Function at 0x10004040
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x504
mov eax, dword [0x10007018]
xor eax, esp
mov dword [esp + 0x4fc], eax
mov eax, dword [esp + 0x508]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
je 0x1000425f
lea edx, [esp + 0x2a0]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x10004070
mov edx, dword [0x10005b84]
mov eax, dword [str.CheckPermitLoad.asp]
mov ecx, dword [0x10005b80]
mov dword [esp + 0x70], edx
mov dword [esp + 0x68], eax
mov eax, dword [0x10005b88]
mov dword [esp + 0x6c], ecx
mov ecx, dword [0x10005b8c]
lea edx, [esp + 0x2a0]
push 0x5c
push edx
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], ecx
call dword [sym.imp.MSVCR80.dll_strchr]
add esp, 8
cmp eax, ebx
je 0x10004136
mov byte [eax], bl
add eax, 1
lea edx, [esp + 0x68]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x100040d1
lea edi, [esp + 0x68]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
cmp al, bl
jne 0x100040e4
mov ax, word [0x1000592c]
mov word [edi], ax
lea eax, [esp + 0x68]
add eax, 0xffffffff
mov edi, edi
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x10004100
mov ecx, dword [str.CheckPermitLoad.asp]
mov edx, dword [0x10005b80]
mov dword [eax], ecx
mov ecx, dword [0x10005b84]
mov dword [eax + 4], edx
mov edx, dword [0x10005b88]
mov dword [eax + 8], ecx
mov ecx, dword [0x10005b8c]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov edx, dword [esp + 0x514]
push edx
push 0x10009688
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x2ac]
push ecx
lea edx, [esp + 0x3e0]
push str._s__s_d10_s__d
push edx
call dword [sym.imp.MSVCR80.dll_sprintf]
push 0x40
lea eax, [esp + 0x40]
push ebx
push eax
mov dword [esp + 0x44], ebx
call sub.MSVCR80.dll_memset
add esp, 0x24
push 0x104
lea ecx, [esp + 0x19c]
xor eax, eax
push ecx
push ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
lea edx, [esp + 0x198]
push 0x5c
push edx
call dword [sym.imp.MSVCR80.dll_strrchr]
mov byte [eax + 1], bl
lea eax, [esp + 0x1a0]
add esp, 8
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x100041c3
mov ecx, dword [str.model2.dat]
mov edx, dword [0x100059e8]
mov dword [eax], ecx
mov cx, word [0x100059ec]
mov dword [eax + 4], edx
mov dl, byte [0x100059ee]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
lea edx, [esp + 0x3f0]
push edx
lea eax, [esp + 0x1bc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1000425f
mov ecx, dword [esp + 0x10]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push eax
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor eax, eax
cmp dword [esp + 0xc], 4
setne al
pop edi
pop ebx
mov ecx, dword [esp + 0x4fc]
xor ecx, esp
call fcn.1000431f
add esp, 0x504
ret
mov ecx, dword [esp + 0x504]
pop edi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.1000431f
add esp, 0x504
ret