Function at 0x424810
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447938
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x45a014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x1c]
mov ecx, esi
mov dword [ebp - 0xd0], edi
mov dword [ebp - 0xac], esi
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0x45aa70
call fcn.00406af0
test al, al
je 0x424e02
push 0
lea eax, [edi + 0x70]
push 0
mov dword [ebp - 0xb4], eax
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov edx, eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xb0], edx
mov ecx, dword [eax]
test ecx, ecx
je 0x4248b7
cmp ecx, 0xffffffff
je 0x4248b7
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xb4]
mov edx, dword [ebp - 0xb0]
mov dword [eax], edx
test edx, edx
je 0x424e6d
push 0x70
lea eax, [ebp - 0x8c]
push 0
push eax
call fcn.00428f40
add esp, 0xc
mov dword [ebp - 0x7c], 0x2000
lea eax, [ebp - 0x8c]
push 0x70
push eax
push 9
push dword [ebp - 0xb0]
call dword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
je 0x424ed4
lea eax, [ebp - 0xe8]
mov ecx, esi
push eax
call fcn.00425c80
push ecx
lea ecx, [ebp - 0xcc]
mov dword [ebp - 4], 7
push ecx
mov ecx, eax
call fcn.00408220
mov byte [ebp - 4], 8
lea eax, [ebp - 0x100]
cmp dword [ebp - 0xb8], 0x10
lea esi, [ebp - 0xcc]
push ecx
mov ecx, dword [ebp - 0xac]
cmovae esi, dword [ebp - 0xcc]
push eax
call fcn.00408220
cmp dword [ebp - 0xec], 0x10
lea eax, [edi + 0x1c]
push eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x100]
cmovae ecx, dword [ebp - 0x100]
lea eax, [edi + 0x2c]
push eax
push esi
push 0
push 4
push 1
push 0
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [ebp - 0xec]
mov esi, eax
cmp ecx, 0x10
jb 0x4249b8
mov edx, dword [ebp - 0x100]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4249ae
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x424f35
push ecx
push edx
call fcn.00427112
add esp, 8
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0xb8]
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0xf
mov byte [ebp - 0x100], 0
cmp ecx, 0x10
jb 0x424a11
mov edx, dword [ebp - 0xcc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x424a07
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x424f35
push ecx
push edx
call fcn.00427112
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xd4]
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], 0xf
mov byte [ebp - 0xcc], 0
cmp ecx, 8
jb 0x424a73
mov edx, dword [ebp - 0xe8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x424a69
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x424f35
push ecx
push edx
call fcn.00427112
add esp, 8
test esi, esi
je 0x424f3a
mov esi, dword [ebp - 0xac]
lea eax, [ebp - 0xe8]
push eax
mov ecx, esi
mov dword [ebp - 4], 0xb
call fcn.00408470
push ecx
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 0xc
push ecx
mov ecx, eax
call fcn.00408220
sub esp, 8
mov byte [ebp - 4], 0xd
mov eax, esp
lea ecx, [ebp - 0xcc]
mov dword [eax], str._created__SUSPENDED_
mov dword [eax + 4], 0x18
call fcn.004037b0
mov byte [ebp - 4], 0xc
add esp, 8
mov ecx, dword [ebp - 0xb8]
cmp ecx, 0x10
jb 0x424b0b
mov edx, dword [ebp - 0xcc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x424b01
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x424fa1
push ecx
push edx
call fcn.00427112
add esp, 8
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0xd4]
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], 0xf
mov byte [ebp - 0xcc], 0
cmp ecx, 8
jb 0x424b6a
mov edx, dword [ebp - 0xe8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x424b60
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x424fa1
push ecx
push edx
