Function at 0x40f140
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8fc
mov eax, dword [0x4d8b40]
xor eax, esp
mov dword [esp + 0x8f8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push 0x1ff
lea edx, [esp + 0x705]
push ebx
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov byte [esp + 0x70c], bl
call fcn.00465b60
add esp, 0xc
push 0x207
lea eax, [esp + 0x3f5]
push ebx
push eax
mov byte [esp + 0x3fc], bl
call fcn.00465b60
add esp, 0xc
push 0x104
lea ecx, [esp + 0x1ec]
push ebx
push ecx
call fcn.00465b60
add esp, 0xc
lea ecx, [esp + 0x1e8]
call fcn.00420c70
lea eax, [esp + 0x1e8]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x40f1d0
mov edx, dword [0x4c0b1c]
mov ecx, dword [0x4c0b20]
mov dword [eax], edx
mov edx, dword [0x4c0b24]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
lea eax, [esp + 0x1e8]
push eax
call fcn.00420d70
mov esi, eax
cmp esi, 1
mov dword [esp + 0x10], esi
jle 0x40f216
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x10]
push 0x103
lea ecx, [esp + 0x5fd]
push ebx
push ecx
mov byte [esp + 0x604], bl
call fcn.00465b60
shl esi, 7
lea eax, [esi + str.CSEbank.GD.user.exe]
lea edx, [esp + 0x604]
add esp, 0xc
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x40f245
push 0xff
lea edx, [esp + 0x2f5]
push ebx
push edx
mov byte [esp + 0x2fc], bl
call fcn.00465b60
add esp, 0xc
lea edi, [esi + str.Gemini]
lea eax, [esp + 0x2f0]
push eax
mov esi, edi
mov dword [esp + 0x10], edi
call fcn.00425010
lea eax, [esp + 0x2f0]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f290
sub eax, edx
cmp eax, 1
jbe 0x40f2b5
xor eax, eax
mov cl, byte [esp + eax + 0x2f0]
mov byte [esp + eax + 0x3f0], cl
inc eax
cmp cl, bl
jne 0x40f2a0
jmp 0x40f2fd
lea ecx, [esp + 0x3f0]
call fcn.00420c70
lea eax, [esp + 0x5f8]
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f2d0
lea edi, [esp + 0x3f0]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x40f2e1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0xc]
push 0x38
lea ecx, [esp + 0x24]
push ebx
push ecx
mov dword [esp + 0x28], 0x3c
call fcn.00465b60
mov eax, dword [esp + 0x20]
add esp, 0xc
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x3f0]
push ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0x40
mov dword [esp + 0x34], str.__S
mov dword [esp + 0x3c], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x40f3a8
push 0xb4
lea edx, [esp + 0x2f4]
push ebx
push edx
mov dword [esp + 0xec], 1
call fcn.00465b60
add esp, 0xc
mov esi, str.IDS_USBKEY_DRV_INST_FAILED
mov ecx, str.CheckRes
call fcn.00426a80
lea edx, [esp + 0x2f0]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x40f382
xor eax, eax
mov edi, edi
mov cl, byte [esp + eax + 0x2f0]
mov byte [esp + eax + 0xe4], cl
inc eax
cmp cl, bl
jne 0x40f390
jmp 0x40f4d6
mov ecx, dword [esp + 0x54]
mov esi, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x14], ebx
call esi
cmp dword [esp + 0xc], 0x103
jne 0x40f3f1
jmp 0x40f3d0
mov eax, dword [esp + 0x54]
lea edx, [esp + 0xc]
push edx
push eax
call esi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0xc], 0x103
je 0x40f3d0
lea eax, [esp + 0x3f0]
lea edx, [eax + 1]
jmp 0x40f400
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f400
sub eax, edx
cmp eax, 3
jbe 0x40f41c
mov ecx, edi
lea edx, [esp + 0x3f0]
call fcn.00424e30
push 0x100
lea ecx, [esp + 0xe8]
push ebx
push ecx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xe8], 0x1b
call fcn.00465b60
add esp, 0xc
mov esi, str.IDS_USBKEY_DRV_INST_FINISHED
mov ecx, str.CheckRes
call fcn.00426a80
lea edx, [esp + 0x700]
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x40f460
lea eax, [esp + 0x700]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f473
lea edi, [esp + 0xe4]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x40f484
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x18]
cmp edi, ebx
je 0x40f4d6
lea eax, [esp + 0x700]
mov ecx, eax
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40f4b0
sub eax, ecx
mov esi, ecx
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x40f4c0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x40f4eb
lea edx, [esp + 0x58]
push edx
call fcn.00420b20
add esp, 4
cmp dword [esp + 0x10], 1
jne 0x40f4f7
call fcn.0040f520
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x904]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045f97b
mov esp, ebp
pop ebp
ret 4