Function at 0x469080
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x5c]
sub esp, 0x5c
push 0xffffffffffffffff
push 0x4ba222
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push ebx
mov ebx, dword [ebp + 0x64]
lea eax, [ebp - 0x80]
push esi
push edi
push ebx
push eax
call fcn.00468ad0
add esp, 8
mov edi, dword [ebp + 0x68]
mov dword [ebp - 4], 0
mov esi, dword [edi]
cmp esi, dword [edi + 4]
je 0x46914f
nop dword [eax + eax]
push 1
push 0x4bcf0c
lea ecx, [ebp - 0x80]
call fcn.00406d80
lea eax, [ebp + 0x30]
push esi
push eax
call fcn.00468ad0
add esp, 8
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 1
call fcn.00406eb0
mov eax, dword [ebp + 0x44]
mov byte [ebp - 4], 0
cmp eax, 0x10
jb 0x469147
mov ecx, dword [ebp + 0x30]
inc eax
cmp eax, 0x1000
jb 0x46913e
test cl, 0x1f
jne 0x469449
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x469449
sub ecx, eax
cmp ecx, 4
jb 0x469449
cmp ecx, 0x23
ja 0x469449
mov ecx, eax
push ecx
call fcn.004539d0
add esp, 4
add esi, 0x18
cmp esi, dword [edi + 4]
jne 0x4690d0
xor eax, eax
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0046bb30
xor eax, eax
mov dword [ebp + 0x54], 0
add esp, 8
mov dword [ebp + 0x14], 7
mov dword [ebp + 0x10], 0
mov word [ebp], ax
cmp dword [ebx + 0x10], 0x104
mov byte [ebp - 4], 3
jbe 0x469220
push ebx
lea ecx, [ebp - 0x12c]
call fcn.00466190
cmp byte [ebp - 0xc0], 0
mov byte [ebp - 4], 4
je 0x469211
lea eax, [ebp]
push eax
push ebx
call fcn.0046bb30
add esp, 8
lea eax, [ebp + 0x30]
lea ecx, [ebp - 0x12c]
push eax
call fcn.00466b80
mov esi, dword [eax + 0x10]
mov eax, dword [ebp + 0x44]
cmp eax, 0x10
jb 0x4691f0
inc eax
lea ecx, [ebp + 0x30]
push eax
push dword [ebp + 0x30]
call fcn.004046a0
test esi, esi
jne 0x469203
push 4
push str..EXE
lea ecx, [ebp]
call fcn.004684e0
cmp dword [ebp + 0x14], 8
lea ebx, [ebp]
cmovae ebx, dword [ebp]
mov dword [ebp + 0x54], ebx
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 3
call fcn.004663e0
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x3c], 0x80
mov word [ebp - 0x36], ax
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor al, al
mov byte [ebp + 0x6b], al
mov eax, dword [ebp + 0x70]
test eax, eax
je 0x46929c
push 2
push 1
push 0
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [eax]
push esi
call fcn.00476ff0
push eax
push esi
call ebx
mov ecx, dword [ebp + 0x70]
push 1
mov byte [ebp + 0x6b], 1
call fcn.0046bce0
jmp 0x4692c4
push 0xfffffffffffffff6
call edi
test eax, eax
je 0x4692bd
push 2
push 1
push 0
lea eax, [ebp - 0x30]
push eax
push esi
push 0xfffffffffffffff6
call edi
push eax
push esi
call ebx
mov byte [ebp + 0x6b], 1
jmp 0x4692c4
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp + 0x74]
test ecx, ecx
je 0x4692e7
mov ecx, dword [ecx]
lea eax, [ebp - 0x2c]
push 2
push 1
push 0
push eax
push esi
call fcn.0046bcd0
push eax
push esi
call ebx
mov byte [ebp + 0x6b], 1
jmp 0x46930f
push 0xfffffffffffffff5
call edi
test eax, eax
je 0x469308
push 2
push 1
push 0
lea eax, [ebp - 0x2c]
push eax
push esi
push 0xfffffffffffffff5
call edi
push eax
push esi
call ebx
mov byte [ebp + 0x6b], 1
jmp 0x46930f
mov dword [ebp - 0x2c], 0
cmp dword [ebp + 0x78], 0
je 0x469335
mov edi, dword [ebp + 0x78]
lea eax, [ebp - 0x28]
push 2
push 1
push 0
mov ecx, dword [edi]
push eax
push esi
call fcn.0046bcd0
push eax
push esi
call ebx
mov bl, 1
mov byte [ebp + 0x6b], bl
jmp 0x469364
push 0xfffffffffffffff4
call edi
test eax, eax
je 0x469357
push 2
push 1
push 0
lea eax, [ebp - 0x28]
push eax
push esi
push 0xfffffffffffffff4
call edi
push eax
push esi
call ebx
mov bl, 1
mov byte [ebp + 0x6b], bl
jmp 0x469361
mov bl, byte [ebp + 0x6b]
mov dword [ebp - 0x28], 0
mov edi, dword [ebp + 0x78]
mov eax, dword [ebp + 0x74]
test eax, eax
je 0x469374
push 2
mov ecx, eax
call fcn.0046bce0
test edi, edi
je 0x469381
push 2
mov ecx, edi