call fcn.00427112
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x424b92
mov eax, dword [edi + 0x20]
mov dword [ebp - 0xa8], eax
mov eax, dword [edi + 0x78]
test eax, eax
je 0x424bae
cmp eax, 0xffffffff
je 0x424bae
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xa8]
mov dword [edi + 0x78], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [edi + 0x74]
mov dword [ebp - 0xa8], ecx
test eax, eax
je 0x424bdb
cmp eax, 0xffffffff
je 0x424bdb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xb4]
push ecx
mov dword [edi + 0x74], ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x424fa6
cmp edi, esi
je 0x424c5e
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
jb 0x424c0a
mov esi, dword [esi]
mov dword [ebp - 0xac], esi
mov edx, dword [edi + 0x14]
mov ecx, edi
cmp eax, edx
ja 0x424c4a
mov dword [ebp - 0xb0], edi
cmp edx, 8
jb 0x424c26
mov ecx, dword [edi]
mov dword [ebp - 0xb0], ecx
lea esi, [eax + eax]
mov dword [edi + 0x10], eax
push esi
push dword [ebp - 0xac]
push ecx
call fcn.004289c0
mov eax, dword [ebp - 0xb0]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax], cx
jmp 0x424c5e
push esi
mov byte [ebp - 0xa8], 0
push dword [ebp - 0xa8]
push eax
call fcn.00406c30
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.NtQueryInformationProcess
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x425007
push 0
push 0x18
lea ecx, [ebp - 0xa4]
xorps xmm0, xmm0
push ecx
mov ecx, dword [ebp - 0x18]
push 0
movups xmmword [ebp - 0xa4], xmm0
push dword [ecx]
movq qword [ebp - 0x94], xmm0
call eax
mov ecx, eax
and ecx, 0xc0000000
cmp ecx, 0xc0000000
je 0x42506e
mov ecx, dword [ebp - 0xa0]
test ecx, ecx
je 0x4250b7
push 0
push 4
lea eax, [edi + 0x18]
push eax
lea eax, [ecx + 8]
push eax
push dword [edi + 0x74]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4250f4
cmp byte [ebp + 0xc], 0
je 0x424dde
push dword [edi + 0x78]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
je 0x42515b
lea eax, [ebp - 0x1a8]
mov dword [ebp - 4], 0x19
push eax
mov ecx, edi
call fcn.00408470
push ecx
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x1a
push ecx
mov ecx, eax
call fcn.00408220
sub esp, 8
mov byte [ebp - 4], 0x1b
mov eax, esp
lea ecx, [ebp - 0x118]
mov dword [eax], str._resumed
mov dword [eax + 4], 0xc
call fcn.004037b0
mov ecx, dword [ebp - 0x104]
add esp, 8
cmp ecx, 0x10
jb 0x424d83
mov edx, dword [ebp - 0x118]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x424d79
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4251bc
push ecx
push edx
call fcn.00427112
add esp, 8
mov ecx, dword [ebp - 0x194]
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 0xf
mov byte [ebp - 0x118], 0
cmp ecx, 8
jb 0x424dde
mov edx, dword [ebp - 0x1a8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x424dd4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4251bc
push ecx
push edx
call fcn.00427112
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004270e1
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0xe8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00411240
mov esi, eax
mov ecx, dword [ebp - 0xac]
lea eax, [ebp - 0xcc]
push eax
mov dword [ebp - 4], 0
call fcn.00408250
mov edx, eax
push esi
sub esp, 8
mov byte [ebp - 4], 1
mov ecx, esp
push ecx
call fcn.00424760
lea ecx, [ebp - 0x100]
call fcn.004246d0
add esp, 0xc
push eax
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 2
call fcn.004238a0
push 0x458504
lea eax, [ebp - 0x124]
push eax
call fcn.00428947
call fcn.00407fd0
mov edi, eax
mov ecx, dword [edi]
mov esi, dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xe8]
mov ecx, edi
push eax
call esi
mov esi, eax
sub esp, 8
