Function at 0x402220
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40cfe5
mov eax, dword fs:[0]
push eax
sub esp, 0xb68
mov eax, dword [0x4120a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
xor eax, eax
mov word [ebp - 0x6a4], ax
push 0x206
push 0
lea ecx, [ebp - 0x6a2]
push ecx
call fcn.00405090
add esp, 0xc
push 0x104
lea edx, [ebp - 0x6a4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x6a4]
push eax
lea ecx, [ebp - 0x488]
call fcn.00402e90
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x488]
push ecx
lea ecx, [ebp - 0x710]
call fcn.00402d90
mov byte [ebp - 4], 3
mov edx, dword [0x40e404]
push edx
push 0x40e300
lea ecx, [ebp - 0x710]
call fcn.004031a0
mov dword [ebp - 0x250], eax
mov eax, dword [0x40e404]
cmp eax, dword [ebp - 0x250]
je 0x4022f2
mov ecx, dword [ebp - 0x250]
add ecx, 1
push ecx
push 0
lea ecx, [ebp - 0x710]
call fcn.004030a0
lea edx, [ebp - 0x488]
push edx
lea ecx, [ebp - 0x238]
call fcn.00402d90
mov byte [ebp - 4], 4
mov eax, dword [0x40e404]
push eax
push 0x40e304
lea ecx, [ebp - 0x238]
call fcn.004031a0
mov dword [ebp - 0x6f4], eax
mov ecx, dword [0x40e404]
cmp ecx, dword [ebp - 0x6f4]
je 0x402353
lea ecx, [ebp - 0x710]
call fcn.00404140
push eax
mov edx, dword [ebp - 0x6f4]
add edx, 1
push edx
lea ecx, [ebp - 0x238]
call fcn.004030a0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x498], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x494], 0
lea eax, [ebp - 0x494]
push eax
lea ecx, [ebp - 0x24c]
push ecx
lea edx, [ebp - 0x498]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xb68], esp
lea eax, [ebp - 0x488]
push eax
call fcn.00402d90
mov dword [ebp - 0xb70], eax
call fcn.004017f0
add esp, 0x28
mov dword [ebp - 0xb74], eax
cmp dword [ebp - 0xb74], 0
jne 0x402432
mov byte [ebp - 0xb69], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x238]
call fcn.00402fa0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x710]
call fcn.00402fa0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x488]
call fcn.00402fa0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00402fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.00402fa0
mov al, byte [ebp - 0xb69]
jmp 0x4028ae
call fcn.00401710
mov dword [ebp - 0x48c], eax
xor ecx, ecx
mov word [ebp - 0x46c], cx
push 0x206
push 0
lea edx, [ebp - 0x46a]
push edx
call fcn.00405090
add esp, 0xc
cmp dword [ebp - 0x48c], 0x1000
jne 0x402498
push 0xa
call fcn.00401070
add esp, 4
push eax
push 0x40e308
call fcn.00406f5c
add esp, 4
push eax
push str._sLow_s.exe
lea eax, [ebp - 0x46c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x4024c6
push 0xa
call fcn.00401070
add esp, 4
push eax
push 0x40e330
call fcn.00406f5c
add esp, 4
push eax
push 0x40e33c
lea ecx, [ebp - 0x46c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov edx, dword [ebp - 0x248]
push edx
mov eax, dword [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x498]
push ecx
lea edx, [ebp - 0x46c]
push edx
call fcn.00401fd0
add esp, 0x10
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.00405090
add esp, 0xc
cmp dword [ebp - 0x48c], 0x1000
jne 0x402545
push 0xa
call fcn.00401070
add esp, 4
push eax
push 0x40e350
call fcn.00406f5c
add esp, 4
push eax
push str._sLOW_s.exe
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x402573
push 0xa
call fcn.00401070
add esp, 4
push eax
push 0x40e378
call fcn.00406f5c
add esp, 4
push eax
push 0x40e384
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x6f0], 0
lea ecx, [ebp - 0x6f0]
push ecx
mov edx, dword [ebp - 0x248]
push edx
