Function at 0x40c040
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcb0
mov eax, dword [0x5f3008]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x4000
mov dword [ebp - 0xc9c], edx
mov dword [ebp - 0xca8], ecx
mov dword [ebp - 0xc98], eax
mov dword [ebp - 0xca0], esi
call fcn.00560858
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 4
mov dword [ebp - 0xcac], eax
push esi
call edi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push esi
push 0x5a9ffc
mov dword [ebp - 0xca4], eax
lea eax, [ebp - 0x30]
push 0xa
push eax
call fcn.00406c50
sar esi, 0x1f
xor edx, edx
and esi, 1
mov ecx, eax
add esi, 9
add esp, 0x10
sub ecx, esi
cmp eax, esi
cmovl ecx, edx
cmp ecx, eax
jge 0x40c0e5
sub eax, ecx
lea esi, [ebp - 0x30]
lea esi, [esi + ecx*2]
mov ecx, eax
shr ecx, 1
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
adc ecx, ecx
rep movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x40c0e7
xor eax, eax
xor ecx, ecx
mov word [ebp + eax*2 - 0x1c], cx
mov eax, dword [ebp - 0xca4]
mov dword [ebp - 0xc90], ecx
test eax, eax
jle 0x40c256
mov edx, 1
lea esi, [ecx + 0x22]
mov dword [ebp - 0xc94], edx
cmp edx, eax
mov eax, dword [ebp - 0xca0]
jge 0x40c22d
cmp word [eax + ecx*2], 0x25
jne 0x40c22d
movzx eax, word [eax + ecx*2 + 2]
cmp eax, 0x76
je 0x40c1dd
cmp eax, 0x56
je 0x40c1dd
cmp eax, 0x66
je 0x40c1a1
cmp eax, 0x46
je 0x40c1a1
cmp eax, 0x6c
je 0x40c15e
cmp eax, 0x4c
je 0x40c15e
mov eax, 0x25
jmp 0x40c231
lea eax, [ebp - 0x1c]
xor esi, esi
push eax
call edi
test eax, eax
jle 0x40c189
nop word [eax + eax]
mov ax, word [ebp + esi*2 - 0x1c]
inc esi
mov word [ebp + ebx*2 - 0x834], ax
lea eax, [ebp - 0x1c]
push eax
inc ebx
call edi
cmp esi, eax
jl 0x40c170
mov ecx, dword [ebp - 0xc90]
mov esi, 0x22
mov edx, dword [ebp - 0xc94]
inc ecx
inc edx
jmp 0x40c23a
push dword [ebp - 0xc98]
mov word [ebp + ebx*2 - 0x834], si
inc ebx
xor esi, esi
call edi
test eax, eax
jle 0x40c20f
nop dword [eax + eax]
mov ecx, dword [ebp - 0xc98]
push ecx
mov ax, word [ecx + esi*2]
inc esi
mov word [ebp + ebx*2 - 0x834], ax
inc ebx
call edi
cmp esi, eax
jl 0x40c1c0
jmp 0x40c20f
push dword [ebp - 0xc9c]
mov word [ebp + ebx*2 - 0x834], si
inc ebx
xor esi, esi
call edi
test eax, eax
jle 0x40c20f
mov ecx, dword [ebp - 0xc9c]
push ecx
mov ax, word [ecx + esi*2]
inc esi
mov word [ebp + ebx*2 - 0x834], ax
inc ebx
call edi
cmp esi, eax
jl 0x40c1f4
mov ecx, dword [ebp - 0xc90]
mov esi, 0x22
mov edx, dword [ebp - 0xc94]
inc ecx
mov word [ebp + ebx*2 - 0x834], si
inc ebx
inc edx
jmp 0x40c23a
mov ax, word [eax + ecx*2]
mov word [ebp + ebx*2 - 0x834], ax
inc ebx
mov eax, dword [ebp - 0xca4]
inc ecx
inc edx
mov dword [ebp - 0xc90], ecx
mov dword [ebp - 0xc94], edx
cmp ecx, eax
jl 0x40c110
add ebx, ebx
cmp ebx, 0x800
jae 0x40c3b0
mov edi, dword [ebp - 0xca8]
xor eax, eax
mov word [ebp + ebx - 0x834], ax
lea eax, [ebp - 0x834]
mov ebx, dword [ebp - 0xcac]
push eax
push edi
push str.__s___s
push 0x2000
push ebx
call fcn.00406c50
add esp, 0x14
mov dword [ebp - 0xc7c], 0x44
xor eax, eax
mov dword [ebp - 0xc50], 1
xorps xmm0, xmm0
mov word [ebp - 0xc3a], ax
mov eax, 0xa
movlpd qword [ebp - 0xc78], xmm0
push edi
mov word [ebp - 0xc4c], ax
or esi, 0xffffffff
lea eax, [ebp - 0xc34]
movlpd qword [ebp - 0xc70], xmm0
push 0x200
push eax
movlpd qword [ebp - 0xc68], xmm0
movlpd qword [ebp - 0xc60], xmm0
movlpd qword [ebp - 0xc58], xmm0
movlpd qword [ebp - 0xc4a], xmm0
movlpd qword [ebp - 0xc42], xmm0
call fcn.00565fee
mov ax, word [ebp - 0xc34]
add esp, 0xc
xor ecx, ecx
test ax, ax
je 0x40c33d
movzx edx, ax
cmp dx, 0x5c
mov eax, ecx
cmovne eax, esi
inc ecx
mov esi, eax
movzx eax, word [ebp + ecx*2 - 0xc34]
mov edx, eax
test ax, ax
jne 0x40c322
xor eax, eax
mov word [ebp + esi*2 - 0xc32], ax
lea eax, [ebp - 0xc8c]
push eax
lea eax, [ebp - 0xc7c]
push eax
lea eax, [ebp - 0xc34]
push eax
push 0
push 0x20
push 0
push 0
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0x2710
push dword [ebp - 0xc8c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0xc88]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc8c]
call esi
push ebx
call fcn.00560853
mov ecx, dword [ebp - 8]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0056060a
mov esp, ebp
pop ebp
ret
call fcn.0056073a
int3