Function at 0x11128850
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1118b9f6
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 1
lea eax, [edi + 0xc]
push eax
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x220], edi
call fcn.110d25a0
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [edi + 0x28], esi
je 0x111288ab
mov ecx, dword [edi + 0x28]
mov edx, dword [ecx]
mov eax, dword [edx + 0x18]
call eax
lea ecx, [ebp - 0x228]
call fcn.110d2480
mov ebx, dword [sym.imp.KeRneL32.DLl_LoadLibraryA]
push 0x11195fc4
mov dword [ebp - 0x21c], esi
call ebx
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], esi
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x264], esi
mov dword [ebp - 0x260], esi
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], esi
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x250], esi
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], esi
mov byte [ebp - 4], 1
call dword [sym.imp.KeRneL32.DLl_GetCurrentProcess]
mov ecx, dword [ebp - 0x270]
push 0x111a55b0
push ecx
mov edi, eax
call dword [sym.imp.KeRneL32.DLl_GetProcAddress]
mov dword [ebp - 0x248], eax
cmp eax, esi
je 0x11128963
lea edx, [ebp - 0x21c]
push edx
push edi
call eax
jmp 0x1112896b
push 0x78
call dword [sym.imp.KeRneL32.DLl_SetLastError]
cmp dword [ebp - 0x21c], esi
je 0x11128a65
push 0x104
lea eax, [ebp - 0x217]
push eax
push esi
mov byte [ebp - 0x218], 0x22
call dword [sym.imp.KeRneL32.DLl_GetModuleFileNameA]
lea ecx, [ebp - 0x218]
push 0x5c
push ecx
call fcn.11081e00
add esp, 8
cmp eax, esi
je 0x11128abc
mov edx, dword [0x111b9d08]
mov dword [eax], edx
mov ecx, dword [0x111b9d0c]
mov dword [eax + 4], ecx
mov edx, dword [0x111b9d10]
mov dword [eax + 8], edx
mov ecx, dword [0x111b9d14]
mov dword [eax + 0xc], ecx
mov edx, dword [0x111b9d18]
mov dword [eax + 0x10], edx
mov ecx, dword [0x111b9d1c]
push 0x44
lea edx, [ebp - 0x2c4]
push esi
push edx
mov dword [eax + 0x14], ecx
call fcn.11162be0
add esp, 0xc
lea ecx, [ebp - 0x280]
push ecx
lea edx, [ebp - 0x2c4]
push edx
push esi
push esi
push 0x4000000
push esi
xor eax, eax
push esi
mov word [ebp - 0x294], ax
push esi
lea eax, [ebp - 0x218]
push eax
push esi
mov dword [ebp - 0x2c4], 0x44
mov dword [ebp - 0x298], 1
call dword [sym.imp.KeRneL32.DLl_CreateProcessA]
cmp eax, esi
je 0x11128abc
mov ecx, dword [ebp - 0x280]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KeRneL32.DLl_WaitForSingleObject]
mov edx, dword [ebp - 0x280]
mov edi, dword [sym.imp.KeRneL32.DLl_CloseHandle]
push edx
call edi
mov eax, dword [ebp - 0x27c]
push eax
call edi
jmp 0x11128abc
push 0x111b9c94
call ebx
mov edi, eax
cmp edi, esi
je 0x11128aa8
push 0x111b9cf4
push edi
call dword [sym.imp.KeRneL32.DLl_GetProcAddress]
push esi
push 0x111b9c44
push esi
call eax
test eax, eax
jne 0x11128a9f
call dword [sym.imp.KeRneL32.DLl_GetLastError]
push eax
push 0x111b9cbc
call fcn.11147060
add esp, 8
push edi
call dword [sym.imp.KeRneL32.DLl_FreeLibrary]
jmp 0x11128abc
call dword [sym.imp.KeRneL32.DLl_GetLastError]
push eax
push 0x111b9bb8
call fcn.11147060
add esp, 8
mov ecx, dword [ebp - 0x220]
mov edx, dword [ecx + 0x2c]
push edx
call dword [sym.imp.KeRneL32.DLl_SetEvent]
mov eax, dword [ebp - 0x270]
cmp eax, esi
je 0x11128add
push eax
call dword [sym.imp.KeRneL32.DLl_FreeLibrary]
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 0xffffffff
call fcn.110d2480
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret