Function at 0x405f10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2e
push 0
push 0
dec ecx
jne 0x405f18
push ebx
push esi
push edi
mov eax, 0x405eb0
call fcn.00403ee8
mov ebx, dword [0x40812c]
xor eax, eax
push ebp
push 0x406884
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x406420
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, dword [0x408114]
call fcn.00403254
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00404424
mov edx, dword [ebp - 0x14]
mov eax, 0x409734
call fcn.004031a4
push 0x409738
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x409734]
call fcn.004034f4
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
mov eax, 0x409734
mov edx, 1
call fcn.00403534
push 0x40973c
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x409734]
call fcn.004034f4
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
mov eax, 0x409734
mov edx, 1
call fcn.00403534
push 0x409740
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x409734]
call fcn.004034f4
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
mov eax, 0x409734
mov edx, 1
call fcn.00403534
push 0x409744
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x409734]
call fcn.004034f4
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
mov eax, 0x409734
mov edx, 1
call fcn.00403534
mov eax, 0x409748
mov edx, dword [0x409734]
call fcn.004031a4
lea eax, [ebp - 0x20]
mov edx, dword [0x408118]
call fcn.00403254
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00404424
mov edx, dword [ebp - 0x1c]
mov eax, 0x409734
call fcn.004031a4
push 0x40974c
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x409734]
call fcn.004034f4
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
mov eax, 0x409734
mov edx, 1
call fcn.00403534
push 0x409750
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x409734]
call fcn.004034f4
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
mov eax, 0x409734
mov edx, 1
call fcn.00403534
push 0x409754
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x409734]
call fcn.004034f4
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
mov eax, 0x409734
mov edx, 1
call fcn.00403534
push 0x409758
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x409734]
call fcn.004034f4
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
mov eax, 0x409734
mov edx, 1
call fcn.00403534
mov eax, 0x40975c
mov edx, dword [0x409734]
call fcn.004031a4
lea eax, [ebp - 0x28]
mov edx, dword [0x40811c]
call fcn.00403254
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00404424
mov edx, dword [ebp - 0x24]
mov eax, 0x409734
call fcn.004031a4
push 0x409760
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x409734]
call fcn.004034f4
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
mov eax, 0x409734
mov edx, 1
call fcn.00403534
push 0x409764
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x409734]
call fcn.004034f4
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
mov eax, 0x409734
mov edx, 1
call fcn.00403534
push 0x409768
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x409734]
call fcn.004034f4
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
mov eax, 0x409734
mov edx, 1
call fcn.00403534
push 0x40976c
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x409734]
call fcn.004034f4
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
mov eax, 0x409734
mov edx, 1
call fcn.00403534
mov eax, 0x409770
mov edx, dword [0x409734]
call fcn.004031a4
lea eax, [ebp - 0x30]
mov edx, dword [0x408120]
call fcn.00403254
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.00404424
mov edx, dword [ebp - 0x2c]
mov eax, 0x409734
call fcn.004031a4
push 0x409774
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x409734]
call fcn.004034f4
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
mov eax, 0x409734
mov edx, 1
call fcn.00403534
push 0x409778
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x409734]
call fcn.004034f4
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
mov eax, 0x409734
mov edx, 1
call fcn.00403534
push 0x40977c
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x409734]
call fcn.004034f4
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
mov eax, 0x409734
mov edx, 1
call fcn.00403534
push 0x409780
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x409734]
call fcn.004034f4
mov eax, dword [ebx]
mov edx, dword [0x409734]
call fcn.0040357c
mov ecx, eax
mov eax, 0x409734
mov edx, 1
call fcn.00403534
mov eax, 0x409784
mov edx, dword [0x409734]
call fcn.004031a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40642a
xor eax, eax
push ebp
push 0x40651c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x409740]
mov edx, 0x40689c
call fcn.004033e0
je 0x40645a
mov eax, dword [0x409744]
mov edx, 0x40689c
call fcn.004033e0
