Function at 0x406899
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, edx
mov edi, ecx
mov eax, dword [0x409198]
xor eax, dword [0x409194]
push 0x44
pop ebx
cmp eax, 0x9d43943b
jbe 0x4068ec
sahf
mov cl, 0xd0
inc edx
sal dword [edi], 0x50
aaa
push eax
mov bl, 0x89
fsubr st(0)
jo 0x4068c0
invalid
mov eax, dword [0x4091a0]
xor eax, dword [0x40919c]
lea eax, [eax + eax*2]
add eax, 3
and eax, 0xfffffffc
call fcn.0040613a
mov eax, esp
push eax
push 3
push 0x409037
push 0x409034
call fcn.00407ae5
add esp, 0x10
mov dword [ebp - 0x10], eax
sub esp, 0x104
mov dword [ebp - 0x14], esp
push 0x10
pop eax
call fcn.0040613a
mov dword [ebp - 0x18], esp
mov eax, ebx
call fcn.0040613a
mov ebx, esp
xorps xmm0, xmm0
movups xmmword [ebx + 0x34], xmm0
movups xmmword [ebx + 0x24], xmm0
movups xmmword [ebx + 0x14], xmm0
movups xmmword [ebx + 4], xmm0
mov dword [ebx], 0x44
mov ecx, edi
mov edx, ebx
call fcn.00406c5a
test eax, eax
je 0x406adf
mov eax, dword [0x4091c4]
xor eax, dword [0x4091c0]
mov dword [ebp - 0x24], esi
mov dword [esi], eax
push edi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.0040702c
add esp, 0xc
mov eax, 0x8000000
or eax, dword [edi + 0x1104]
mov dword [ebp - 0x10], eax
lea eax, [edi + 0x1000]
xor edx, edx
mov dword [ebp - 0x20], edi
cmp byte [edi + 0x1000], 0
cmovne edx, eax
mov dword [ebp - 0x1c], edx
mov esi, dword [ebp - 0x18]
mov edi, ebx
mov ebx, dword [0x4091c8]
mov eax, 0xadde79f4
or ebx, eax
push esi
push edi
push dword [ebp - 0x1c]
push 0
push dword [ebp - 0x10]
push dword [0x4091cc]
push 0
push 0
push dword [ebp - 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp ebx, 0xb98e5e6e
jae 0x406a09
fisub dword [eax - 0x63]
inc eax
and ch, byte [ebp + 0x73]
wait
push esi
push edi
push dword [ebp - 0x1c]
push 0
push dword [ebp - 0x10]
push 1
push 0
push 0
push dword [ebp - 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x4069b0
test eax, eax
je 0x406b43
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
mov edi, dword [ebp - 0x24]
and dword [edi], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x1210]
cmp eax, dword [0x409f0c]
jne 0x406a3e
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, 0x99a9aeae
xor eax, dword [0x4091d0]
imul eax, eax, 0x2b348742
add eax, 0xa32a6881
xor eax, 0x458a99a9
add eax, 0x4f4620df
cmp eax, 0xc697a6d9
jbe 0x406a71
cmp byte [eax], cl
fsubr dword [eax]
inc ebp
xchg ecx, eax
mov esp, 0xbb5f2664
jl 0x4069f3
cmp dword [0x4091d4], 0x910b4fb5
jne 0x406aa5
cmp eax, 0x4091d4
mov ch, 0x4f
or edx, dword [ecx + 0x3d812875]
sub byte [edx - 0x1182ffc0], dl
mov bl, 0x31
cmp dword [0x409228], 0x31b3ee7d
jae 0x406a9d
mov ebp, 0x1cbeefc4
mov edi, 0x78006dce
adc byte [ebx + ebx*4], 0x13
sbb eax, 0x824e259b
mov esp, 0x9b1d139b
and eax, 0xb8bc824e
test byte [edi + 0x5d], al
wait
adc ebx, dword [0x824e259b]
mov esp, 0x5d4784b8
mov eax, 0x795d4784
xor eax, dword [0x4091d8]
jns 0x406ade
add eax, 0x4091d8
mov ecx, 0x421404ac
xor edx, edx
div ecx
and eax, 2
xor eax, 0xfbee9ff7
add eax, 0x72a872aa
mov ecx, dword [0x4091e0]
xor ecx, dword [0x4091dc]
cmp eax, ecx
jbe 0x406b8b
jmp 0x406baa
add byte [eax + 0xa5960be], bh
mov eax, 0xa5960be
sub eax, dword [0x4091a4]
and eax, dword [0x4091a8]
cmp eax, dword [0x4091ac]
jne 0x406b04
jecxz 0x406af9
invalid
sti
sbb edx, ecx
invalid
mov ecx, dword [0x4091b4]
xor ecx, dword [0x4091b0]
mov eax, 0xcde6d76c
xor edx, edx
div ecx
mov ecx, eax
mov edx, dword [0x4091bc]
xor edx, dword [0x4091b8]
push 2
pop eax
cmp ecx, edx
jbe 0x406c52
pop es
cmp eax, 0xd97b9a4f
pop ds
cmp cl, 0xda
iretd
mov eax, 0xf7286214
add eax, dword [0x4091f4]
cmp eax, 0xc9e1a406
jbe 0x406b5d
nop
dec esi
inc esi
stosb byte es:[edi], al
add bl, byte [0xc6b98c37]
inc ebp
leave
push edi
mov ecx, 0x57c945c6
xor ecx, dword [0x4091f8]
mov eax, 0x7a87ddf4
xor edx, edx
div ecx
and eax, 0x7fbf0f8e
xor eax, 0x904e7562
and eax, dword [0x4091fc]
cmp eax, dword [0x409200]
jne 0x406bcc
jmp 0x406bf7
mov eax, 0x4408b834
and eax, dword [0x4091e4]
add eax, 0x4091e4
or eax, 0x80110200
imul eax, dword [0x4091e8]
cmp eax, dword [0x4091ec]
jne 0x406bb4
sbb dword [edi + 0x2f], edi
bswap edi
xchg ecx, eax
xchg ebp, eax
push cs
jmp 0x406b8b
xor eax, eax
cmp dword [0x4091f0], 0x3c1a4797
jne 0x406c31
retf
mov eax, 0x810c140
and eax, dword [0x409204]
xor eax, 0xc6e5956d
add eax, dword [0x409208]
or eax, 0x543ece2d
mov ecx, dword [str.XuN]
xor ecx, dword [0x40920c]
cmp eax, ecx
jb 0x406c01
push ebp
sti
xchg esi, eax
pop ebp
loope 0x406b91
push 0xefb9cbeb
outsd dx, dword [esi]
aaa
mov ecx, 0x37f36fef
or ecx, dword [0x409214]
xor ecx, dword [str.E___P5]
xor ecx, dword [0x40921c]
xor ecx, 0x86f6deda
xor eax, eax
inc eax
cmp ecx, 0x977ebc4e
jbe 0x406c31
mov esp, 0x876977e
adc dword [edi], edi
stc
cdq
jg 0x406c24
mov al, byte [0x8a54b9ca]
cmp eax, 0x200d2352
xchg edx, eax
inc eax
add byte [ecx - 0x2d88400f], al
invalid
mov ecx, 0x523d8a54
and ecx, dword [str._fkq]
xor ecx, 0xffd277bf
cmp ecx, dword [0x409224]
jne 0x406c52
sub eax, edi
daa
and eax, 0xa434ac01
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret