Function at 0x2e00ae4a
Capabilities:
Create process on windows

Disassembly:
push 0x400
mov eax, 0x2e020a95
call fcn.2e00eaaf
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x198]
mov esi, ecx
push eax
mov ecx, edi
mov dword [ebp - 0x1f4], edi
call fcn.2e00d461
lea eax, [ebp - 0x17c]
xor ebx, ebx
push eax
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.2e00d47c
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 1
mov dword [ebp - 0x1f0], ebx
call fcn.2e00a28d
push 7
pop edi
push ebx
lea ecx, [ebp - 0x1b4]
mov dword [ebp - 0x19c], edi
call fcn.2e003a65
push ebx
lea ecx, [ebp - 0x1ec]
mov dword [ebp - 0x1d4], edi
call fcn.2e003a65
push ebx
lea ecx, [ebp - 0x1d0]
mov dword [ebp - 0x1b8], edi
call fcn.2e003a65
mov ecx, dword [esi + 0x20]
mov byte [ebp - 4], 5
call fcn.2e007839
test al, al
je 0x2e00b105
push 1
lea eax, [ebp - 0x160]
push eax
call fcn.2e007fb7
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 6
jb 0x2e00af04
mov eax, dword [eax + 4]
jmp 0x2e00af07
add eax, 4
push eax
lea ecx, [ebp - 0x344]
call fcn.2e003b55
push dword [eax]
lea ecx, [ebp - 0x1b4]
mov byte [ebp - 4], 7
call fcn.2e00479e
lea eax, [ebp - 0x340]
cmp dword [ebp - 0x344], eax
je 0x2e00af3e
push dword [ebp - 0x344]
call fcn.2e00ef71
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 5
call fcn.2e003b71
push ebx
push 0x529
lea eax, [ebp - 0x160]
push eax
call fcn.2e004e2e
push 8
pop edi
mov byte [ebp - 4], 8
cmp dword [eax + 0x18], edi
jb 0x2e00af73
mov eax, dword [eax + 4]
jmp 0x2e00af76
add eax, 4
mov ecx, dword [esi + 0x20]
push 2
push eax
call fcn.2e0080b4
push ebx
push 1
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 5
call fcn.2e003bbc
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x19c], edi
jae 0x2e00afa7
lea eax, [ebp - 0x1b0]
mov ecx, dword [esi + 0x20]
push 2
push eax
call fcn.2e00866e
push ebx
push 0x52a
lea eax, [ebp - 0x160]
push eax
call fcn.2e004e2e
mov byte [ebp - 4], 9
cmp dword [eax + 0x18], edi
jb 0x2e00afd2
mov eax, dword [eax + 4]
jmp 0x2e00afd5
add eax, 4
mov ecx, dword [esi + 0x20]
push 2
push eax
call fcn.2e0080b4
push ebx
push 1
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 5
call fcn.2e003bbc
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x180], edi
jae 0x2e00b006
lea eax, [ebp - 0x194]
mov ecx, dword [esi + 0x20]
push 2
push eax
call fcn.2e00866e
push ebx
push 0x52b
lea eax, [ebp - 0x160]
push eax
call fcn.2e004e2e
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x18], edi
jb 0x2e00b031
mov eax, dword [eax + 4]
jmp 0x2e00b034
add eax, 4
mov ecx, dword [esi + 0x20]
push 2
push eax
call fcn.2e0080b4
push ebx
push 1
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 5
call fcn.2e003bbc
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x164], edi
jae 0x2e00b065
lea eax, [ebp - 0x178]
mov ecx, dword [esi + 0x20]
push 2
push eax
call fcn.2e00866e
mov ecx, dword [ebp - 0x1f4]
call fcn.2e00d3f9
test al, al
je 0x2e00b105
push ebx
push 0x530
lea eax, [ebp - 0x160]
push eax
call fcn.2e004e2e
cmp dword [eax + 0x18], 8
mov byte [ebp - 4], 0xb
jb 0x2e00b0a4
mov eax, dword [eax + 4]
jmp 0x2e00b0a7
add eax, 4
mov ecx, dword [esi + 0x20]
push 2
push eax
call fcn.2e0080b4
push ebx
push 1
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 5
call fcn.2e003bbc
mov ecx, dword [ebp - 0x1f4]
lea eax, [ebp - 0x160]
push eax
call fcn.2e00d587
cmp dword [eax + 0x18], 8
mov byte [ebp - 4], 0xc
jb 0x2e00b0e5
mov eax, dword [eax + 4]
jmp 0x2e00b0e8
add eax, 4
mov ecx, dword [esi + 0x20]
push 2
push eax
call fcn.2e00866e
push ebx
push 1
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 5
call fcn.2e003bbc
push 0x10b
lea eax, [ebp - 0x143]
push ebx
push eax
mov byte [ebp - 0x144], bl
call fcn.2e00e5f0
mov ecx, dword [esi + 0x20]
add esp, 0xc