jne 0x406489
mov eax, dword [0x408130]
mov edx, dword [0x409744]
call fcn.004031a4
mov eax, dword [0x40813c]
mov edx, dword [0x409748]
call fcn.004031a4
mov eax, 0x4068a8
call fcn.00405c04
jmp 0x406512
mov eax, dword [0x409738]
call fcn.0040430c
lea edx, [ebp - 0x38]
call fcn.004045b4
lea eax, [ebp - 0x38]
mov edx, dword [0x40973c]
call fcn.004032a4
mov eax, dword [ebp - 0x38]
call fcn.00403494
mov edx, eax
lea eax, [ebp - 0x34]
call fcn.00403254
mov edx, dword [ebp - 0x34]
mov eax, 0x4068a8
call fcn.00405d30
test al, al
je 0x406512
push 0
mov eax, dword [0x408144]
push dword [eax]
mov eax, dword [0x409738]
call fcn.0040430c
lea edx, [ebp - 0x40]
call fcn.004045b4
push dword [ebp - 0x40]
push dword [0x40973c]
mov eax, dword [0x408134]
push dword [eax]
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.0040335c
mov eax, dword [ebp - 0x3c]
call fcn.00403494
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x406526
xor eax, eax
push ebp
push 0x406618
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x409754]
mov edx, 0x40689c
call fcn.004033e0
je 0x406556
mov eax, dword [0x409758]
mov edx, 0x40689c
call fcn.004033e0
jne 0x406585
mov eax, dword [0x408130]
mov edx, dword [0x409758]
call fcn.004031a4
mov eax, dword [0x40813c]
mov edx, dword [0x40975c]
call fcn.004031a4
mov eax, 0x4068b4
call fcn.00405c04
jmp 0x40660e
mov eax, dword [0x40974c]
call fcn.0040430c
lea edx, [ebp - 0x48]
call fcn.004045b4
lea eax, [ebp - 0x48]
mov edx, dword [0x409750]
call fcn.004032a4
mov eax, dword [ebp - 0x48]
call fcn.00403494
mov edx, eax
lea eax, [ebp - 0x44]
call fcn.00403254
mov edx, dword [ebp - 0x44]
mov eax, 0x4068b4
call fcn.00405d30
test al, al
je 0x40660e
push 0
mov eax, dword [0x408144]
push dword [eax]
mov eax, dword [0x40974c]
call fcn.0040430c
lea edx, [ebp - 0x50]
call fcn.004045b4
push dword [ebp - 0x50]
push dword [0x409750]
mov eax, dword [0x408134]
push dword [eax]
lea eax, [ebp - 0x4c]
mov edx, 4
call fcn.0040335c
mov eax, dword [ebp - 0x4c]
call fcn.00403494
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x406622
xor eax, eax
push ebp
push 0x406714
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x409768]
mov edx, 0x40689c
call fcn.004033e0
je 0x406652
mov eax, dword [0x40976c]
mov edx, 0x40689c
call fcn.004033e0
jne 0x406681
mov eax, dword [0x408130]
mov edx, dword [0x40976c]
call fcn.004031a4
mov eax, dword [0x40813c]
mov edx, dword [0x409770]
call fcn.004031a4
mov eax, 0x4068c0
call fcn.00405c04
jmp 0x40670a
mov eax, dword [0x409760]
call fcn.0040430c
lea edx, [ebp - 0x58]
call fcn.004045b4
lea eax, [ebp - 0x58]
mov edx, dword [0x409764]
call fcn.004032a4
mov eax, dword [ebp - 0x58]
call fcn.00403494
mov edx, eax
lea eax, [ebp - 0x54]
call fcn.00403254
mov edx, dword [ebp - 0x54]
mov eax, 0x4068c0
call fcn.00405d30
test al, al
je 0x40670a
push 0
mov eax, dword [0x408144]
push dword [eax]
mov eax, dword [0x409760]
call fcn.0040430c
lea edx, [ebp - 0x60]
call fcn.004045b4
push dword [ebp - 0x60]
push dword [0x409764]
mov eax, dword [0x408134]
push dword [eax]
lea eax, [ebp - 0x5c]
mov edx, 4
call fcn.0040335c
mov eax, dword [ebp - 0x5c]
call fcn.00403494
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40671e
xor eax, eax
push ebp
push 0x406810
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x40977c]
mov edx, 0x40689c
call fcn.004033e0
je 0x40674e
mov eax, dword [0x409780]
mov edx, 0x40689c
call fcn.004033e0
jne 0x40677d
mov eax, dword [0x408130]
mov edx, dword [0x409780]
call fcn.004031a4
mov eax, dword [0x40813c]
mov edx, dword [0x409784]
call fcn.004031a4
mov eax, 0x4068cc
call fcn.00405c04
jmp 0x406806
mov eax, dword [0x409774]
call fcn.0040430c
lea edx, [ebp - 0x68]
call fcn.004045b4
lea eax, [ebp - 0x68]
mov edx, dword [0x409778]
call fcn.004032a4
mov eax, dword [ebp - 0x68]
call fcn.00403494
mov edx, eax
lea eax, [ebp - 0x64]
call fcn.00403254
mov edx, dword [ebp - 0x64]
mov eax, 0x4068cc
call fcn.00405d30
test al, al
je 0x406806
push 0
mov eax, dword [0x408144]
push dword [eax]
mov eax, dword [0x409774]
call fcn.0040430c
lea edx, [ebp - 0x70]
call fcn.004045b4
push dword [ebp - 0x70]
push dword [0x409778]
mov eax, dword [0x408134]
push dword [eax]
lea eax, [ebp - 0x6c]
mov edx, 4
call fcn.0040335c
mov eax, dword [ebp - 0x6c]
call fcn.00403494
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40681a
xor eax, eax
push ebp
push 0x40685f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x170]
mov edx, dword [0x408128]
call fcn.0040288c
lea eax, [ebp - 0x170]
mov edx, 0x4068d0
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402730
jne 0x406855
call fcn.004047c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x406869
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40688b
lea eax, [ebp - 0x70]
mov edx, 0x18
call fcn.00403174
ret