Function at 0x63b5cf
Capabilities:
Create process on windows

Disassembly:
cmp byte [0x65a2c5], 0
je 0x63b559
mov eax, dword [0x65a2c0]
cmp dword [eax + 0x314], 1
jne 0x63b455
push 3
push 0
push 0
lea ecx, [ebp - 8]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x63b688
call fcn.00597218
push dword [ebp - 8]
lea ecx, [ebp - 0xc]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x63b6fc
call fcn.00597218
push dword [ebp - 0xc]
lea ecx, [ebp - 0x10]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x63b760
call fcn.00597218
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x63b7b8
call fcn.00597218
push dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 4
call fcn.00404250
mov eax, dword [ebp - 4]
call fcn.00404354
push eax
push 0x63b808
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x65a2c0]
cmp dword [eax + 0x314], 2
jne 0x63b4d4
push 3
push 0
push 0
lea ecx, [ebp - 0x1c]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x63b818
call fcn.00597218
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x63b88c
call fcn.00597218
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x63b8f0
call fcn.00597218
push dword [ebp - 0x24]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404250
mov eax, dword [ebp - 0x18]
call fcn.00404354
push eax
push 0x63b808
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x65a2c0]
cmp dword [eax + 0x314], 3
jne 0x63b5ca
push 3
push 0
push 0
lea ecx, [ebp - 0x2c]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x63b948
call fcn.00597218
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x30]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x63b9b8
call fcn.00597218
push dword [ebp - 0x30]
lea ecx, [ebp - 0x34]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x63ba14
call fcn.00597218
push dword [ebp - 0x34]
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00404250
mov eax, dword [ebp - 0x28]
call fcn.00404354
push eax
push 0x63b808
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x63b5ca
push 3
push 0
push 0
lea ecx, [ebp - 0x3c]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x63ba60
call fcn.00597218
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x40]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x63bac8
call fcn.00597218
push dword [ebp - 0x40]
lea ecx, [ebp - 0x44]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x63bb18
call fcn.00597218
push dword [ebp - 0x44]
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.00404250
mov eax, dword [ebp - 0x38]
call fcn.00404354
push eax
push 0x63b808
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x63b62a
mov edi, 0x457456
add edi, dword [esp + 0x38]
pop edx
lea edx, [edx + ecx + 0x1c]
sub edx, ecx
sbb edi, 0x1b1460ca
push edx
xor edi, dword [esp + 8]
rcl edi, 0xf5
pop edi
lea edx, [edx + ecx + 0x218]
sub edx, ecx
sub ecx, dword [edi]
lea edi, [edi + eax + 3]
sub edi, eax
cmp edi, edx
jb 0x63b5fa
pop edi
cmp ecx, 0x274380c3
pop edx
pop ecx
nop
jmp 0x63b3ae
jmp 0x63b65a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63b67c
lea eax, [ebp - 0x44]
mov edx, 0x11
call fcn.00403f34
ret