Function at 0x64f5a1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 1], bl
test edi, edi
je 0x64f5ca
cmp edi, 1
je 0x64f5ca
jle 0x64f5d2
cmp edi, 3
jle 0x64f5ca
cmp edi, 4
jne 0x64f5d2
mov byte [ebp - 1], 1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
jmp 0x64f608
call fcn.00639963
mov dword [eax], ebx
call fcn.00639997
mov dword [eax], 0x16
call fcn.00640278
or eax, 0xffffffff
jmp 0x64f7b9
add eax, 2
cmp word [eax], bx
jne 0x64f5f1
cmp word [eax + 2], bx
je 0x64f608
push 0x20
pop edx
mov word [eax], dx
add eax, 2
cmp word [eax], bx
jne 0x64f5f1
push esi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.0063ac00
mov dword [ebp - 0x68], esi
mov esi, dword [0x7976ac]
add esp, 0xc
test esi, esi
je 0x64f64f
lea edx, [esi - 1]
mov eax, edx
sar eax, 5
mov ecx, edx
mov eax, dword [eax*4 + 0x77a200]
and ecx, 0x1f
shl ecx, 6
cmp byte [eax + ecx + 4], bl
jne 0x64f64d
dec edx
dec esi
jne 0x64f62f
test esi, esi
js 0x64f7aa
cmp esi, 0x3332
jae 0x64f7aa
mov eax, esi
imul eax, eax, 5
add eax, 4
mov word [ebp - 0x36], ax
movzx eax, ax
push 1
push eax
call fcn.0063c55c
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
test eax, eax
je 0x64f7aa
mov dword [eax], esi
mov eax, dword [ebp - 0x34]
mov edx, ebx
lea ecx, [eax + 4]
mov dword [ebp - 0xc], ecx
lea ecx, [eax + 4]
add ecx, esi
mov dword [ebp - 8], ecx
test esi, esi
jle 0x64f6e3
mov edi, dword [ebp - 0xc]
mov ecx, edx
and ecx, 0x1f
mov eax, edx
sar eax, 5
shl ecx, 6
add ecx, dword [eax*4 + 0x77a200]
mov al, byte [ecx + 4]
test al, 0x10
jne 0x64f6c9
mov byte [edi], al
mov eax, dword [ecx]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, ecx
jmp 0x64f6d1
mov eax, dword [ebp - 8]
mov byte [edi], bl
or dword [eax], 0xffffffff
inc edx
add eax, 4
inc edi
mov dword [ebp - 8], eax
cmp edx, esi
jl 0x64f6a1
mov eax, dword [ebp - 0x34]
mov edi, dword [ebp + 8]
cmp byte [ebp - 1], bl
je 0x64f717
lea edx, [eax + 4]
add eax, 4
mov ecx, ebx
add eax, esi
mov dword [ebp + 8], esi
cmp esi, 3
jl 0x64f701
mov dword [ebp + 8], 3
cmp ecx, dword [ebp + 8]
jge 0x64f712
mov byte [edx], bl
or dword [eax], 0xffffffff
inc ecx
inc edx
add eax, 4
jmp 0x64f6f2
push 8
pop esi
jmp 0x64f719
mov esi, ebx
call fcn.00639963
mov dword [eax], ebx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push dword [ebp + 0x14]
or esi, 0x400
push esi
push 1
push ebx
push ebx
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x34]
mov dword [ebp + 8], eax
call fcn.00634402
pop ecx
test esi, esi
jne 0x64f766
push dword [ebp + 8]
call fcn.00639976
pop ecx
jmp 0x64f7b5
cmp edi, 2
je 0x64f7bd
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x64f792
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ebx, dword [ebp - 0x14]
jmp 0x64f797
cmp edi, 4
jne 0x64f79e
push dword [ebp - 0x24]
call esi
jmp 0x64f7a1
mov ebx, dword [ebp - 0x24]
push dword [ebp - 0x20]
call esi
mov eax, ebx
jmp 0x64f7b8
call fcn.00639997
mov dword [eax], 0xc
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
push ebx
call fcn.00634f1a
int3