mov dword [ebp - 4], 3
mov ecx, esp
push str.CreateJobObject:_
call fcn.00402fe0
mov edx, esi
lea ecx, [ebp - 0xcc]
call fcn.00424780
add esp, 8
push eax
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 4
call fcn.004238a0
push 0x458504
lea eax, [ebp - 0x130]
push eax
call fcn.00428947
call fcn.00407fd0
mov edi, eax
mov ecx, dword [edi]
mov esi, dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xe8]
mov ecx, edi
push eax
call esi
mov edx, eax
sub esp, 8
mov dword [ebp - 4], 5
mov ecx, esp
push ecx
call fcn.00425b40
lea ecx, [ebp - 0xcc]
call fcn.00424780
add esp, 8
push eax
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 6
call fcn.004238a0
push 0x458504
lea eax, [ebp - 0x13c]
push eax
call fcn.00428947
call fcn.0042c03f
call fcn.00407fd0
mov edi, eax
mov ecx, dword [edi]
mov esi, dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xe8]
mov ecx, edi
push eax
call esi
mov esi, eax
sub esp, 8
mov dword [ebp - 4], 9
mov ecx, esp
push str.CreateProcessA:_
call fcn.00402fe0
mov edx, esi
lea ecx, [ebp - 0xcc]
call fcn.00424780
add esp, 8
push eax
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 0xa
call fcn.004238a0
push 0x458504
lea eax, [ebp - 0x148]
push eax
call fcn.00428947
call fcn.0042c03f
call fcn.00407fd0
mov edi, eax
mov ecx, dword [edi]
mov esi, dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xe8]
mov ecx, edi
push eax
call esi
mov edx, eax
sub esp, 8
mov dword [ebp - 4], 0xf
mov ecx, esp
push ecx
call fcn.00425b60
lea ecx, [ebp - 0xcc]
call fcn.00424780
add esp, 8
push eax
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 0x10
call fcn.004238a0
push 0x458504
lea eax, [ebp - 0x154]
push eax
call fcn.00428947
call fcn.00407fd0
mov edi, eax
mov ecx, dword [edi]
mov esi, dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xe8]
mov ecx, edi
push eax
call esi
mov esi, eax
sub esp, 8
mov dword [ebp - 4], 0x11
mov ecx, esp
push str.NtQueryInformationProcess:_
call fcn.00402fe0
mov edx, esi
lea ecx, [ebp - 0xcc]
call fcn.00424780
add esp, 8
push eax
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x12
call fcn.004238a0
push 0x458504
lea eax, [ebp - 0x160]
push eax
call fcn.00428947
sub esp, 8
mov dword [ebp - 0xa8], eax
mov ecx, esp
push ecx
call fcn.004247f0
lea edx, [ebp - 0xa8]
lea ecx, [ebp - 0xe8]
call fcn.00403030
add esp, 8
push eax
lea ecx, [ebp - 0x16c]
mov dword [ebp - 4], 0x13
call fcn.004238a0
push 0x458504
lea eax, [ebp - 0x16c]
push eax
call fcn.00428947
sub esp, 8
mov ecx, esp
push ecx
call fcn.00425b80
lea ecx, [ebp - 0xe8]
call fcn.00402f70
add esp, 8
push eax
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], 0x14
call fcn.004238a0
push 0x458504
lea eax, [ebp - 0x178]
push eax
call fcn.00428947
call fcn.00407fd0
mov edi, eax
mov ecx, dword [edi]
mov esi, dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xe8]
mov ecx, edi
push eax
call esi
mov esi, eax
sub esp, 8
mov dword [ebp - 4], 0x15
mov ecx, esp
push str.ReadProcessMemory:_
call fcn.00402fe0
mov edx, esi
lea ecx, [ebp - 0xcc]
call fcn.00424780
add esp, 8
push eax
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 0x16
call fcn.004238a0
push 0x458504
lea eax, [ebp - 0x184]
push eax
call fcn.00428947
call fcn.00407fd0
mov edi, eax
mov ecx, dword [edi]
mov esi, dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xe8]
mov ecx, edi
push eax
call esi
mov edx, eax
sub esp, 8
mov dword [ebp - 4], 0x17
mov ecx, esp
push ecx
call fcn.00425ba0
lea ecx, [ebp - 0xcc]
call fcn.00424780
add esp, 8
push eax
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x18
call fcn.004238a0
push 0x458504
lea eax, [ebp - 0x190]
push eax
call fcn.00428947
call fcn.0042c03f
int3