Function at 0x3a6a54
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x3a6a5c
push ecx
push ebx
push esi
mov byte [ebp - 2], dl
mov byte [ebp - 1], al
mov ebx, 0xbb42b8
xor eax, eax
push ebp
push 0x3a6db6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx]
mov eax, dword [eax + 0xb88]
xor edx, edx
call fcn.00346d48
mov eax, dword [ebx]
mov eax, dword [eax + 0xd3c]
xor edx, edx
call fcn.00346d48
mov eax, dword [ebx]
mov eax, dword [eax + 0xa18]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebx]
mov eax, dword [eax + 0xb08]
mov dl, 1
call fcn.00346d48
call fcn.0038e140
mov eax, dword [ebx]
mov esi, dword [eax + 0xa2c]
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, eax
lea ecx, [ebp - 8]
mov eax, dword [esi + 0x218]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 8]
call fcn.0038df2c
mov esi, eax
mov eax, dword [ebx]
mov eax, dword [eax + 0xb10]
xor edx, edx
call fcn.00332c10
mov eax, dword [ebx]
mov eax, dword [eax + 0xb28]
mov edx, 0x3a6dcc
call fcn.00346e58
lea edx, [ebp - 0x1c]
mov eax, dword [0x3b3de4]
call fcn.0038f208
cmp dword [ebp - 0x1c], 0
jne 0x3a6b30
mov eax, 0x3b3de4
mov edx, dword [0x3b3df0]
call fcn.00304db4
cmp dword [0x3b0e00], 1
jne 0x3a6b9a
cmp byte [ebp - 2], 3
jne 0x3a6b6e
mov eax, dword [0x3b3de4]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebx]
mov eax, dword [eax + 0xa2c]
mov edx, dword [eax]
call dword [edx + 0xcc]
push eax
mov ecx, esi
mov edx, dword [0x3b3dc8]
mov al, 3
call fcn.003a6380
jmp 0x3a6c00
mov eax, dword [0x3b3de4]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebx]
mov eax, dword [eax + 0xa2c]
mov edx, dword [eax]
call dword [edx + 0xcc]
push eax
mov ecx, esi
mov edx, dword [0x3b3dc8]
mov al, 4
call fcn.003a6380
jmp 0x3a6c00
cmp byte [ebp - 2], 0
jne 0x3a6bd1
mov eax, dword [0x3b3de4]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebx]
mov eax, dword [eax + 0xa2c]
mov edx, dword [eax]
call dword [edx + 0xcc]
push eax
lea eax, [ebp - 0x20]
call fcn.003a1ff8
mov edx, dword [ebp - 0x20]
mov ecx, esi
xor eax, eax
call fcn.003a6380
jmp 0x3a6c00
mov eax, dword [0x3b3de4]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebx]
mov eax, dword [eax + 0xa2c]
mov edx, dword [eax]
call dword [edx + 0xcc]
push eax
lea eax, [ebp - 0x24]
call fcn.003a1ff8
mov edx, dword [ebp - 0x24]
mov ecx, esi
mov al, 1
call fcn.003a6380
mov eax, dword [ebx]
mov eax, dword [eax + 0xb08]
xor edx, edx
call fcn.00346d48
mov al, byte [ebp - 1]
sub al, 1
jb 0x3a6c1e
je 0x3a6c3b
dec al
je 0x3a6c58
jmp 0x3a6c73
lea eax, [ebp - 0xc]
mov edx, dword [0x3b3dcc]
call fcn.00304df8
lea edx, [ebp - 0x10]
mov eax, dword [0x3b3dd0]
call fcn.0038f208
jmp 0x3a6c73
lea eax, [ebp - 0xc]
mov edx, dword [0x3b3dd4]
call fcn.00304df8
lea edx, [ebp - 0x10]
mov eax, dword [0x3b3dd8]
call fcn.0038f208
jmp 0x3a6c73
lea eax, [ebp - 0xc]
mov edx, dword [0x3b3ddc]
call fcn.00304df8
lea edx, [ebp - 0x10]
mov eax, dword [0x3b3de0]
call fcn.0038f208
lea ecx, [ebp - 0x28]
mov eax, dword [ebx]
mov eax, dword [eax + 0xe90]
mov eax, dword [eax + 0x218]
mov edx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x14]
call fcn.0038dfec
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
call fcn.0030516c
je 0x3a6cae
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x18]
call fcn.00304df8
cmp dword [ebp - 0x14], 0
jne 0x3a6cc1
lea eax, [ebp - 0x14]
mov edx, 0x3a6dd8
call fcn.00304df8
lea edx, [ebp - 0x2c]
mov eax, dword [0x3b3de4]
call fcn.0038daa0
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x14]
call fcn.0030506c
push dword [ebp - 0x10]
push 0x3a6dec
push dword [ebp - 8]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.003050e0
push 1
push 0x3a6df0
mov eax, dword [ebp - 0x10]
call fcn.00305220
push eax
mov eax, dword [ebp - 0xc]
call fcn.00305220
push eax
push 0
mov eax, dword [ebx]
call fcn.0034d610
push eax
call sub.shell32.dll_ShellExecuteA
mov al, byte [ebp - 1]
sub al, 1
jb 0x3a6d2b
je 0x3a6d4c
dec al
je 0x3a6d6d
jmp 0x3a6d8c
cmp byte [0x3b3de8], 0
je 0x3a6d8c
mov eax, dword [ebx]
mov eax, dword [eax + 0xb30]
mov eax, dword [eax + 0x218]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x3a6d8c
cmp byte [0x3b3de9], 0
je 0x3a6d8c
mov eax, dword [ebx]
mov eax, dword [eax + 0xb30]
mov eax, dword [eax + 0x218]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x3a6d8c
cmp byte [0x3b3dea], 0
je 0x3a6d8c
mov eax, dword [ebx]
mov eax, dword [eax + 0xb30]
mov eax, dword [eax + 0x218]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx]
mov eax, dword [eax + 0xa18]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3a6dbd
lea eax, [ebp - 0x2c]
mov edx, 0xa
call fcn.00304d84
ret