Function at 0x1cf698
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x1cf9dc
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
or edi, 0xffffffff
mov edx, 1
mov eax, esi
call fcn.001d2018
mov eax, dword [esi + 0x24]
call fcn.00024934
test al, al
jne 0x1cf6e0
mov edx, 4
mov eax, esi
call fcn.001d2018
jmp 0x1cf9c1
mov eax, dword [esi + 0x20]
call fcn.00024934
test al, al
jne 0x1cf6fd
mov edx, 4
mov eax, esi
call fcn.001d2018
jmp 0x1cf9c1
cmp byte [esi + 0x29], 0
je 0x1cf70c
cmp byte [esi + 0x28], 0
je 0x1cf70c
or bl, 1
cmp byte [esi + 0x2b], 0
je 0x1cf71b
cmp byte [esi + 0x2a], 0
je 0x1cf71b
or bl, 2
test bl, bl
jne 0x1cf730
mov edx, 5
mov eax, esi
call fcn.001d2018
jmp 0x1cf9c1
mov eax, dword [esi + 0x1c]
cmp eax, 0x15
ja case.0x1cf73c.1
jmp dword [eax*4 + 0x1cf743]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, esi
call fcn.001cfa70
test al, al
je 0x1cf9c1
jmp 0x1cf916
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, esi
call fcn.001cfd18
test al, al
je 0x1cf9c1
jmp 0x1cf916
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, esi
call fcn.001d00cc
test al, al
je 0x1cf9c1
jmp 0x1cf916
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, esi
call fcn.001d0374
test al, al
je 0x1cf9c1
jmp 0x1cf916
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, esi
call fcn.001d0644
test al, al
je 0x1cf9c1
jmp 0x1cf916
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, esi
call fcn.001d0914
test al, al
je 0x1cf9c1
jmp 0x1cf916
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, esi
call fcn.001d0b9c
test al, al
je 0x1cf9c1
jmp 0x1cf916
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, esi
call fcn.001d0e30
test al, al
je 0x1cf9c1
jmp 0x1cf916
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, esi
call fcn.001d10c4
test al, al
je 0x1cf9c1
jmp 0x1cf916
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, esi
call fcn.001d1358
test al, al
je 0x1cf9c1
jmp 0x1cf916
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, esi
call fcn.001d15ec
test al, al
je 0x1cf9c1
jmp 0x1cf916
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, esi
call fcn.001d1880
test al, al
je 0x1cf9c1
jmp 0x1cf916
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, esi
call fcn.001d1b14
test al, al
je 0x1cf9c1
jmp 0x1cf916
mov edx, 3
mov eax, esi
call fcn.001d2018
jmp 0x1cf9c1
cmp byte [esi + 0x2c], 0
je 0x1cf955
mov eax, ebx
and al, 3
cmp al, 1
jne 0x1cf92f
lea eax, [ebp - 8]
mov edx, dword [esi + 0x30]
call fcn.00016cb0
mov eax, ebx
and al, 3
cmp al, 2
jne 0x1cf942
lea eax, [ebp - 8]
mov edx, dword [esi + 0x34]
call fcn.00016cb0
and bl, 3
cmp bl, 3
jne 0x1cf955
lea eax, [ebp - 8]
mov edx, dword [esi + 0x38]
call fcn.00016cb0
mov eax, dword [ebp - 4]
call fcn.000248ec
test al, al
jne 0x1cf96f
mov edx, 6
mov eax, esi
call fcn.001d2018
jmp 0x1cf9c1
cmp byte [esi + 0x18], 0
je 0x1cf981
push 0xbb8
call sub.kernel32.dll_Sleep_1
jmp 0x1cf9b5
push 5
push 0
mov eax, dword [ebp - 8]
call fcn.00016ce8
push eax
mov eax, dword [ebp - 4]
call fcn.00016ce8
push eax
push 0x1cf9ec
push edi
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
ja 0x1cf9b5
mov edx, 7
mov eax, esi
call fcn.001d2018
jmp 0x1cf9c1
mov edx, 2
mov eax, esi
call fcn.001d2018
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1cf9e3
lea eax, [ebp - 8]
mov edx, 2
call fcn.00016c54
ret