Function at 0x6461204a
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x646180b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor esi, esi
mov dword [ebp - 0x218], edx
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], ecx
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x270]
xor ebx, ebx
push 0x44
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea edi, [ebp - 0x228]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x6461800c]
cmp eax, 0x6461800c
je 0x646120d0
test byte [eax + 0x1c], 2
je 0x646120d0
cmp byte [eax + 0x19], 5
jb 0x646120d0
push dword [eax + 0x14]
mov edx, 0x64603dd0
push dword [eax + 0x10]
push 0x49
pop ecx
call fcn.6460534c
push 0x20019
push 0
mov edx, 0x64603b40
mov ecx, 0x80000000
call fcn.6460f8df
mov edi, eax
test edi, edi
jne 0x64612133
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x6461800c]
cmp ecx, 0x6461800c
je 0x64612310
test byte [ecx + 0x1c], 2
je 0x64612310
cmp byte [ecx + 0x19], 2
jb 0x64612310
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x4a
mov edx, 0x64603dd0
pop ecx
call fcn.64605370
jmp 0x64612310
push ecx
push 0
xor edx, edx
mov ecx, edi
push 0
inc edx
call fcn.6460f96e
mov ebx, eax
test ebx, ebx
jne 0x646121cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x6461800c]
cmp eax, 0x6461800c
je 0x64612180
test byte [eax + 0x1c], 2
je 0x64612180
cmp byte [eax + 0x19], 2
jb 0x64612180
push esi
push dword [eax + 0x14]
mov edx, 0x64603dd0
push dword [eax + 0x10]
push 0x4b
pop ecx
call fcn.64605370
push ecx
push 0
push 0
push 2
pop edx
mov ecx, edi
call fcn.6460f96e
mov ebx, eax
test ebx, ebx
jne 0x646121cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x6461800c]
cmp eax, 0x6461800c
je 0x64612310
test byte [eax + 0x1c], 2
je 0x64612310
cmp byte [eax + 0x19], 2
jb 0x64612310
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x4c
jmp 0x64612123
push 0x64603b90
push ebx
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x64612218
mov esi, 0x65b
mov eax, dword [0x6461800c]
cmp eax, 0x6461800c
je 0x64612310
test byte [eax + 0x1c], 2
je 0x64612310
cmp byte [eax + 0x19], 2
jb 0x64612310
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x4d
jmp 0x64612123
push dword [ebp - 0x214]
xor ecx, ecx
push dword [ebp - 0x218]
mov word [eax], cx
lea eax, [ebp - 0x210]
push ebx
push 0x64603b9c
push 0x104
push eax
call fcn.64605260
add esp, 0x18
test eax, eax
jns 0x6461228e
mov ecx, eax
movzx esi, ax
and ecx, 0x1fff0000
cmp ecx, 0x70000
je 0x6461225c
mov esi, eax
mov eax, dword [0x6461800c]
cmp eax, 0x6461800c
je 0x64612310
test byte [eax + 0x1c], 2
je 0x64612310
cmp byte [eax + 0x19], 2
jb 0x64612310
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x4e
jmp 0x64612123
push 9
pop eax
mov word [ebp - 0x240], ax
xor ecx, ecx
lea eax, [ebp - 0x228]
mov dword [ebp - 0x270], 0x44
push eax
lea eax, [ebp - 0x270]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x210]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x646122f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x6461800c]
cmp eax, 0x6461800c
je 0x64612310
test byte [eax + 0x1c], 2
je 0x64612310
cmp byte [eax + 0x19], 2
jb 0x64612310
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x4f
jmp 0x64612123
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call fcn.6460d3c9
test edi, edi
je 0x64612322
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.64616f60
leave
ret