Function at 0x40327d
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov eax, 0x41dc5e
call fcn.00415a34
sub esp, 0x318
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
call fcn.0040d172
mov eax, dword [esi + 0xeb8]
xor ebx, ebx
cmp eax, ebx
je 0x4032b1
push 0x21
push ebx
push eax
call fcn.00415510
add esp, 0xc
cmp dword [esi + 0xee8], ebx
push edi
je 0x4032f5
cmp dword [ebp + 8], 7
jne 0x403407
cmp dword [esi + 0x1ec], ebx
jne 0x403407
push 4
push 5
push dword [esi + 0x1308]
lea ecx, [ebp - 0x10]
call fcn.0040d235
cmp eax, 6
jne 0x403407
call fcn.00405df6
jmp 0x403407
cmp dword [ebp + 8], ebx
je 0x403407
cmp dword [esi + 0xeec], ebx
jne 0x403407
cmp dword [esi + 0x1ec], ebx
jne 0x403407
push str.Readme
push str.Group
mov ecx, 0x425a04
call fcn.0040d8e1
test eax, eax
jne 0x403345
push ebx
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
push dword [esi + 0x1308]
call fcn.0040d235
jmp 0x403407
push 0x80
mov dword [ebp - 0x14], ebx
call fcn.00415d12
pop ecx
mov ecx, eax
mov dword [ebp - 0x18], ecx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x40336c
lea eax, [ebp - 0x14]
push eax
push 1
call fcn.0040d3f5
jmp 0x40336e
xor eax, eax
or dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x181c]
push 0x96
push 0x40c5bd
mov dword [edi], eax
mov edx, dword [eax]
mov ecx, eax
call dword [edx]
mov ecx, dword [edi]
cmp ecx, ebx
je 0x403397
mov eax, dword [ecx]
push 1
call dword [eax + 4]
cmp dword [ebp - 0x14], ebx
jne 0x403407
lea eax, [ebp - 0x11c]
push 0x104
push eax
push 0x424ae0
push str.Readme
push str.Group
mov ecx, 0x425a04
call fcn.0040d8c4
lea eax, [ebp - 0x11c]
mov ecx, 0x424b10
push eax
call fcn.004019e2
push 5
push ebx
lea eax, [ebp - 0x11c]
push ebx
push eax
push str.open
push dword [esi + 0x1308]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [ebp - 0x11c]
push eax
push str.shellexecute_:__s.
push 0x424b20
call fcn.0040d0ca
add esp, 0xc
cmp dword [esi + 0xee8], ebx
jne 0x403540
cmp dword [ebp + 8], 7
jne 0x403540
cmp byte [esi + 0xa98], bl
je 0x40352d
lea eax, [esi + 0x87c]
push eax
lea eax, [ebp - 0x324]
push str._sGLWorld.exe
push eax
call fcn.00415cc0
lea eax, [ebp - 0x324]
push eax
call fcn.00405aaf
add esp, 0x10
test eax, eax
je 0x403540
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x324]
push eax
call fcn.00405c91
lea eax, [esi + 0x1938]
push eax
call fcn.00415b30
add esp, 0xc
test eax, eax
jbe 0x403507
mov edi, 0x400
push str.__GLIEDOWN_MAPFILE_NAME__
push edi
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebx
mov dword [esi + 0x1934], eax
je 0x4034f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4034e2
push edi
push ebx
push ebx
push 0xf001f
push dword [esi + 0x1934]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, ebx
je 0x4034f4
lea eax, [esi + 0x1938]
push eax
push edi
call fcn.00415570
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x4034f4
push dword [esi + 0x1934]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1934], ebx
lea eax, [ebp - 0x324]
push str.__webstart
push eax
call fcn.00415580
pop ecx
pop ecx
lea eax, [esi + 0xa98]
push eax
lea eax, [ebp - 0x324]
push eax
call fcn.00415580
pop ecx
lea eax, [ebp - 0x324]
pop ecx
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x403540
lea eax, [esi + 0xef4]
mov ecx, esi
push eax
push str.OverRun
call fcn.00403754
cmp dword [esi + 0x1d48], ebx
pop edi
je 0x403577
mov ecx, dword [esi + 0x1d38]
cmp ecx, ebx
je 0x403571
mov eax, dword [esi + 0x1d3c]
cmp eax, ebx
je 0x403571
push dword [esi + 0x1d44]
push dword [esi + 0x1d40]
push eax
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov dword [esi + 0x1d48], ebx
push dword [0x425e18]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [ebp + 8]
call fcn.00415df2
pop esi
pop ebx