call fcn.0046bce0
test bl, bl
je 0x46938c
or dword [ebp - 0x3c], 0x100
xor eax, eax
mov dword [ebp + 0x2c], 7
mov dword [ebp + 0x28], 0
mov word [ebp + 0x18], ax
lea eax, [ebp + 0x18]
mov byte [ebp - 4], 5
push eax
push dword [ebp + 0x6c]
call fcn.0046bb30
add esp, 8
cmp dword [ebp + 0x28], 0
jne 0x4693c2
mov dword [ebp + 0x58], 0
jmp 0x4693d0
cmp dword [ebp + 0x2c], 8
lea eax, [ebp + 0x18]
cmovae eax, dword [ebp + 0x18]
mov dword [ebp + 0x58], eax
xor ebx, ebx
xor edi, edi
xor esi, esi
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x50], edi
mov eax, dword [ebp + 0x7c]
mov byte [ebp - 4], 6
cmp dword [eax + 4], edi
je 0x46947d
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00468da0
mov esi, eax
add esp, 8
lea eax, [ebp + 0x48]
cmp eax, esi
je 0x469431
mov ecx, eax
call fcn.0043ebf0
mov ebx, dword [esi]
mov eax, dword [esi + 4]
mov edi, dword [esi + 8]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x50], edi
mov dword [esi + 8], 0
mov ecx, dword [ebp + 0x3c]
test ecx, ecx
je 0x46947b
mov eax, dword [ebp + 0x44]
sub eax, ecx
cmp eax, 0x1000
jb 0x469472
test cl, 0x1f
je 0x46944e
call fcn.0048d32d
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x46945a
call fcn.0048d32d
sub ecx, eax
cmp ecx, 4
jae 0x469466
call fcn.0048d32d
cmp ecx, 0x23
jbe 0x469470
call fcn.0048d32d
mov ecx, eax
push ecx
call fcn.004539d0
add esp, 4
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
neg eax
lea edx, [ebp - 0x90]
push edx
sbb eax, eax
lea edx, [ebp - 0x68]
push edx
push dword [ebp + 0x58]
and eax, 0xf8000000
lea ecx, [ebp - 0x24]
push esi
add eax, 0x8000000
cmp dword [ebp - 0x10], 8
push eax
movzx eax, byte [ebp + 0x6b]
cmovae ecx, dword [ebp - 0x24]
push eax
push 0
push 0
push ecx
push dword [ebp + 0x54]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0x68], eax
test ecx, ecx
je 0x4694d2
push ecx
call esi
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4694dc
push eax
call esi
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4694e6
push eax
call esi
cmp dword [ebp + 0x68], 0
je 0x46960f
push dword [ebp - 0x8c]
call esi
push 0x10
call fcn.00464239
add esp, 4
mov dword [ebp + 0x68], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x469524
push dword [ebp - 0x88]
mov ecx, eax
push dword [ebp - 0x90]
call fcn.00468150
mov esi, eax
jmp 0x469526
xor esi, esi
test ebx, ebx
je 0x46956b
sub edi, ebx
cmp edi, 0x1000
jb 0x469562
test bl, 0x1f
je 0x46953e
call fcn.0048d32d
mov eax, dword [ebx - 4]
cmp eax, ebx
jb 0x46954a
call fcn.0048d32d
sub ebx, eax
cmp ebx, 4
jae 0x469556
call fcn.0048d32d
cmp ebx, 0x23
jbe 0x469560
call fcn.0048d32d
mov ebx, eax
push ebx
call fcn.004539d0
add esp, 4
mov eax, dword [ebp + 0x2c]
cmp eax, 8
jb 0x469580
inc eax
lea ecx, [ebp + 0x18]
push eax
push dword [ebp + 0x18]
call fcn.00462c0c
xor eax, eax
mov dword [ebp + 0x2c], 7
mov word [ebp + 0x18], ax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x28], 0
cmp eax, 8
jb 0x4695a9
inc eax
lea ecx, [ebp]
push eax
push dword [ebp]
call fcn.00462c0c
xor eax, eax
mov dword [ebp + 0x14], 7
mov word [ebp], ax
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x10], 0
cmp eax, 8
jb 0x4695d2
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.00462c0c
xor eax, eax
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x14], 0
cmp eax, 0x10
jb 0x4695fb
inc eax
lea ecx, [ebp - 0x80]
push eax
push dword [ebp - 0x80]
call fcn.004046a0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
lea esp, [ebp + 0x5c]
pop ebp
ret
push 0x15
push str.Cannot_launch_process
lea ecx, [ebp + 0x30]
mov dword [ebp + 0x44], 0xf
mov dword [ebp + 0x40], 0
mov byte [ebp + 0x30], 0
call fcn.00404290
push 0
push dword [ebp + 0x64]
lea eax, [ebp + 0x30]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0xbc]
call fcn.0046a010
push 0x4f4650
lea eax, [ebp - 0xbc]
push eax
call fcn.00483d2d
int3