Function at 0x409760
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x5c]
sub esp, 0x5c
push 0xffffffffffffffff
push 0x42d729
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8c
push ebx
push esi
push edi
mov dword [ebp + 0x58], 0
call fcn.0040cf60
mov esi, dword [ebp + 0x64]
xor eax, eax
mov ecx, esi
mov dword [ebp + 0x40], eax
mov dword [ebp + 0x44], eax
mov dword [ebp + 0x48], eax
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x50], eax
lea edx, [ecx + 1]
mov dword [ebp + 0x54], eax
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4097b0
sub ecx, edx
push ecx
push esi
lea ecx, [ebp + 0x40]
call fcn.004018f0
push 0x20
lea eax, [ebp + 0x40]
mov dword [ebp - 4], 0
push eax
xor eax, eax
sub esp, 0x18
mov ecx, esp
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], 0xe
mov dword [ecx + 0x14], 0xf
mov eax, dword [str.Auto_Selecting]
mov dword [ecx], eax
mov eax, dword [0x4302b0]
mov dword [ecx + 4], eax
mov eax, dword [0x4302b4]
mov dword [ecx + 8], eax
mov ax, word [0x4302b8]
mov word [ecx + 0xc], ax
mov byte [ecx + 0xe], 0
call fcn.0040d000
mov ecx, dword [ebp + 0x54]
add esp, 0x20
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0x10
jb 0x409859
mov edx, dword [ebp + 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40984f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40984f
call fcn.0041567f
push ecx
push edx
call fcn.00410809
add esp, 8
call fcn.0040cf60
mov ecx, dword [0x43f05c]
mov eax, 0x7fffffff
sub eax, ecx
cmp eax, 9
jae 0x409875
call fcn.004063d0
cmp dword [0x43f060], 0x10
mov eax, 0x43f04c
jb 0x409888
mov eax, dword [0x43f04c]
push 9
push str.Binaries_
push ecx
push eax
push 0x43f04c
push dword [ebp + 0x58]
lea ecx, [ebp]
call fcn.00403900
push esi
lea eax, [ebp]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.004017f0
add esp, 0xc
push 4
push 0x4302bc
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.004066e0
mov edx, eax
xor eax, eax
mov dword [ebp + 0x28], eax
mov dword [ebp + 0x2c], eax
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x34], eax
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x3c], eax
mov ecx, dword [edx]
mov dword [ebp + 0x28], ecx
mov eax, dword [edx + 4]
mov dword [ebp + 0x2c], eax
mov eax, dword [edx + 8]
mov dword [ebp + 0x30], eax
mov eax, dword [edx + 0xc]
mov dword [ebp + 0x34], eax
mov eax, dword [edx + 0x10]
mov dword [ebp + 0x38], eax
mov eax, dword [edx + 0x14]
mov dword [ebp + 0x3c], eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov ecx, dword [ebp - 0x54]
mov byte [ebp - 4], 4
cmp ecx, 0x10
jb 0x409949
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40993f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409985
push ecx
push edx
call fcn.00410809
add esp, 8
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0xf
mov byte [ebp - 0x68], 0
mov ecx, dword [ebp + 0x14]
mov byte [ebp - 4], 5
cmp ecx, 0x10
jb 0x409994
mov edx, dword [ebp]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40998a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40998a
call fcn.0041567f
push ecx
push edx
call fcn.00410809
add esp, 8
push 0x20
sub esp, 0x18
mov dword [ebp + 0x10], 0
mov esi, esp
mov dword [ebp + 0x14], 0xf
xor eax, eax
mov byte [ebp], 0
lea ecx, [ebp + 0x28]
mov dword [ebp + 0x58], ecx
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
cmp dword [ebp + 0x3c], 0x10
jb 0x4099d2
mov ecx, dword [ebp + 0x28]
mov dword [ebp + 0x58], ecx
mov ebx, dword [ebp + 0x38]
cmp ebx, 0x7fffffff
jbe 0x4099e2
call fcn.004063d0
mov dword [esi + 0x14], 0xf
cmp ebx, 0x10
jae 0x409a09
mov dword [esi + 0x10], ebx
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0xc], eax
jmp 0x409a4a
mov edi, ebx
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x409a1d
mov edi, 0x7fffffff
jmp 0x409a27
cmp edi, 0x16
jae 0x409a27
mov edi, 0x16
lea eax, [edi + 1]
mov ecx, esi
push eax
call fcn.00406400
lea ecx, [ebx + 1]
mov dword [esi], eax
push ecx
push dword [ebp + 0x58]
mov dword [esi + 0x10], ebx
push eax
mov dword [esi + 0x14], edi
call fcn.00412070
add esp, 0xc
call fcn.0040ce50
add esp, 0x1c
xor eax, eax
push 0x20
sub esp, 0x18
mov ecx, esp
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], 1
mov dword [ecx + 0x14], 0xf
mov al, byte [0x42f43c]
mov byte [ecx], al
mov byte [ecx + 1], 0
call fcn.0040ce50
add esp, 0x1c
xor eax, eax
push 0x59
sub esp, 0x18
mov esi, esp
mov ecx, esi
push 0x20
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0xf
call fcn.00406400
mov dword [esi], eax
mov edi, eax
mov dword [esi + 0x10], 0x17
mov ecx, 5
mov dword [esi + 0x14], 0x1f
mov esi, str.Launching_y_cruncher...