call fcn.2e007839
test al, al
je 0x2e00b221
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x228]
push eax
mov ecx, esi
call fcn.2e009ea3
mov ecx, dword [esi + 0x20]
push eax
lea eax, [ebp - 0x160]
push eax
mov byte [ebp - 4], 0xd
call fcn.2e008b70
push ebx
push 1
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0xf
call fcn.2e003bbc
cmp dword [ebp - 0x148], 0x10
mov eax, dword [ebp - 0x15c]
jae 0x2e00b180
lea eax, [ebp - 0x15c]
push eax
lea ecx, [ebp - 0x344]
call fcn.2e003b55
push dword [eax]
lea ecx, [ebp - 0x1ec]
mov byte [ebp - 4], 0x10
call fcn.2e00479e
lea eax, [ebp - 0x340]
cmp dword [ebp - 0x344], eax
je 0x2e00b1b7
push dword [ebp - 0x344]
call fcn.2e00ef71
pop ecx
push 0xffffffffffffffff
push 0x2e0019d0
mov edi, 0x10c
lea eax, [ebp - 0x144]
push edi
push eax
call fcn.2e010a07
mov eax, dword [ebp - 0x15c]
add esp, 0x10
cmp dword [ebp - 0x148], 0x10
jae 0x2e00b1e8
lea eax, [ebp - 0x15c]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x144]
push edi
push eax
call fcn.2e00eead
push 0xffffffffffffffff
push 0x2e0019cc
lea eax, [ebp - 0x144]
push edi
push eax
call fcn.2e00eead
add esp, 0x20
push ebx
push 1
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 5
call fcn.2e003b71
mov eax, 0x2e001990
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x2e00b229
sub eax, edx
mov edi, eax
lea eax, [ebp - 0x144]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x2e00b23d
mov edx, dword [ebp - 0x168]
sub eax, ecx
mov ecx, dword [ebp - 0x184]
add edx, ecx
add edx, eax
lea edi, [edx + edi + 1]
push edi
call fcn.2e00f0d8
pop ecx
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x164], 8
mov eax, dword [ebp - 0x178]
mov byte [ebp - 4], 0x11
jae 0x2e00b280
lea eax, [ebp - 0x178]
push eax
lea ecx, [ebp - 0x2c4]
call fcn.2e006494
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x180], 8
mov eax, dword [ebp - 0x194]
mov byte [ebp - 4], 0x12
jae 0x2e00b2ab
lea eax, [ebp - 0x194]
push eax
lea ecx, [ebp - 0x3c8]
call fcn.2e006494
mov ecx, dword [ebp - 0x20c]
mov ecx, dword [ecx]
mov eax, dword [eax]
push ecx
push eax
lea eax, [ebp - 0x144]
push eax
push 0x2e001990
push edi
push dword [ebp - 0x1f4]
call fcn.2e00f0ba
add esp, 0x18
cmp eax, 0xffffffff
lea eax, [ebp - 0x3c4]
sete byte [ebp - 0x1f5]
cmp dword [ebp - 0x3c8], eax
je 0x2e00b302
push dword [ebp - 0x3c8]
call fcn.2e00ef71
pop ecx
lea eax, [ebp - 0x2c0]
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x2c4], eax
je 0x2e00b320
push dword [ebp - 0x2c4]
call fcn.2e00ef71
pop ecx
cmp byte [ebp - 0x1f5], bl
je 0x2e00b359
push 0x2e001300
lea ecx, [ebp - 0x228]
call fcn.2e004779
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x13
call fcn.2e004479
push 0x2e0212c0
lea eax, [ebp - 0x38]
push eax
call fcn.2e00e596
push 0x44
lea eax, [ebp - 0x40c]
push ebx
push eax
call fcn.2e00e5f0
xor eax, eax
lea edi, [ebp - 0x208]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x40c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x1f4]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
jne 0x2e00b3ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1f0], eax
jmp 0x2e00b53f
or edi, 0xffffffff
push edi
push dword [ebp - 0x208]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
jne 0x2e00b3d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1f0], eax
jmp 0x2e00b519
lea eax, [ebp - 0x1f0]
push eax
push dword [ebp - 0x208]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x2e00b3c1
mov ecx, dword [esi + 0x20]
call fcn.2e007839
test al, al
je 0x2e00b519
push dword [ebp - 0x1f0]
lea eax, [ebp - 0x30]
push 0x2e0013a8
push eax
call fcn.2e009186
add esp, 0xc
cmp eax, edi
je 0x2e00b463
push ebx
push 0x52f
lea eax, [ebp - 0x228]
push eax
call fcn.2e004e2e
cmp dword [eax + 0x18], 8
mov byte [ebp - 4], 0x14
