Function at 0x4043c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x44e
push 0
push 0
dec ecx
jne 0x4043c8
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x404a31
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4049d7
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x2134]
xor eax, eax
call fcn.00402714
mov eax, dword [ebp - 0x2134]
lea edx, [ebp - 0x28]
call fcn.00404244
lea eax, [ebp - 0x14]
call fcn.00404328
mov eax, dword [ebp - 0x14]
call fcn.0040259c
call fcn.004025c8
test eax, eax
je 0x40442b
lea eax, [ebp - 0x14]
call fcn.00404328
mov eax, dword [ebp - 0x28]
call fcn.0040259c
mov dword [ebp - 0x2c], 0xc
lea edx, [ebp - 0x2138]
xor eax, eax
call fcn.00402714
mov eax, dword [ebp - 0x2138]
mov edx, 0x20
call fcn.00404190
mov edi, eax
mov edx, dword [ebp - 0x2c]
neg edx
mov ecx, 2
mov eax, edi
call fcn.00404158
lea edx, [ebp - 4]
mov ecx, 4
mov eax, edi
call fcn.00404164
lea edx, [ebp - 8]
mov ecx, 4
mov eax, edi
call fcn.00404164
lea edx, [ebp - 0x36]
mov ecx, 4
mov eax, edi
call fcn.00404164
lea eax, [ebp - 0x3c]
call fcn.00403700
mov dword [ebp - 0x10], 1
lea ebx, [ebp - 0x36]
lea eax, [ebp - 0x213c]
mov dl, byte [ebx]
call fcn.004037f4
mov edx, dword [ebp - 0x213c]
lea eax, [ebp - 0x3c]
call fcn.00403830
inc dword [ebp - 0x10]
inc ebx
cmp dword [ebp - 0x10], 5
jne 0x4044a9
lea eax, [ebp - 0x18]
mov ecx, 0x404a48
mov edx, dword [ebp - 0x14]
call fcn.00403874
mov eax, dword [ebp - 0x18]
call fcn.00404278
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x404584
lea eax, [ebp - 0x24]
push eax
mov ecx, 2
mov edx, 6
mov eax, dword [ebp - 0x18]
call fcn.00403a2c
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0x24]
call fcn.00402d70
mov byte [ebp - 0x1d], al
inc byte [ebp - 0x1d]
lea edx, [ebp - 0x223c]
xor eax, eax
mov al, byte [ebp - 0x1d]
call fcn.00402d64
lea edx, [ebp - 0x223c]
lea eax, [ebp - 0x24]
call fcn.00403804
push dword [ebp - 0x14]
push 0x404a5c
push dword [ebp - 0x24]
push 0x404a6c
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004038e8
mov eax, dword [ebp - 0x18]
call fcn.00404278
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x404566
xor eax, eax
jmp 0x404568
mov al, 1
cmp byte [ebp - 0x1d], 0x63
jae 0x404576
cmp al, 1
jne 0x4044f1
test al, al
jne 0x404584
mov eax, 1
call fcn.004036e8
mov eax, dword [ebp - 4]
mov ecx, 0x2001
cdq
idiv ecx
mov esi, eax
mov eax, dword [ebp - 4]
mov ecx, 0x2001
cdq
idiv ecx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 4]
add edx, dword [ebp - 8]
neg edx
mov ecx, 2
mov eax, edi
call fcn.00404158
test esi, esi
jle 0x4045eb
mov dword [ebp - 0x10], 1
lea edx, [ebp - 0x212e]
mov ecx, 0x2001
mov eax, edi
call fcn.00404164
lea edx, [ebp - 0x212e]
mov ecx, 0x2001
mov eax, ebx
call fcn.0040429c
inc dword [ebp - 0x10]
dec esi
jne 0x4045c1
cmp dword [ebp - 0xc], 0
je 0x404611
lea edx, [ebp - 0x212e]
mov ecx, dword [ebp - 0xc]
mov eax, edi
call fcn.00404164
lea edx, [ebp - 0x212e]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0040429c
mov eax, ebx
call fcn.004042c8
lea eax, [ebp - 0x8c]
mov edx, dword [ebp - 0x18]
call fcn.00404304
lea edx, [ebp - 0x2244]
mov eax, 1
call fcn.00402714
push dword [ebp - 0x2244]
lea edx, [ebp - 0x2248]
mov eax, 2
call fcn.00402714
push dword [ebp - 0x2248]
lea edx, [ebp - 0x224c]
mov eax, 3
call fcn.00402714
push dword [ebp - 0x224c]
lea eax, [ebp - 0x2240]
mov edx, 3
call fcn.004038e8
mov edx, dword [ebp - 0x2240]
lea eax, [ebp - 0xdc]
call fcn.00404304
lea eax, [ebp - 0x12c]
mov edx, 0x404a7c
call fcn.00404304
lea eax, [ebp - 0x2250]
call fcn.00404328
lea eax, [ebp - 0x2250]
mov edx, 0x404a88
call fcn.00403830
mov eax, dword [ebp - 0x2250]
push eax
lea eax, [ebp - 0x2254]
lea edx, [ebp - 0x8c]
mov ecx, 0x50
call fcn.00403810
mov eax, dword [ebp - 0x2254]
pop edx
