Function at 0x4305d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c51bc
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x624500]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0
call fcn.00405c3d
mov ecx, eax
test ecx, ecx
je case.0x4307ba.1
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
test edi, edi
je 0x4306e9
test edi, 0xffff0000
jne 0x4306de
movzx edi, di
mov ecx, edi
call fcn.004098b0
mov ebx, eax
test ebx, ebx
je 0x4306f5
mov ecx, edi
shr ecx, 4
push 6
inc ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4306f5
push edi
push eax
push ebx
call fcn.00409910
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4306f5
movzx edx, word [ebx]
mov ecx, 1
mov eax, dword [esi - 8]
mov edi, edx
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x4306a1
push edi
lea ecx, [ebp - 0x14]
call fcn.0040595f
movzx edx, word [ebx]
mov esi, dword [ebp - 0x14]
movzx ecx, dx
lea eax, [ebx + 2]
push ecx
push eax
push edi
push esi
call fcn.00594fab
add esp, 0x10
cmp eax, 0x50
ja case.0x4307ba.1
movzx eax, byte [eax + 0x430e48]
jmp dword [eax*4 + 0x430e38]
cmp edi, dword [esi - 8]
jg case.0x4307ba.20
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
jmp 0x4306f5
push edi
call fcn.00594f90
add esp, 4
jmp 0x4306eb
xor eax, eax
push eax
push edi
lea ecx, [ebp - 0x14]
call fcn.00409b39
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], 0
call fcn.00405c3d
mov ecx, eax
test ecx, ecx
je 0x430db5
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x2c], esi
mov ebx, str.explorer.exe__
mov byte [ebp - 4], 2
test ebx, 0xffff0000
jne 0x4307cf
movzx edi, bx
mov ecx, edi
call fcn.004098b0
mov ebx, eax
test ebx, ebx
je 0x4308ee
mov ecx, edi
shr ecx, 4
push 6
inc ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4308ee
push edi
push eax
push ebx
call fcn.00409910
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4308ee
movzx edx, word [ebx]
mov ecx, 1
mov eax, dword [esi - 8]
mov edi, edx
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x430798
push edi
lea ecx, [ebp - 0x2c]
call fcn.0040595f
movzx edx, word [ebx]
mov esi, dword [ebp - 0x2c]
movzx ecx, dx
lea eax, [ebx + 2]
push ecx
push eax
push edi
push esi
call fcn.00594fab
add esp, 0x10
cmp eax, 0x50
ja case.0x4307ba.1
movzx eax, byte [eax + 0x430eac]
jmp dword [eax*4 + 0x430e9c]
cmp edi, dword [esi - 8]
jg 0x430dc9
jmp 0x4308e5
push str.explorer.exe__
call fcn.00594f90
mov edi, eax
add esp, 4
test edi, edi
jne 0x43084a
lea edx, [esi - 0x10]
mov byte [ebp - 4], 3
mov edi, dword [edx]
cmp dword [edx + 4], eax
je 0x4308ee
mov eax, dword [edx + 0xc]
lea ecx, [edx + 0xc]
shr eax, 0x1f
test al, al
je 0x43081c
cmp dword [edx + 8], 0
jl 0x430dd3
xor eax, eax
mov dword [edx + 4], 0
mov word [esi], ax
jmp 0x4308ee
mov byte [ebp - 4], 4
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x430834
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x2c], esi
jmp 0x4308ee
mov eax, dword [esi - 0xc]
sub ebx, esi
sar ebx, 1
mov dword [ebp - 0x20], eax
test edi, edi
js 0x430ddd
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x430879
push edi
lea ecx, [ebp - 0x2c]
call fcn.0040595f
mov esi, dword [ebp - 0x2c]
cmp ebx, dword [ebp - 0x20]
ja 0x4308ca
mov eax, dword [esi - 8]
lea ecx, [edi + edi]
lea edx, [esi + ebx*2]
test ecx, ecx
je 0x4308dc
test esi, esi
jne 0x4308a1
call fcn.00591718
mov dword [eax], 0x16
call fcn.0059163f
jmp 0x4308dc
test edx, edx
je 0x43088f
add eax, eax
cmp eax, ecx
jae 0x4308bd
call fcn.00591718
mov dword [eax], 0x22
call fcn.0059163f
jmp 0x4308dc
push ecx
push edx
push esi
call fcn.0058d520
add esp, 0xc
jmp 0x4308dc
push edi
push str.explorer.exe__
push dword [esi - 8]
push esi
call fcn.00405d4d
add esp, 0x10
cmp edi, dword [esi - 8]