jb 0x2e00b435
mov eax, dword [eax + 4]
jmp 0x2e00b438
add eax, 4
mov ecx, dword [esi + 0x20]
push 2
push eax
call fcn.2e0080b4
push ebx
push 1
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0x11
call fcn.2e003bbc
mov ecx, dword [esi + 0x20]
push 2
lea eax, [ebp - 0x30]
push eax
call fcn.2e00868e
cmp dword [ebp - 0x1f0], ebx
je 0x2e00b481
xor eax, eax
cmp dword [ebp - 0x1f0], 0xbc2
setne al
add eax, 0x53c
jmp 0x2e00b486
mov eax, 0x53e
push ebx
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.2e004e2e
push edi
push ebx
push eax
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 0x15
call fcn.2e004224
push ebx
push 1
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0x11
call fcn.2e003bbc
push ebx
push 0x52c
lea eax, [ebp - 0x228]
push eax
call fcn.2e004e2e
cmp dword [eax + 0x18], 8
mov byte [ebp - 4], 0x16
jb 0x2e00b4d9
mov eax, dword [eax + 4]
jmp 0x2e00b4dc
add eax, 4
mov ecx, dword [esi + 0x20]
push 2
push eax
call fcn.2e0080b4
push ebx
push 1
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0x11
call fcn.2e003bbc
cmp dword [ebp - 0x1b8], 8
mov eax, dword [ebp - 0x1cc]
jae 0x2e00b50e
lea eax, [ebp - 0x1cc]
mov ecx, dword [esi + 0x20]
push 2
push eax
call fcn.2e00866e
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x208], ebx
je 0x2e00b52f
push dword [ebp - 0x208]
call edi
cmp dword [ebp - 0x204], ebx
je 0x2e00b53f
push dword [ebp - 0x204]
call edi
mov ecx, dword [esi + 0x20]
call fcn.2e007839
xor edi, edi
inc edi
test al, al
je 0x2e00b6ab
push edi
lea eax, [ebp - 0x228]
push eax
call fcn.2e007fb7
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0x17
jb 0x2e00b56e
mov eax, dword [eax + 4]
jmp 0x2e00b571
add eax, 4
push eax
lea ecx, [ebp - 0x344]
call fcn.2e003b55
push dword [eax]
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x18
call fcn.2e004d0e
lea eax, [ebp - 0x340]
cmp dword [ebp - 0x344], eax
je 0x2e00b5a8
push dword [ebp - 0x344]
call fcn.2e00ef71
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0x1b
call fcn.2e003b71
push ebx
push 0x52e
lea eax, [ebp - 0x2c]
push eax
call fcn.2e004e2e
cmp dword [eax + 0x18], 8
mov byte [ebp - 4], 0x1c
jb 0x2e00b5d7
mov eax, dword [eax + 4]
jmp 0x2e00b5da
add eax, 4
mov ecx, dword [esi + 0x20]
push 2
push eax
call fcn.2e0080b4
push ebx
push edi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x1b
call fcn.2e003bbc
cmp dword [ebp - 0x148], 8
mov eax, dword [ebp - 0x15c]
jae 0x2e00b608
lea eax, [ebp - 0x15c]
mov ecx, dword [esi + 0x20]
push 2
push eax
call fcn.2e00866e
mov ecx, dword [esi + 0x20]
push 2
call fcn.2e0084e0
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x240]
call fcn.2e00ac1b
lea eax, [ebp - 0x17c]
push eax
lea ecx, [ebp - 0x240]
call fcn.2e00ac1b
lea eax, [ebp - 0x1d0]
push eax
lea ecx, [ebp - 0x240]
call fcn.2e00ac1b
lea eax, [ebp - 0x1ec]
push eax
lea ecx, [ebp - 0x240]
call fcn.2e00ac1b
lea eax, [ebp - 0x1b4]
push eax
lea ecx, [ebp - 0x240]
call fcn.2e00ac1b
lea eax, [ebp - 0x160]
push eax
lea ecx, [ebp - 0x240]
call fcn.2e00ac1b
mov esi, dword [esi + 0x24]
cmp esi, ebx
je 0x2e00b69e
lea eax, [ebp - 0x240]
push eax
mov ecx, esi
call fcn.2e00d32b
push ebx
push edi
lea ecx, [ebp - 0x160]
call fcn.2e003bbc
mov esi, dword [ebp - 0x1f0]
cmp dword [ebp - 0x1f4], ebx
je 0x2e00b6c5
push dword [ebp - 0x1f4]
call fcn.2e00eb4a
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x1d0]
call fcn.2e003bbc
push ebx
push edi
lea ecx, [ebp - 0x1ec]
call fcn.2e003bbc
push ebx
push edi
lea ecx, [ebp - 0x1b4]
call fcn.2e003bbc
lea ecx, [ebp - 0x240]
call fcn.2e00a3ba
push dword [ebp - 0x240]
call fcn.2e00e33e
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x17c]
call fcn.2e003bbc
push ebx
push edi
lea ecx, [ebp - 0x198]
call fcn.2e003bbc
mov eax, esi
call fcn.2e00eb32
ret 4