call fcn.00404000
lea eax, [ebp - 0x8c]
push eax
call fcn.00403e44
push 1
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x2258]
call fcn.00404328
lea eax, [ebp - 0x2258]
mov edx, 0x404a88
call fcn.00403830
mov eax, dword [ebp - 0x2258]
call fcn.00403a20
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push dword [ebp - 0x14]
push 0x404a5c
push dword [ebp - 0x3c]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004038e8
mov eax, dword [ebp - 0x1c]
call fcn.00404278
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4047e1
lea eax, [ebp - 0x24]
push eax
mov ecx, 2
mov edx, 6
mov eax, dword [ebp - 0x1c]
call fcn.00403a2c
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0x24]
call fcn.00402d70
mov byte [ebp - 0x1d], al
inc byte [ebp - 0x1d]
lea edx, [ebp - 0x223c]
xor eax, eax
mov al, byte [ebp - 0x1d]
call fcn.00402d64
lea edx, [ebp - 0x223c]
lea eax, [ebp - 0x24]
call fcn.00403804
push dword [ebp - 0x14]
push 0x404a5c
push dword [ebp - 0x24]
push dword [ebp - 0x3c]
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004038e8
mov eax, dword [ebp - 0x1c]
call fcn.00404278
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4047c7
xor eax, eax
jmp 0x4047c9
mov al, 1
cmp byte [ebp - 0x1d], 0x63
jae 0x4047d3
cmp al, 1
jne 0x404754
test al, al
jne 0x4047e1
mov eax, 1
call fcn.004036e8
mov eax, dword [ebp - 8]
mov ecx, 0x2001
cdq
idiv ecx
mov esi, eax
mov eax, dword [ebp - 8]
mov ecx, 0x2001
cdq
idiv ecx
mov dword [ebp - 0xc], edx
test esi, esi
jle 0x404831
mov dword [ebp - 0x10], 1
lea edx, [ebp - 0x212e]
mov ecx, 0x2001
mov eax, edi
call fcn.00404164
lea edx, [ebp - 0x212e]
mov ecx, 0x2001
mov eax, ebx
call fcn.0040429c
inc dword [ebp - 0x10]
dec esi
jne 0x404807
cmp dword [ebp - 0xc], 0
je 0x404857
lea edx, [ebp - 0x212e]
mov ecx, dword [ebp - 0xc]
mov eax, edi
call fcn.00404164
lea edx, [ebp - 0x212e]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0040429c
mov eax, ebx
call fcn.004042c8
mov eax, dword [ebp - 0x3c]
mov edx, 0x404a6c
call fcn.0040396c
jne 0x404984
lea eax, [ebp - 0x8c]
mov edx, dword [ebp - 0x1c]
call fcn.00404304
lea edx, [ebp - 0x2260]
mov eax, 1
call fcn.00402714
push dword [ebp - 0x2260]
lea edx, [ebp - 0x2264]
mov eax, 2
call fcn.00402714
push dword [ebp - 0x2264]
lea edx, [ebp - 0x2268]
mov eax, 3
call fcn.00402714
push dword [ebp - 0x2268]
lea eax, [ebp - 0x225c]
mov edx, 3
call fcn.004038e8
mov edx, dword [ebp - 0x225c]
lea eax, [ebp - 0xdc]
call fcn.00404304
lea eax, [ebp - 0x12c]
mov edx, 0x404a7c
call fcn.00404304
lea eax, [ebp - 0x226c]
call fcn.00404328
lea eax, [ebp - 0x226c]
mov edx, 0x404a98
call fcn.00403830
mov eax, dword [ebp - 0x226c]
push eax
lea eax, [ebp - 0x2270]
lea edx, [ebp - 0x8c]
mov ecx, 0x50
call fcn.00403810
mov eax, dword [ebp - 0x2270]
pop edx
call fcn.00404000
lea eax, [ebp - 0x8c]
push eax
call fcn.00403e44
push 1
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x2274]
call fcn.00404328
lea eax, [ebp - 0x2274]
mov edx, 0x404a98
call fcn.00403830
mov eax, dword [ebp - 0x2274]
call fcn.00403a20
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4049cd
lea eax, [ebp - 0x8c]
mov edx, 0x404aa8
call fcn.00404304
lea eax, [ebp - 0xdc]
mov edx, dword [ebp - 0x1c]
call fcn.00404304
lea eax, [ebp - 0x12c]
mov edx, 0x404a7c
call fcn.00404304
push 1
push 0
push 0
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x8c]
push eax
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4049e1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404a38
lea eax, [ebp - 0x2274]
mov edx, 0xe
call fcn.00403724
lea eax, [ebp - 0x213c]
mov edx, 3
call fcn.00403724
lea eax, [ebp - 0x3c]
call fcn.00403700
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00403724
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403724
ret