Function at 0x646118db
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x646170a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor esi, esi
mov dword [ebp - 0x218], edx
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], ecx
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x270]
xor ebx, ebx
push 0x44
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea edi, [ebp - 0x228]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64611961
test byte [eax + 0x1c], 2
je 0x64611961
cmp byte [eax + 0x19], 5
jb 0x64611961
push dword [eax + 0x14]
mov edx, 0x64603008
push dword [eax + 0x10]
push 0x47
pop ecx
call fcn.64604453
push 0x20019
push 0
mov edx, 0x64602d78
mov ecx, 0x80000000
call fcn.6460f208
mov edi, eax
test edi, edi
jne 0x646119c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x64617004]
cmp ecx, 0x64617004
je 0x64611ba1
test byte [ecx + 0x1c], 2
je 0x64611ba1
cmp byte [ecx + 0x19], 2
jb 0x64611ba1
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x48
mov edx, 0x64603008
pop ecx
call fcn.64604471
jmp 0x64611ba1
push ecx
push 0
xor edx, edx
mov ecx, edi
push 0
inc edx
call fcn.6460f291
mov ebx, eax
test ebx, ebx
jne 0x64611a60
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64611a11
test byte [eax + 0x1c], 2
je 0x64611a11
cmp byte [eax + 0x19], 2
jb 0x64611a11
push esi
push dword [eax + 0x14]
mov edx, 0x64603008
push dword [eax + 0x10]
push 0x49
pop ecx
call fcn.64604471
push ecx
push 0
push 0
push 2
pop edx
mov ecx, edi
call fcn.6460f291
mov ebx, eax
test ebx, ebx
jne 0x64611a60
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64611ba1
test byte [eax + 0x1c], 2
je 0x64611ba1
cmp byte [eax + 0x19], 2
jb 0x64611ba1
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x4a
jmp 0x646119b4
push 0x64602dc8
push ebx
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x64611aa9
mov esi, 0x65b
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64611ba1
test byte [eax + 0x1c], 2
je 0x64611ba1
cmp byte [eax + 0x19], 2
jb 0x64611ba1
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x4b
jmp 0x646119b4
push dword [ebp - 0x214]
xor ecx, ecx
push dword [ebp - 0x218]
mov word [eax], cx
lea eax, [ebp - 0x210]
push ebx
push 0x64602dd4
push 0x104
push eax
call fcn.64604373
add esp, 0x18
test eax, eax
jns 0x64611b1f
mov ecx, eax
movzx esi, ax
and ecx, 0x1fff0000
cmp ecx, 0x70000
je 0x64611aed
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64611ba1
test byte [eax + 0x1c], 2
je 0x64611ba1
cmp byte [eax + 0x19], 2
jb 0x64611ba1
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x4c
jmp 0x646119b4
push 9
pop eax
mov word [ebp - 0x240], ax
xor ecx, ecx
lea eax, [ebp - 0x228]
mov dword [ebp - 0x270], 0x44
push eax
lea eax, [ebp - 0x270]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x210]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x64611b89
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64611ba1
test byte [eax + 0x1c], 2
je 0x64611ba1
cmp byte [eax + 0x19], 2
jb 0x64611ba1
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x4d
jmp 0x646119b4
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call fcn.6460cda9
test edi, edi
je 0x64611bb3
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.64615dc0
leave
ret