Function at 0x401b8c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e4
mov eax, dword [0x40a020]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push 0x40
lea eax, [ebp - 0x1e0]
push esi
push eax
mov ebx, ecx
mov dword [ebp - 0x1e4], esi
call fcn.00402300
xor eax, eax
mov dword [ebp - 0x1a0], esi
lea edi, [ebp - 0x19c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
pop edi
push edi
lea eax, [ebp - 0x1e4]
push esi
push eax
call fcn.00402300
push 0x10
lea eax, [ebp - 0x1a0]
push esi
push eax
call fcn.00402300
push dword [ebx + 0x153c]
xor eax, eax
push dword [ebx + 0x1538]
mov word [ebp - 0x1b2], ax
lea eax, [ebp - 0x128]
mov dword [ebp - 0x1e4], edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x4074e4
push eax
mov dword [ebp - 0x1e0], esi
mov dword [ebp - 0x1b0], esi
mov dword [ebp - 0x1dc], esi
mov dword [ebp - 0x1b8], esi
call edi
add esp, 0x34
lea eax, [ebx + 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
je 0x401c5b
push 0x4074e0
lea eax, [ebx + 0x808]
push eax
call esi
lea eax, [ebp - 0x128]
push eax
lea eax, [ebx + 0x808]
push eax
call esi
lea eax, [ebx + 0x1120]
push eax
lea eax, [ebp - 0x128]
push 0x4074d0
push eax
call edi
add esp, 0xc
push 0x4074e0
lea eax, [ebx + 0x808]
push eax
call esi
lea eax, [ebp - 0x128]
push eax
lea eax, [ebx + 0x808]
push eax
call esi
movzx eax, byte [ebx + 0x1114]
push eax
lea eax, [ebp - 0x128]
push 0x4074c4
push eax
call edi
add esp, 0xc
push 0x4074e0
lea eax, [ebx + 0x808]
push eax
call esi
lea eax, [ebp - 0x128]
push eax
lea eax, [ebx + 0x808]
push eax
call esi
push dword [ebx + 0x111c]
lea eax, [ebp - 0x128]
push dword [ebx + 0x1118]
push 0x4074b4
push eax
call edi
add esp, 0x10
push 0x4074e0
lea eax, [ebx + 0x808]
push eax
call esi
lea eax, [ebp - 0x128]
push eax
lea eax, [ebx + 0x808]
push eax
call esi
and dword [ebp - 0x130], 0
lea eax, [ebp - 0x130]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401de8
and dword [ebp - 0x138], 0
push 0x4000
call fcn.0040278c
pop ecx
mov dword [ebp - 0x134], eax
test eax, eax
je 0x401de8
lea ecx, [ebp - 0x138]
push ecx
push 0x4000
push eax
push 1
push dword [ebp - 0x130]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x401de8
and dword [ebp - 0x12c], 0
lea eax, [ebp - 0x12c]
push eax
mov eax, dword [ebp - 0x134]
push dword [eax]
mov ecx, ebx
call fcn.00401821
test eax, eax
je 0x401ddc
cmp dword [ebp - 0x12c], 0
je 0x401ddc
push dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
push 0x4074a4
push eax
call edi
add esp, 0xc
push 0x4074e0
lea edi, [ebx + 0x808]
push edi
call esi
lea eax, [ebp - 0x128]
push eax
push edi
call esi
push dword [ebp - 0x12c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x134]
call fcn.00402752
pop ecx
xor ecx, ecx
cmp dword [0x40ab80], ecx
je 0x401e08
push ecx
lea eax, [ebx + 0x1224]
push eax
lea eax, [ebx + 0x808]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x174]
push 0
push eax
call fcn.00402300
lea eax, [ebx + 0x1224]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x174], esi
lea eax, [ebx + 0x808]
mov dword [ebp - 0x160], eax
add esp, 0xc
xor edi, edi
xor esi, esi
lea eax, [ebp - 0x174]
inc esi
push eax
mov dword [ebp - 0x170], 0x40
mov dword [ebp - 0x16c], edi
mov dword [ebp - 0x168], 0x40749c
mov dword [ebp - 0x15c], edi
mov dword [ebp - 0x158], esi
mov dword [ebp - 0x154], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x401e9b
push 0x407480
add ebx, 8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x12c], 0x37
jmp 0x401f49
cmp dword [ebx + 0x110c], edi
je 0x401f03
jmp 0x401ee9
cmp dword [ebp - 0x18c], 0xf
je 0x401eba
cmp dword [ebp - 0x18c], 0x200
jne 0x401ed4
lea eax, [ebp - 0x190]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x190]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push esi
push edi
push edi
push edi
lea eax, [ebp - 0x190]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jg 0x401ea5
push 0xff
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x13c]
push eax
push esi
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, esi
je 0x401ed4
lea eax, [ebx + 0x1548]
push eax
push dword [ebp - 0x13c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebx + 0x1548]
mov dword [ebp - 0x12c], eax
mov dword [ebx + 0x1110], esi
cmp eax, 0x103
jne 0x401f3d
cmp dword [ebx + 0x110c], edi
jne 0x401f3d
mov dword [ebp - 0x12c], edi
push dword [ebp - 0x13c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x12c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040237a
leave
ret