mov eax, dword [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x498]
push ecx
call fcn.00401b50
add esp, 0x10
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 0
je 0x4025b9
cmp dword [ebp - 0x6f0], 0
jne 0x4025be
jmp 0x4026dd
mov edx, dword [ebp - 0x6f0]
push edx
mov eax, dword [ebp - 0x490]
push eax
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00404ac0
add esp, 0xc
test eax, eax
jne 0x4025e4
jmp 0x4026c0
xor edx, edx
mov word [ebp - 0x954], dx
push 0x206
push 0
lea eax, [ebp - 0x952]
push eax
call fcn.00405090
add esp, 0xc
lea ecx, [ebp + 0x24]
call fcn.00404140
test eax, eax
jbe 0x40263d
lea ecx, [ebp + 0x24]
call fcn.00403180
push eax
lea ecx, [ebp - 0x6a4]
push ecx
lea edx, [ebp - 0x46c]
push edx
push str.__s____s____s_
lea eax, [ebp - 0x954]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
jmp 0x402660
lea ecx, [ebp - 0x6a4]
push ecx
lea edx, [ebp - 0x46c]
push edx
push str.__s____s_
lea eax, [ebp - 0x954]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x3c
push 0
lea ecx, [ebp - 0x74c]
push ecx
call fcn.00405090
add esp, 0xc
mov dword [ebp - 0x74c], 0x3c
mov dword [ebp - 0x740], str.open
lea edx, [ebp - 0x21c]
mov dword [ebp - 0x73c], edx
lea eax, [ebp - 0x954]
mov dword [ebp - 0x738], eax
mov dword [ebp - 0x748], 0x440
mov dword [ebp - 0x730], 5
lea ecx, [ebp - 0x74c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0x490], 0
je 0x4026dd
push 0x8000
push 0
mov edx, dword [ebp - 0x490]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
call fcn.00401e90
test eax, eax
jne 0x40283c
cmp dword [ebp - 0x48c], 0x1000
je 0x40283c
xor eax, eax
mov word [ebp - 0xb64], ax
push 0x206
push 0
lea ecx, [ebp - 0xb62]
push ecx
call fcn.00405090
add esp, 0xc
push 0xa
call fcn.00401070
add esp, 4
push eax
push str.TEMP
call fcn.00406f5c
add esp, 4
push eax
push str._s_s.exe
lea edx, [ebp - 0xb64]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x958], 0
lea eax, [ebp - 0x958]
push eax
mov ecx, dword [ebp - 0x248]
push ecx
mov edx, dword [ebp - 0x24c]
push edx
mov eax, dword [ebp - 0x498]
push eax
call fcn.00401cf0
add esp, 0x10
mov dword [ebp - 0x95c], eax
cmp dword [ebp - 0x95c], 0
je 0x40278d
cmp dword [ebp - 0x958], 0
jne 0x402792
jmp 0x40283c
mov ecx, dword [ebp - 0x958]
push ecx
mov edx, dword [ebp - 0x95c]
push edx
lea eax, [ebp - 0xb64]
push eax
call fcn.00404ac0
add esp, 0xc
test eax, eax
jne 0x4027b5
jmp 0x40281f
lea ecx, [ebp - 0x6ec]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor edx, edx
mov word [ebp - 0x6bc], dx
mov dword [ebp - 0x6b4], 0
mov dword [ebp - 0x6b0], 0
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x6c0], 1
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x6ec]
push ecx
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea edx, [ebp - 0xb64]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [ebp - 0x95c], 0
je 0x40283c
push 0x8000
push 0
mov eax, dword [ebp - 0x95c]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp dword [ebp - 0x498], 0
je 0x402859
push 0x8000
push 0
mov ecx, dword [ebp - 0x498]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov byte [ebp - 0xb6a], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x238]
call fcn.00402fa0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x710]
call fcn.00402fa0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x488]
call fcn.00402fa0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00402fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.00402fa0
mov al, byte [ebp - 0xb6a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004054ee
mov esp, ebp
pop ebp
ret