Function at 0x4ce215
Capabilities:
Create process on windows

Disassembly:
push 0x35c
mov eax, 0x553016
call fcn.00513ea1
push 0x49
pop ecx
mov esi, str.xjtiDSG69CgdO5g0NNLT5aHY11JKXYzbVXfFlQw0o1WmCjlGK79PllZRnqqOkl0GLCHFEgZLFRNsV1Yw1NKwFlo2HtZEw69f1qGFAvfeUAvCaSNGU090V0ZTGpNJZUgpabu4jhSQH2zPcezaxsCWv6KSodG2ZYtesXZwX0WPAc13eaox1Oh3TaVWONOHxNfuwuQSlQbIGBinqV9rCTxrqAxYTsnjZ6XSZ4B1qZoSO954CEloOHwJA3mEwlpFVJWZ8MXXkk38Z7DC0oTPuUWWnEGRKqzMb2uw3l7N
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x138]
mov ebx, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
push 0x60
pop ecx
mov dword [ebp - 0x308], eax
xor eax, eax
movsb byte es:[edi], byte [esi]
mov esi, str.LK7yGKIzjxdQOxRAjjA78TnPWdz53gF07g5jy4FtmJZm3TlFyhA8GK0Avyt3vejr74NjqZ3BAr8iL7EGfF3q1RISoMYAcVliP60wayHg9dy0H71lK1zhkLmVyU89rty9iAAiwPz766cl5BBM7NuChEgoI4AZjqc3jIQAR5Jn8WersiCo62gcpoNFCP0W8j2G0ljHz3FSMBe4ZUhySUHwXBCgcgPwVkpI8oz4VeoS3A2Lk32HuF34hUoprt26N1IN4XuBbVZVrvBMmHPxGnf3Eng9MjRMGGKlJelWb9Z6h4EZMRsf3NqwHusYFoY8jBWX4A4RD3X80lS8opCNIX8gTZNcNdvY7nHvLru2YgilqYSBZDeJpHoglWuvJcZ4jqme7
mov dword [ebp - 0x314], eax
lea edi, [ebp - 0x2bc]
mov dword [ebp - 0x310], eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x30c], eax
movsw word es:[edi], word [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x304]
lea eax, [ebp - 0x138]
push eax
call fcn.004057d0
lea eax, [ebp - 0x304]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x314]
call fcn.00408170
push 0
push 1
lea ecx, [ebp - 0x304]
mov byte [ebp - 4], 0
call fcn.004096c0
lea eax, [ebp - 0x2bc]
push eax
lea ecx, [ebp - 0x304]
call fcn.004057d0
lea eax, [ebp - 0x304]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x314]
call fcn.00408170
xor edi, edi
lea ecx, [ebp - 0x304]
push edi
push 1
call fcn.004096c0
push 0x44
pop esi
push esi
lea eax, [ebp - 0x368]
push edi
push eax
call fcn.004f0ae0
push 0x10
lea eax, [ebp - 0x324]
mov dword [ebp - 0x368], esi
push edi
push eax
call fcn.004f0ae0
add esp, 0x18
xor edx, edx
xor eax, eax
mov dword [ebp - 0x2c4], edx
mov word [ebp - 0x2d4], ax
push 7
pop ecx
mov dword [ebp - 0x2c0], ecx
mov dword [ebp - 0x2d8], ecx
mov dword [ebp - 0x2dc], edx
mov word [ebp - 0x2ec], ax
mov edi, dword [ebp - 0x308]
or esi, 0xffffffff
mov byte [ebp - 4], 4
test edi, edi
je 0x4ce3d5
cmp word [edi], dx
jne 0x4ce351
mov eax, edx
jmp 0x4ce358
push edi
call fcn.00500d29
pop ecx
push eax
push edi
lea ecx, [ebp - 0x2ec]
call fcn.00402650
cmp dword [ebp - 0x2dc], 0
je 0x4ce3d3
mov edi, 0x5b5e14
push edi
call fcn.00500d29
pop ecx
push eax
push edi
lea ecx, [ebp - 0x2d4]
call fcn.00402650
xor eax, eax
cmp word [ebx], ax
je 0x4ce395
push ebx
call fcn.00500d29
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x2d4]
call fcn.00404240
mov edi, 0x5ca0f4
push edi
call fcn.00500d29
pop ecx
push eax
push edi
lea ecx, [ebp - 0x2d4]
call fcn.00404240
push esi
xor ebx, ebx
lea eax, [ebp - 0x2ec]
push ebx
push eax
lea ecx, [ebp - 0x2d4]
call fcn.00404370
jmp 0x4ce3f4
xor edx, edx
cmp word [ebx], dx
jne 0x4ce3de
mov eax, edx
jmp 0x4ce3e5
push ebx
call fcn.00500d29
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x2d4]
call fcn.00402650
xor ebx, ebx
cmp dword [ebp - 0x2c0], 8
lea ecx, [ebp - 0x324]
push ecx
lea ecx, [ebp - 0x368]
push ecx
push ebx
push ebx
lea eax, [ebp - 0x2d4]
cmovae eax, dword [ebp - 0x2d4]
xor edi, edi
push ebx
inc edi
push edi
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4ce42f
mov esi, ebx
jmp 0x4ce462
cmp byte [ebp + 0x10], 0
je 0x4ce44a
cmp dword [ebp + 0x14], 0
cmovg esi, dword [ebp + 0x14]
push esi
push dword [ebp - 0x324]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x324]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x320]
call esi
mov esi, edi
push ebx
push edi
lea ecx, [ebp - 0x2ec]
call fcn.00402590
push ebx
push edi
lea ecx, [ebp - 0x2d4]
call fcn.00402590
lea ecx, [ebp - 0x314]
call fcn.0047920e
mov eax, esi
call fcn.00513e4b
ret