jg case.0x4307ba.20
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 8
mov ecx, dword [eax]
mov dword [ebp - 0x48], eax
test ecx, ecx
je 0x430907
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
jmp 0x430909
xor ecx, ecx
mov byte [ebp - 4], 7
test ecx, ecx
jne 0x43091f
call fcn.00405c3d
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
mov byte [ebp - 4], 9
test ecx, ecx
je 0x430de7
mov eax, dword [ecx]
call dword [eax + 0xc]
mov byte [ebp - 4], 6
mov dword [ebp - 0x24], 1
lea edi, [eax + 0x10]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], edi
test eax, eax
je 0x430951
push eax
call fcn.00594f90
add esp, 4
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], edx
lea ebx, [eax + edx]
test ebx, ebx
js 0x430df1
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, ebx
or eax, ecx
jge 0x430985
push ebx
lea ecx, [ebp - 0x34]
call fcn.0040595f
mov edi, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
push edx
push esi
push edx
push edi
call fcn.00405d4d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
push eax
push ecx
push eax
mov eax, dword [ebp - 0x30]
lea eax, [edi + eax*2]
push eax
call fcn.00405d4d
lea eax, [edi - 0x10]
add esp, 0x20
mov dword [ebp - 0x44], eax
cmp ebx, dword [eax + 8]
jg case.0x4307ba.20
xor ecx, ecx
mov dword [eax + 4], ebx
mov word [edi + ebx*2], cx
mov byte [ebp - 4], 0xc
mov ecx, dword [eax]
test ecx, ecx
je 0x4309d1
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
jmp 0x4309d3
xor ecx, ecx
mov byte [ebp - 4], 0xb
test ecx, ecx
jne 0x4309e9
call fcn.00405c3d
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
mov byte [ebp - 4], 0xd
test ecx, ecx
je 0x430dfb
mov eax, dword [ecx]
call dword [eax + 0xc]
mov byte [ebp - 4], 0xa
push 0x603874
mov dword [ebp - 0x24], 3
lea esi, [eax + 0x10]
mov dword [ebp - 0x30], esi
call fcn.00594f90
mov edx, dword [edi - 0xc]
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
lea ebx, [eax + edx]
test ebx, ebx
js 0x430e05
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, ebx
or eax, ecx
jge 0x430a4c
push ebx
lea ecx, [ebp - 0x30]
call fcn.0040595f
mov esi, dword [ebp - 0x30]
mov edx, dword [ebp - 0x1c]
push edx
push edi
push edx
push esi
call fcn.00405d4d
mov eax, dword [ebp - 0x1c]
add esp, 0x10
mov ecx, dword [ebp - 0x20]
lea eax, [esi + eax*2]
add ecx, ecx
je 0x430a8a
test eax, eax
jne 0x430a7b
call fcn.00591718
mov dword [eax], 0x16
call fcn.0059163f
jmp 0x430a8a
push ecx
push 0x603874
push eax
call fcn.0058cfa0
add esp, 0xc
lea eax, [esi - 0x10]
mov dword [ebp - 0x40], eax
cmp ebx, dword [eax + 8]
jg case.0x4307ba.20
xor ecx, ecx
mov dword [eax + 4], ebx
mov word [esi + ebx*2], cx
mov byte [ebp - 4], 0x10
mov ecx, dword [eax]
test ecx, ecx
je 0x430ab5
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
jmp 0x430ab7
xor ecx, ecx
mov byte [ebp - 4], 0xf
test ecx, ecx
jne 0x430acd
call fcn.00405c3d
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
mov byte [ebp - 4], 0x11
test ecx, ecx
je 0x430e0f
mov eax, dword [ecx]
call dword [eax + 0xc]
mov byte [ebp - 4], 0xe
push 0x602d08
mov dword [ebp - 0x24], 7
lea edi, [eax + 0x10]
mov dword [ebp - 0x38], edi
call fcn.00594f90
mov ebx, dword [esi - 0xc]
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ebx
lea edx, [eax + ebx]
test edx, edx
js 0x430e19
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, edx
or eax, ecx
jge 0x430b2d
push edx
lea ecx, [ebp - 0x38]
call fcn.0040595f
mov edi, dword [ebp - 0x38]
push ebx
push esi
push ebx
push edi
call fcn.00405d4d
mov esi, dword [ebp - 0x20]
lea eax, [edi + ebx*2]
add esp, 0x10
lea ecx, [esi + esi]
test ecx, ecx
je 0x430b6b
test eax, eax
jne 0x430b5c
call fcn.00591718
mov dword [eax], 0x16
call fcn.0059163f
