Function at 0x4035f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 0x68], eax
mov eax, 0x486020
call fcn.00467b50
mov dword [ebp - 0x48], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.00470824
inc dword [ebp - 0x48]
mov word [ebp - 0x54], 8
xor edx, edx
mov dword [ebp - 0x6c], edx
xor ecx, ecx
mov dword [ebp - 0x74], ecx
mov word [ebp - 0x54], 0x14
lea eax, [ebp - 8]
call fcn.004019c0
inc dword [ebp - 0x48]
mov word [ebp - 0x54], 8
xor edx, edx
mov dword [ebp - 0x78], edx
mov word [ebp - 0x54], 0x20
push 0x24
call fcn.00466ef4
pop ecx
mov dword [ebp - 0x6c], eax
push 0x24
push 0
push dword [ebp - 0x6c]
call fcn.00467834
add esp, 0xc
mov ecx, dword [ebp - 0x6c]
mov dword [ecx], 0x24
mov eax, dword [ebp - 0x68]
call fcn.00461acc
mov edx, dword [ebp - 0x6c]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x6c]
xor eax, eax
mov dword [ecx + 0x1c], eax
mov edx, dword [ebp - 0x6c]
xor ecx, ecx
mov dword [edx + 0x20], ecx
push dword [ebp - 0x6c]
push 0
lea eax, [ebp - 4]
call fcn.00402264
push eax
push 0
call sub.RASDLG.DLL_RasDialDlgA
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
je 0x4038e8
mov edx, dword [0x48bf60]
mov eax, dword [edx]
call fcn.004511f0
mov word [ebp - 0x54], 0x2c
lea eax, [ebp - 0xc]
call fcn.004019c0
mov edx, eax
inc dword [ebp - 0x48]
mov ecx, dword [0x48bf60]
mov eax, dword [ecx]
call fcn.00451de4
lea edx, [ebp - 0xc]
push dword [edx]
lea eax, [ebp - 0x10]
call fcn.004019c0
mov edx, eax
inc dword [ebp - 0x48]
pop eax
call fcn.00417a2c
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x18]
call fcn.004019c0
push eax
inc dword [ebp - 0x48]
mov edx, 0x48545d
lea eax, [ebp - 0x14]
call fcn.004707ec
inc dword [ebp - 0x48]
lea edx, [ebp - 0x14]
pop ecx
pop eax
call fcn.00470900
lea ecx, [ebp - 0x18]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x415044]
call fcn.0040397c
mov dword [ebp - 0x74], eax
dec dword [ebp - 0x48]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004708bc
dec dword [ebp - 0x48]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004708bc
dec dword [ebp - 0x48]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004708bc
dec dword [ebp - 0x48]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004708bc
push 0
mov edx, str.flag
lea eax, [ebp - 0x20]
call fcn.004707ec
inc dword [ebp - 0x48]
push dword [eax]
mov word [ebp - 0x54], 0x38
mov edx, 0x485468
lea eax, [ebp - 0x1c]
call fcn.004707ec
inc dword [ebp - 0x48]
mov edx, dword [eax]
mov eax, dword [ebp - 0x74]
pop ecx
mov ebx, dword [eax]
call dword [ebx + 8]
mov dword [ebp - 0x78], eax
dec dword [ebp - 0x48]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004708bc
dec dword [ebp - 0x48]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004708bc
mov word [ebp - 0x54], 0x44
mov edx, 0x485479
lea eax, [ebp - 0x2c]
call fcn.004707ec
inc dword [ebp - 0x48]
push dword [eax]
lea eax, [ebp - 0x30]
call fcn.004019c0
push eax
inc dword [ebp - 0x48]
mov edx, 0x485475
lea eax, [ebp - 0x28]
call fcn.004707ec
inc dword [ebp - 0x48]
push dword [eax]
mov edx, 0x485471
lea eax, [ebp - 0x24]
call fcn.004707ec
inc dword [ebp - 0x48]
mov edx, dword [eax]
mov eax, dword [ebp - 0x74]
pop ecx
mov ebx, dword [eax]
call dword [ebx]
lea edx, [ebp - 0x30]
lea eax, [ebp - 8]
call fcn.004708ec
dec dword [ebp - 0x48]
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.004708bc
dec dword [ebp - 0x48]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004708bc
dec dword [ebp - 0x48]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004708bc
dec dword [ebp - 0x48]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.004708bc
cmp dword [ebp - 0x78], 0
je 0x4038e8
mov word [ebp - 0x54], 0x50
lea eax, [ebp - 0x34]
call fcn.004019c0
mov edx, eax
inc dword [ebp - 0x48]
lea eax, [ebp - 8]
call fcn.00470a64
lea edx, [ebp - 0x34]
push edx
mov edx, 0x48547a
lea eax, [ebp - 0x38]
call fcn.004707ec
inc dword [ebp - 0x48]
lea edx, [ebp - 0x38]
pop eax
call fcn.004709a4
push eax
dec dword [ebp - 0x48]
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.004708bc
dec dword [ebp - 0x48]
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.004708bc
pop ecx
test cl, cl
je 0x4038e8
push 1
push 0
push 0
lea eax, [ebp - 8]
call fcn.00402264
push eax
push 0x48547b
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov word [ebp - 0x54], 8
cmp dword [ebp - 0x6c], 0
je 0x403902
push dword [ebp - 0x6c]
call fcn.00466d2c
pop ecx
xor edx, edx
mov dword [ebp - 0x6c], edx
cmp dword [ebp - 0x74], 0
je 0x40393a
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0
je 0x403935
mov eax, dword [ebp - 0x40]
mov edx, dword [eax]
mov dword [ebp - 0x3c], edx
mov word [ebp - 0x54], 0x68
mov edx, 3
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x54], 0x5c
xor eax, eax
mov dword [ebp - 0x74], eax
cmp word [ebp - 0x52], 0
je 0x403942
ret
dec dword [ebp - 0x48]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004708bc
dec dword [ebp - 0x48]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004708bc
mov ecx, dword [ebp - 0x64]
mov dword fs:[0], ecx
mov edi, dword [ebp - 0x84]
mov esi, dword [ebp - 0x80]
mov ebx, dword [ebp - 0x7c]
mov esp, ebp
pop ebp
ret