Function at 0x84a9a8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x84a9b0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x84aecb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0xcc8], 0
je 0x84ae90
cmp dword [ebp - 8], 0
jl 0x84ae90
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x1058]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
cmp eax, dword [ebp - 8]
jl 0x84ae90
xor eax, eax
push ebp
push 0x84ae89
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.008538bc
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0084c514
mov eax, dword [0x8aa338]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 0x1e], ax
mov eax, dword [0x8aa338]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0046f580
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
call fcn.0082b45c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
add eax, 0x270
call fcn.00405268
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov byte [eax + 0x280], 0
lea eax, [ebp - 0x1c]
mov edx, 0x84aee0
call fcn.004052c8
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x7d0]
xor edx, edx
call fcn.004055f0
je 0x84aacc
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x7d0]
call fcn.00876648
test al, al
je 0x84aacc
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov edx, dword [eax + 0x7d0]
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
call fcn.00405544
jmp 0x84aae4
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov edx, dword [eax + 0x7cc]
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
call fcn.00405544
mov eax, dword [ebp - 0x10]
call fcn.00876648
test al, al
jne 0x84aaf8
mov eax, dword [ebp - 0x10]
call fcn.0047c144
mov eax, dword [ebp - 0x10]
call fcn.00876648
test al, al
jne 0x84ab0e
call fcn.004045a0
jmp 0x84ae90
mov byte [ebp - 0x25], 0
mov byte [ebp - 0x26], 0
mov eax, dword [0x8a9588]
mov eax, dword [eax]
cmp byte [eax + 0x151e], 0
je 0x84ab76
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x264]
xor edx, edx
call fcn.004055f0
je 0x84ab76
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x264]
call fcn.008765c8
test al, al
je 0x84ab76
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xcc8]
mov edx, dword [edx + 0x264]
call fcn.004052c8
mov byte [ebp - 0x25], 1
jmp 0x84acdd
xor eax, eax
push ebp
push 0x84acd3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x84acc2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x618368]
call fcn.0061886c
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
mov edx, dword [eax]
call dword [edx + 0xd0]
mov edx, eax
mov eax, dword [ebp - 0x24]
call fcn.00626480
mov eax, dword [0x8a9588]
mov eax, dword [eax]
cmp byte [eax + 0x151a], 0
je 0x84ac20
push dword [ebp - 0x10]
push 0x84aef8
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x234]
call fcn.0040b1b8
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
call fcn.0040544c
push dword [ebp - 0x2c]
push 0x84af1c
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004055a8
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
call fcn.0061d528
jmp 0x84ac7d
push dword [ebp - 0x10]
push 0x84aef8
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x234]
call fcn.0040b1b8
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
call fcn.0040544c
push dword [ebp - 0x34]
push 0x84af2c
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004055a8
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x124], 5
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
call fcn.00622428
mov byte [ebp - 0x25], 1
mov byte [ebp - 0x26], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x84acc9
lea eax, [ebp - 0x24]
call fcn.00411378
cmp byte [ebp - 0x25], 0
jne 0x84acc1
mov ax, word [0x84af38]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb9c]
mov edx, dword [eax + 0x7c]
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.00837bd8
ret
xor ebx, ebx
mov eax, dword [ebp - 0x18]
call fcn.008765c8
test al, al
je 0x84ad2e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
add eax, 0x270
mov edx, dword [ebp - 0x18]
call fcn.004052a4
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0xcc8]
mov al, byte [ebp - 0x26]
mov byte [esi + 0x280], al
mov eax, dword [esi + 0x270]
call fcn.00877988
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
fstp qword [eax + 0x278]
wait
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x270]
xor edx, edx
call fcn.004055f0
je 0x84ae2b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x270]
call fcn.008765c8
test al, al
je 0x84ae2b
cmp byte [ebp - 0x25], 0
je 0x84ae2b
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x1058]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
cmp eax, dword [ebp - 8]
jl 0x84ae2b
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x1058]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
test esi, esi
je 0x84ae2b
lea eax, [ebp - 0xc]
mov edx, dword [esi + 8]
call fcn.004052c8
push 0x84af40
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
push dword [eax + 0x270]
push 0x84af40
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004055a8
xor eax, eax
push ebp
push 0x84ae1f
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
mov eax, dword [ebp - 0x14]
call fcn.004054c8
push eax
mov eax, dword [ebp - 0xc]
call fcn.004054c8
push eax
push 0x84af44
mov eax, dword [0x8a9c8c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x84ae29
mov bl, 1
test bl, bl
je 0x84ae41
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
call fcn.0082b3d4
test al, al
je 0x84ae6b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
add eax, 0x270
call fcn.00405268
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
xor edx, edx
mov dword [eax + 0x278], edx
mov dword [eax + 0x27c], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x84ae90
mov eax, dword [0x8aa338]
mov eax, dword [eax]
mov dx, word [ebp - 0x1e]
call fcn.0046f580
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x84aed2
lea eax, [ebp - 0x38]
call fcn.00404b34
lea eax, [ebp - 0x34]
call fcn.00405268
lea eax, [ebp - 0x30]
call fcn.00404b34
lea eax, [ebp - 0x2c]
call fcn.00405268
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00405280
ret