Function at 0x439cb0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x5c
push ebx
xor eax, eax
push ebp
mov dword [esp + 0x10], eax
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x20], eax
mov ecx, 0x11
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], eax
mov eax, str.Ati2evxx.exe__CFPnP
mov dword [esp + 0x10], 0
mov dword [esp + 0x28], 0x44
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x439cf0
mov ebp, dword [esp + 0x70]
sub eax, edx
mov edi, eax
mov eax, dword [ebp + 4]
add edi, 0xa
xor esi, esi
test al, 0x10
je 0x439d21
movzx eax, byte [ebp + 0x11]
mov ecx, dword [ebp + 0x10]
and ecx, 0xff
mov esi, 0x10
add eax, ecx
jmp 0x439d3f
test al, 2
je 0x439d33
mov edx, dword [ebp + 0x10]
mov esi, 2
mov dword [esp + 0x10], edx
jmp 0x439d43
test al, 1
je 0x439d43
mov eax, dword [ebp + 0x10]
mov esi, 1
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x439d51
lea ecx, [eax + eax*2]
lea edi, [edi + ecx*4]
push edi
call fcn.0045e736
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x439d75
push str.CeateRestartProcess:_failed_to_create_memory_n
call fcn.0040aab0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret
mov ecx, edi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, str.Ati2evxx.exe__CFPnP
mov edx, ebx
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x439d92
mov eax, str.Ati2evxx.exe__CFPnP
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x439da4
sub eax, edx
push esi
add eax, ebx
push 0x483c44
push eax
call fcn.0045e6a9
mov eax, ebx
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x439dc3
mov ecx, dword [ebp + 0x10]
push ecx
sub eax, esi
add eax, ebx
push 0x483c44
push eax
call fcn.0045e6a9
mov eax, ebx
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x439de5
sub eax, edx
mov edi, eax
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x439e74
lea esi, [ebp + 0x18]
mov ebp, eax
lea ecx, [ecx]
xor ecx, ecx
mov ch, byte [esi + 4]
xor edx, edx
mov eax, edx
mov dword [esp + 0x14], edx
mov edx, dword [esi - 4]
and edx, 0xff
and eax, 0xff000000
mov cl, byte [esi]
shl ecx, 8
or ecx, edx
or ecx, eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x439e31
or ecx, 0x1000000
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 8]
and eax, 1
shl eax, 4
and edx, 0xf
or eax, edx
shl eax, 0x19
and ecx, 0xc1ffffff
or eax, ecx
push eax
push 0x483c44
add edi, ebx
push edi
call fcn.0045e6a9
mov eax, ebx
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x439e63
sub eax, edi
add esi, 0x18
dec ebp
mov edi, eax
jne 0x439e00
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x439ec9
push str.CreateRestartProcess:_create_restart_process_n
call fcn.0040aab0
mov edx, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push edx
call esi
mov eax, dword [esp + 0x18]
push eax
call esi
push ebx
call fcn.0045e020
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret
push str.CeateRestartProcess:_failed_to_create_process_n
call fcn.0040aab0
add esp, 4
push ebx
call fcn.0045e020
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret