Function at 0x467d40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x880
mov eax, dword [0x564610]
xor eax, ebp
mov dword [ebp - 4], eax
push str.04CE0CB6_CDF3_4a4b_8B9D_292A455FAF5B
call fcn.00443cd0
add esp, 4
test eax, eax
je 0x467d77
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f019a
mov esp, ebp
pop ebp
ret
push edi
xor edi, edi
push 0x410
lea eax, [ebp - 0x82a]
push edi
push eax
mov word [ebp - 0x82c], di
call sub.MSVCR80.dll_memset
push 0x410
lea ecx, [ebp - 0x416]
push edi
push ecx
mov word [ebp - 0x418], di
call sub.MSVCR80.dll_memset
push 0x40
lea edx, [ebp - 0x87c]
push edi
push edx
call sub.MSVCR80.dll_memset
xor eax, eax
add esp, 0x24
mov dword [ebp - 0x838], eax
mov dword [ebp - 0x834], eax
mov dword [ebp - 0x830], eax
push 0x104
lea eax, [ebp - 0x82c]
push eax
push edi
mov dword [ebp - 0x83c], edi
mov dword [ebp - 0x880], 0x44
mov dword [ebp - 0x854], 1
mov word [ebp - 0x850], di
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x82c]
push 0x5c
push ecx
call dword [sym.imp.MSVCR80.dll_wcsrchr]
add esp, 8
cmp eax, edi
jne 0x467e2d
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f019a
mov esp, ebp
pop ebp
ret
mov word [eax + 2], di
lea eax, [ebp - 0x418]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x467e40
sub eax, edx
sar eax, 1
push esi
mov esi, dword [sym.imp.MSVCR80.dll_wcsncat]
mov edx, 0x208
sub edx, eax
push edx
lea eax, [ebp - 0x418]
push 0x50a068
push eax
call esi
lea eax, [ebp - 0x418]
add esp, 0xc
lea edx, [eax + 2]
jmp 0x467e80
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x467e80
sub eax, edx
sar eax, 1
mov ecx, 0x208
sub ecx, eax
push ecx
lea edx, [ebp - 0x82c]
push edx
lea eax, [ebp - 0x418]
push eax
call esi
lea eax, [ebp - 0x418]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x467eb3
sub eax, edx
sar eax, 1
mov ecx, 0x208
sub ecx, eax
push ecx
lea edx, [ebp - 0x418]
push 0x50a04c
push edx
call esi
lea eax, [ebp - 0x418]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x467ee4
sub eax, edx
sar eax, 1
mov ecx, 0x208
sub ecx, eax
push ecx
lea edx, [ebp - 0x418]
push 0x50a068
push edx
call esi
lea eax, [ebp - 0x418]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x467f15
sub eax, edx
sar eax, 1
mov ecx, 0x208
sub ecx, eax
push ecx
lea edx, [ebp - 0x418]
push 0x5232b4
push edx
call esi
lea eax, [ebp - 0x418]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x467f46
sub eax, edx
sar eax, 1
mov ecx, 0x208
sub ecx, eax
push ecx
lea edx, [ebp - 0x418]
push str._tray
push edx
call esi
lea eax, [ebp - 0x418]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x467f77
sub eax, edx
sar eax, 1
mov ecx, 0x208
sub ecx, eax
push ecx
lea edx, [ebp - 0x418]
push 0x5232b4
push edx
call esi
lea eax, [ebp - 0x418]
add esp, 0xc
lea edx, [eax + 2]
jmp 0x467fb0
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x467fb0
sub eax, edx
sar eax, 1
mov ecx, 0x208
sub ecx, eax
push ecx
lea edx, [ebp - 0x418]
push str._doctor
push edx
call esi
add esp, 0xc
lea eax, [ebp - 0x83c]
push eax
lea ecx, [ebp - 0x880]
push ecx
push edi
push edi
push 0x2000000
push edi
push edi
push edi
lea edx, [ebp - 0x418]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop edi
call fcn.004f019a
mov esp, ebp
pop ebp
ret