jmp 0x430b6b
push ecx
push 0x602d08
push eax
call fcn.0058cfa0
add esp, 0xc
mov eax, dword [ebp - 0x1c]
lea ebx, [edi - 0x10]
add eax, esi
cmp eax, dword [ebx + 8]
jg case.0x4307ba.20
xor ecx, ecx
mov dword [ebx + 4], eax
mov word [edi + eax*2], cx
mov dword [ebp - 0x28], ecx
mov byte [ebp - 4], 0x14
mov ecx, dword [ebx]
test ecx, ecx
je 0x430b9b
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
jmp 0x430b9d
xor ecx, ecx
mov byte [ebp - 4], 0x13
test ecx, ecx
jne 0x430bb3
call fcn.00405c3d
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
mov byte [ebp - 4], 0x15
test ecx, ecx
je 0x430e23
mov eax, dword [ecx]
call dword [eax + 0xc]
mov byte [ebp - 4], 0x12
mov edx, dword [edi - 0xc]
mov dword [ebp - 0x24], 0xf
lea esi, [eax + 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x4c], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
lea ecx, [eax + edx]
test ecx, ecx
js 0x430e2d
mov eax, 1
sub eax, dword [esi - 4]
mov dword [ebp - 0x3c], eax
mov eax, dword [esi - 8]
sub eax, ecx
or eax, dword [ebp - 0x3c]
jge 0x430c19
push ecx
lea ecx, [ebp - 0x28]
call fcn.0040595f
mov esi, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
push edx
push edi
push edx
push esi
call fcn.00405d4d
mov eax, dword [ebp - 0x20]
push eax
push dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
lea eax, [esi + eax*2]
push eax
call fcn.00405d4d
mov eax, dword [ebp - 0x20]
lea edi, [esi - 0x10]
add eax, dword [ebp - 0x1c]
add esp, 0x20
cmp eax, dword [edi + 8]
jg case.0x4307ba.20
xor ecx, ecx
mov dword [edi + 4], eax
mov word [esi + eax*2], cx
lea edx, [ebp - 0x28]
push 0x602d08
lea ecx, [ebp - 0x18]
call fcn.00408b05
add esp, 4
mov dword [ebp - 0x24], 7
or esi, 0xffffffff
mov byte [ebp - 4], 0x18
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x430c89
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x24], 3
mov byte [ebp - 4], 0x1a
mov eax, esi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x430ca8
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x24], 1
mov edx, dword [ebp - 0x40]
mov eax, esi
mov byte [ebp - 4], 0x1c
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430cca
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x44]
mov eax, esi
mov byte [ebp - 4], 0x1e
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430ce5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x48]
mov eax, esi
mov byte [ebp - 4], 0x20
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430d00
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x1f
lea eax, [ebp - 0xcc]
push 3
push dword [ebp - 0x18]
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xd0], eax
call fcn.00408cbb
push 1
push dword [ebp - 0xd0]
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [ebp - 0xd0]
mov edi, eax
lea eax, [ebp - 0xcc]
cmp ecx, eax
je 0x430d49
push ecx
call fcn.005950fb
add esp, 4
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x21
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430d67
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 4], 0x22
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x430d83
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053a175
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00405d25
push 0x8007000e
call fcn.00405d25
push 0x80004005
call fcn.00405d25
push 0x80070057
call fcn.00405d25
push 0x80070057
call fcn.00405d25
push 0x80070057
call fcn.00405d25
push 0x80070057
call fcn.00405d25
push 0x80004005
call fcn.00405d25
push 0x80070057
call fcn.00405d25
push 0x80004005
call fcn.00405d25
push 0x80070057
call fcn.00405d25
push 0x80004005
call fcn.00405d25
push 0x80070057
call fcn.00405d25
push 0x80004005
call fcn.00405d25
push 0x80070057
call fcn.00405d25
nop
retf 0x4306