Function at 0x4435e0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a8fab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x76c
push ebx
push ebp
push esi
lea eax, [esp + 0x178]
push edi
push eax
push 0x200
push 0
mov esi, ecx
push 0
push 0xff
push 0xf6
mov ecx, dword [esi + 0x1c]
push 0x51
push pe_nt_image_headers32
push ecx
call fcn.0048fc90
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x24
push 0x3e8
call ebp
lea edx, [esp + 0x17c]
mov eax, dword [esi + 0x1c]
push edx
push 0x200
push 0
push 0
push 0
push 0xf6
push 0x51
push pe_nt_image_headers32
push eax
call fcn.0048fc90
mov ebx, dword [esp + 0x7b4]
lea ecx, [esp + 0x1a0]
mov eax, dword [esi + 0x1c]
push ecx
mov edx, ebx
push 0x200
push 0
and edx, 0xff
push 0
push edx
push 0
push 0x80
push 0xfa
push eax
call fcn.0048fc90
add esp, 0x48
push 0x3e8
call ebp
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x37d]
mov byte [esp + 0x37c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x3e8
stosb byte es:[edi], al
call ebp
mov eax, dword [esi + 0x1c]
lea ecx, [esp + 0x30]
push 0
push ecx
lea edx, [esp + 0x384]
push 0x400
push edx
push 0
push 0
push 0x7400c
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebp, eax
test ebp, ebp
jne 0x443710
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x24]
push 0x4d8340
push ecx
mov dword [esp + 0x2c], 0x91f00
call sub.MSVCRT.dll__CxxThrowException
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x34]
xor edx, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], edx
mov ecx, 0x41
lea edi, [esp + 0x78]
mov dword [esp + 0x18], edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x1c], edx
push 0x4e5a9c
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0x44
mov dword [esp + 0x64], 1
mov word [esp + 0x68], ax
mov dword [esp + 0x24], edx
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esi + 8]
cmp bl, 0x20
mov dword [esp + 0x784], 0
jne 0x443778
mov ecx, dword [eax + 0x108]
jmp 0x44377e
mov ecx, dword [eax + 0x10c]
push ecx
lea edx, [esp + 0x14]
push str.__s_
push edx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov edi, 0x4e5a9c
mov eax, edx
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [edi]
jne 0x4437c0
test cl, cl
je 0x4437bc
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [edi + 1]
jne 0x4437c0
add eax, 2
add edi, 2
test cl, cl
jne 0x44379c
xor eax, eax
jmp 0x4437c5
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
test eax, eax
je 0x4437fe
push edx
push str._FS:NTFS__Q__V:
movsx edx, byte [esp + 0x794]
push edx
push str.Alcfmt
lea eax, [esp + 0x88]
push str._s__c:__s_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
jmp 0x443827
movsx ecx, byte [esp + 0x78c]
push str._FS:NTFS__Q
push ecx
push str.Alcfmt
lea edx, [esp + 0x84]
push str._s__c:__s
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
mov ecx, esi
call fcn.0041bf70
lea eax, [esp + 0x14]
lea ecx, [esp + 0x34]
push eax
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
lea edx, [esp + 0x94]
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x443865
call edi
xor ebp, ebp
mov eax, dword [esp + 0x14]
or ebx, 0xffffffff
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
jne 0x44387c
call edi
xor ebp, ebp
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x443894
call edi
xor ebp, ebp
mov eax, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call edi
mov ecx, esi
call fcn.004156e0
test ebp, ebp
jne 0x4438ca
lea edx, [esp + 0x28]
push 0x4d8340
push edx
mov dword [esp + 0x30], 0x91f00
call sub.MSVCRT.dll__CxxThrowException
cmp dword [0x4e0588], 4
jb 0x4438df
cmp dword [esi + 0x20], ebx
jne 0x4438df
mov ecx, esi
call fcn.0041be30
lea ecx, [esp + 0x10]
mov dword [esp + 0x784], ebx
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x77c]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x778
ret 8