - 0x3dc]
mov ax, 0x72
call fcn.00404b48
push dword [ebp - 0x3dc]
push 0x406f64
lea edx, [ebp - 0x3e0]
mov ax, 0x73
call fcn.00404b48
push dword [ebp - 0x3e0]
push 0x406f64
lea edx, [ebp - 0x3e4]
mov ax, 0x74
call fcn.00404b48
push dword [ebp - 0x3e4]
push dword [ebp - 0x18]
push 0x406f64
push 0x406f64
lea eax, [ebp - 0x1c]
mov edx, 0x11
call fcn.004029ec
lea eax, [ebp - 0xc]
mov edx, 0x1394
call fcn.00402cac
mov eax, dword [ebp - 0x1c]
call fcn.0040292c
push eax
lea eax, [ebp - 0x1c]
call fcn.00402b78
mov edx, eax
mov eax, dword [ebp - 8]
pop ecx
call fcn.0040586c
push 0
lea eax, [ebp - 0x24]
push eax
push 0x1394
lea eax, [ebp - 0xc]
call fcn.00402b78
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
lea eax, [ebp - 0xc]
call fcn.00402b78
mov edx, eax
mov cx, 0x1394
mov eax, dword [ebp - 8]
call fcn.0040586c
cmp dword [ebp - 0x24], 0x1394
jae 0x406e46
push ebx
mov eax, dword [0x40a680]
mov eax, dword [eax]
call eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406ed4
lea eax, [ebp - 0x3e4]
mov edx, 0x27
call fcn.004026b0
lea eax, [ebp - 0x348]
mov edx, dword [0x403dc8]
call fcn.00402e40
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.004026b0
lea eax, [ebp - 4]
call fcn.0040268c
ret