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [eax + 0x17], 0
call fcn.0040ce50
add esp, 0x1c
xor eax, eax
push 0x67
sub esp, 0x18
mov esi, esp
mov ecx, esi
push 0x50
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0xf
call fcn.00406400
mov dword [esi], eax
mov edi, eax
mov dword [esi + 0x10], 0x41
mov ecx, 0x10
mov dword [esi + 0x14], 0x4f
mov esi, str._n
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov byte [eax + 0x41], 0
call fcn.0040ce50
push 0x77
call fcn.0040d900
add esp, 0x20
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x50], 0x44
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x1c], eax
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x24], eax
cmp dword [ebp + 0x3c], 0x10
mov dword [ebp + 0x40], eax
mov dword [ebp + 0x44], eax
mov dword [ebp + 0x48], eax
mov dword [ebp + 0x4c], eax
lea eax, [ebp + 0x28]
mov byte [ebp - 4], 6
mov dword [ebp + 0x50], 1
mov dword [ebp + 0x54], 0xf
mov word [ebp + 0x40], 0x22
mov dword [ebp + 0x58], 7
jb 0x409bf0
mov eax, dword [ebp + 0x28]
push dword [ebp + 0x38]
lea ecx, [ebp + 0x40]
push eax
call fcn.004066e0
push 1
push 0x4302a4
lea ecx, [ebp + 0x40]
call fcn.004066e0
mov ecx, dword [0x43ff34]
mov eax, 0x2aaaaaab
sub ecx, dword [0x43ff30]
mov edi, 1
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, edi
jbe 0x409c94
lea esi, [edi + 0x17]
push 2
push 0x4302a8
lea ecx, [ebp + 0x40]
call fcn.004066e0
mov eax, dword [0x43ff30]
add eax, esi
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x409c54
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp + 0x40]
call fcn.004066e0
push 1
push 0x4302a4
lea ecx, [ebp + 0x40]
call fcn.004066e0
mov ecx, dword [0x43ff34]
mov eax, 0x2aaaaaab
sub ecx, dword [0x43ff30]
inc edi
imul ecx
add esi, 0x18
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x409c34
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.0040e1e0
mov esi, eax
lea eax, [ebp + 0x28]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0040e1e0
add esp, 0x10
cmp dword [esi + 0x14], 8
jb 0x409cc2
mov esi, dword [esi]
cmp dword [eax + 0x14], 8
jb 0x409cca
mov eax, dword [eax]
lea ecx, [ebp + 0x18]
push ecx
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 0x6c]
test eax, eax
sete bl
cmp ecx, 8
jb 0x409d25
mov edx, dword [ebp - 0x80]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x409d1b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409dc0
push ecx
push edx
call fcn.00410809
add esp, 8
mov ecx, dword [ebp - 0x84]
xor eax, eax
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 7
mov word [ebp - 0x80], ax
mov byte [ebp - 4], 6
cmp ecx, 8
jb 0x409d79
mov edx, dword [ebp - 0x98]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x409d6f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409dc0
push ecx
push edx
call fcn.00410809
add esp, 8
mov ecx, dword [ebp + 0x54]
xor eax, eax
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 7
mov word [ebp - 0x98], ax
mov byte [ebp - 4], 5
cmp ecx, 0x10
jb 0x409dcf
mov edx, dword [ebp + 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x409dc5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x409dc5
call fcn.0041567f
push ecx
push edx
call fcn.00410809
add esp, 8
test bl, bl
je 0x409e03
push 0x20
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
sub esp, 0x18
mov ecx, esp
push str.Unable_to_start_y_cruncher
call fcn.00403700
call fcn.0040d0c0
push 0x20
call fcn.0040a1c0
add esp, 0x28
push 1
call fcn.00418455
push 0xffffffffffffffff
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
test esi, esi
je 0x409e2d
push 0x20
sub esp, 0x18
mov ecx, esp
push 0x42f43c
call fcn.00403700
call fcn.0040ce50
add esp, 0x1c
call fcn.004088f0
mov ecx, eax
call fcn.0040dae0
cmp eax, 1
ja 0x409e51
call fcn.00405710
test al, al
jne 0x409e51
push 0x20
call fcn.0040a1c0
add esp, 4
push esi
call fcn.00418455
int3