Function at 0x423820
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x6fb448]
xor eax, ebp
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x284], 0
xor eax, eax
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x50], 0
push 0x40
push 0
lea ecx, [ebp - 0x4c]
push ecx
call fcn.005b02a0
add esp, 0xc
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x274], 0
mov byte [ebp - 0x160], 0
push 0x103
push 0
lea edx, [ebp - 0x15f]
push edx
call fcn.005b02a0
add esp, 0xc
mov byte [ebp - 0x270], 0
push 0x103
push 0
lea eax, [ebp - 0x26f]
push eax
call fcn.005b02a0
add esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401389
add esp, 4
test eax, eax
je 0x4238db
xor eax, eax
jmp 0x423c2d
cmp dword [ebp + 0x28], 0
jne 0x4238fb
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x24], 1
mov word [ebp - 0x20], 0
lea edx, [ebp - 0x50]
mov dword [ebp + 0x28], edx
cmp dword [ebp + 0x2c], 0
jne 0x42390a
lea eax, [ebp - 0x284]
mov dword [ebp + 0x2c], eax
push 0x104
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x160]
push edx
call fcn.00402725
add esp, 0xc
lea eax, [ebp - 0x160]
push eax
call fcn.005b4690
add esp, 4
movsx ecx, byte [ebp + eax - 0x161]
cmp ecx, 0x2e
jne 0x423959
push 0x104
push 0x64c808
lea edx, [ebp - 0x160]
push edx
call fcn.004014f1
add esp, 0xc
jmp 0x423972
push 0x104
push 0x64c80c
lea eax, [ebp - 0x160]
push eax
call fcn.004014f1
add esp, 0xc
lea ecx, [ebp - 0x160]
push ecx
call fcn.004028ab
add esp, 4
test eax, eax
je 0x423a88
mov byte [ebp - 0x308], 0
push 0x7f
push 0
lea edx, [ebp - 0x307]
push edx
call fcn.005b02a0
add esp, 0xc
lea eax, [ebp - 0x160]
push eax
lea ecx, [ebp - 0x270]
push ecx
call fcn.005b4720
add esp, 8
lea edx, [ebp - 0x270]
push edx
call fcn.00402608
add esp, 4
push 0xa
lea eax, [ebp - 0x308]
push eax
call fcn.005b3db0
cdq
mov ecx, 0x8ae
idiv ecx
add edx, 0x8ae
push edx
call fcn.005b8940
add esp, 0xc
mov byte [ebp - 0x303], 0
push 0
lea edx, [ebp - 0x308]
push edx
push str..exe
push 0x104
lea eax, [ebp - 0x270]
push eax
call fcn.00402004
add esp, 0x14
push 1
lea ecx, [ebp - 0x270]
push ecx
lea edx, [ebp - 0x160]
push edx
call fcn.00401375
add esp, 0xc
test eax, eax
jne 0x423a88
push 0x4b0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x160]
push ecx
call fcn.00401375
add esp, 0xc
test eax, eax
jne 0x423a88
push 0x64c81c
lea edx, [ebp - 0x270]
push edx
lea eax, [ebp - 0x160]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.:8:CreateProcessExe___s_____s___will_FAIL:_An_alternate_version_of_the_EXE_will_be_run:_The_file___s__could_not_be_renamed_to___s_:__s
call fcn.00401014
add esp, 0x18
mov byte [ebp - 0x270], 0
mov dword [ebp - 0x164], 0
cmp dword [ebp - 0x164], 0
je 0x423a9f
xor eax, eax
je 0x423adf
mov ecx, dword [ebp + 0x2c]
push ecx
mov edx, dword [ebp + 0x28]
push edx
mov eax, dword [ebp + 0x24]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x164], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x274], eax
lea edx, [ebp - 0x270]
push edx
call fcn.00401389
add esp, 4
test eax, eax
jne 0x423bd7
mov byte [ebp - 0x410], 0
push 0x103
push 0
lea eax, [ebp - 0x40f]
push eax
call fcn.005b02a0
add esp, 0xc
lea ecx, [ebp - 0x160]
push ecx
lea edx, [ebp - 0x410]
push edx
call fcn.005b4720
add esp, 8
lea eax, [ebp - 0x410]
push eax
call fcn.00402338
add esp, 4
lea ecx, [ebp - 0x160]
push ecx
call fcn.00402608
add esp, 4
lea edx, [ebp - 0x270]
push edx
call fcn.00402608
add esp, 4
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x270]
push ecx
call fcn.00402293
add esp, 8
push 1
lea edx, [ebp - 0x160]
push edx
lea eax, [ebp - 0x270]
push eax
call fcn.00401375
add esp, 0xc
test eax, eax
jne 0x423bd7
push 0x2ee
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
lea ecx, [ebp - 0x160]
push ecx
lea edx, [ebp - 0x270]
push edx
call fcn.00401375
add esp, 0xc
test eax, eax
jne 0x423bd7
push 0x64c8b8
lea eax, [ebp - 0x160]
push eax
lea ecx, [ebp - 0x270]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.:8:CreateProcessExe___s_____s___encountered_a_problem:_The_file___s__could_not_be_reverse_renamed_back_to___s_:__s
call fcn.00401014
add esp, 0x18
mov ecx, dword [ebp - 0x274]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [ebp + 0x2c]
lea eax, [ebp - 0x284]
cmp edx, eax
jne 0x423c27
push 0x1a66
push 0x64c93c
push 0x64c948
mov ecx, dword [ebp - 0x280]
push ecx
call fcn.00401f5a
push 0x1a67
push 0x64c95c
push str.CreateProcessExe
mov edx, dword [ebp - 0x284]
push edx
call fcn.00401f5a
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0x54]
xor ecx, ebp
call fcn.005b0290
mov esp, ebp
pop ebp
ret