Function at 0x423518
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
xor ebx, ebx
push edi
push 0x44
lea eax, [ebp - 0x80]
push ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call fcn.00408740
xor eax, eax
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x10], ebx
push dword [eax + 0x24]
push dword [eax + 0x14]
call fcn.00420820
mov edi, eax
cmp edi, ebx
jge 0x423588
mov eax, dword [esi + 8]
push dword [eax]
push 0x447cbc
jmp 0x423882
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x70]
mov eax, dword [eax]
push dword [eax + 0x18]
push dword [ebp - 0x1c]
call fcn.0043094a
mov edi, eax
cmp edi, ebx
jge 0x4235af
push 0x447c9a
jmp 0x4238d5
mov eax, dword [esi + 0xc]
dec eax
je 0x4235e2
dec eax
je 0x4235d7
sub eax, 3
je 0x4235cc
mov edi, 0x8000ffff
push 0x447c62
jmp 0x4238d5
mov eax, dword [esi + 8]
mov ebx, dword [eax + 0x90]
jmp 0x4235eb
mov eax, dword [esi + 8]
mov ebx, dword [eax + 0x8c]
jmp 0x4235eb
mov eax, dword [esi + 8]
mov ebx, dword [eax + 0x94]
test ebx, ebx
je 0x423669
cmp word [ebx], 0
je 0x423669
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp + 0xc]
call fcn.00413ff2
mov edi, eax
test edi, edi
jns 0x423614
push 0x447c40
jmp 0x4238d5
push dword [ebp - 0x14]
lea eax, [ebp - 8]
push dword [ebp - 4]
push 0x447c2e
push eax
call fcn.004300a2
mov edi, eax
add esp, 0x10
test edi, edi
js 0x423684
push 0
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
call fcn.004167be
mov edi, eax
test edi, edi
jns 0x423650
push 0x447c00
jmp 0x4238d5
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
push dword [ebp - 4]
push 0x447c2e
push eax
call fcn.004300a2
add esp, 0x10
jmp 0x42369e
push dword [ebp - 4]
mov ebx, 0x444f28
lea eax, [ebp - 8]
push ebx
push eax
call fcn.004300a2
mov edi, eax
add esp, 0xc
test edi, edi
jns 0x42368e
push 0x447bda
jmp 0x4238d5
push dword [ebp - 4]
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.004300a2
add esp, 0xc
mov edi, eax
test edi, edi
jns 0x4236ae
push 0x447baa
jmp 0x4238d5
mov eax, dword [esi + 0x10]
test eax, eax
je 0x423714
mov ecx, dword [esi + 8]
cmp dword [ecx + 0xa0], 1
jne 0x423714
push eax
push 0x402efc
push dword [ebp - 8]
mov ebx, 0x447b90
lea eax, [ebp - 8]
push ebx
push eax
call fcn.004300a2
mov edi, eax
add esp, 0x14
test edi, edi
jns 0x4236ec
push 0x447b46
jmp 0x4238d5
push dword [esi + 0x10]
lea eax, [ebp - 0xc]
push 0x402efc
push dword [ebp - 0xc]
push ebx
push eax
call fcn.004300a2
mov edi, eax
add esp, 0x14
test edi, edi
jns 0x423714
push 0x447af2
jmp 0x4238d5
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [esi + 0xc]
call fcn.0041bca0
push eax
mov eax, dword [esi + 8]
push dword [eax]
push dword [ebp + 0x10]
call fcn.0041bff4
push eax
push 0x2000012d
push 1
call fcn.0040c35a
mov eax, dword [esi + 8]
mov eax, dword [eax + 0xa0]
add esp, 0x1c
push 2
pop ebx
cmp eax, 1
jne 0x42377d
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.0042c1d2
mov edi, eax
test edi, edi
jns 0x423856
push dword [ebp - 4]
push 0x447ac2
jmp 0x423882
cmp eax, ebx
jne 0x4237ad
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.0042bca4
mov edi, eax
test edi, edi
jns 0x423856
push dword [ebp - 4]
push 0x447aa0
jmp 0x423882
lea eax, [ebp - 0x2c]
push eax
xor edi, edi
lea eax, [ebp - 0x80]
push eax
push edi
push edi
push 0x8000000
push edi
push edi
push edi
push dword [ebp - 8]
mov dword [ebp - 0x80], 0x44
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x423813
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x4237ec
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
js 0x4237f7
mov edi, 0x80004005
push edi
push 0x1f1
push 0x447676
call fcn.004315ca
push dword [ebp - 4]
push 0x447a7a
jmp 0x423882
xor edi, edi
push dword [ebp + 0x18]
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], 0x32
call dword [ebp + 0x14]
cmp eax, 1
je 0x423837
cmp eax, edi
jne 0x42388d
lea eax, [ebp - 0x10]
push eax
push 0x1f4
push dword [ebp - 0x2c]
call fcn.0042eaf8
mov edi, eax
cmp edi, 0x80070102
je 0x423811
test edi, edi
js 0x4238b1
mov edi, dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x10]
mov eax, dword [esi + 8]
call fcn.004230d2
mov edi, eax
test edi, edi
jns 0x4238bb
push edi
push 0x206
push 0x447676
call fcn.004315ca
push dword [ebp - 0x10]
push 0x447a5c
push edi
call fcn.004315b6
add esp, 0xc
jmp 0x4238ec
xor ecx, ecx
cmp eax, ebx
setne cl
lea edi, [ecx - 0x7ff8f9be]
push edi
push 0x1fb
push 0x447676
call fcn.004315ca
push 0x447a26
jmp 0x4238d5
push dword [ebp - 4]
push 0x4479f6
jmp 0x423882
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x4238df
push dword [esi + 8]
call fcn.00428268
mov edi, eax
test edi, edi
jns 0x4238ec
push 0x4479c0
push edi
call fcn.004315b6
pop ecx
pop ecx
jmp 0x4238ec
cmp eax, 1
jne 0x4238ec
push dword [esi + 8]
call fcn.00428352
xor ebx, ebx
cmp dword [ebp - 0x14], ebx
je 0x4238fb
push dword [ebp - 0x14]
call fcn.0042ecb2
cmp dword [ebp - 0x18], ebx
je 0x423908
push dword [ebp - 0x18]
call fcn.0042ecb2
cmp dword [ebp - 0x1c], ebx
je 0x423915
push dword [ebp - 0x1c]
call fcn.0042ecb2
cmp dword [ebp - 4], ebx
je 0x423922
push dword [ebp - 4]
call fcn.0042ecb2
cmp dword [ebp - 8], ebx
je 0x42392f
push dword [ebp - 8]
call fcn.0042ecb2
cmp dword [ebp - 0xc], ebx
je 0x42393c
push dword [ebp - 0xc]
call fcn.0042ecb2
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x28], ebx
je 0x42394f
push dword [ebp - 0x28]
call esi
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x2c], ebx
je 0x423959
push dword [ebp - 0x2c]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x18