Function at 0x2e017ec4
Capabilities:
Create process on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push edi
mov eax, ebx
call fcn.2e017bb2
mov ebp, eax
xor edi, edi
mov dword [esp + 0xc], ebp
cmp ebp, edi
jne 0x2e017ee7
xor eax, eax
jmp 0x2e018133
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 4]
push esi
mov esi, 0x2e02b96c
cmp eax, edi
je 0x2e017fa4
push str._blank
push eax
call fcn.2e014ad1
pop ecx
pop ecx
test eax, eax
jne 0x2e017fa4
push edi
push 8
push esi
call fcn.2e001175
push eax
push esi
push ebx
call fcn.2e014f3f
add esp, 0x18
test eax, eax
je 0x2e017fa4
cmp dword [esp + 0x20], edi
je 0x2e017f54
push ebx
call fcn.2e0179bc
pop ecx
test ax, ax
jne 0x2e017f54
push edi
push edi
push edi
push edi
push 1
push ebx
push edi
call fcn.2e00d34e
add esp, 0x1c
test ax, ax
je 0x2e0180b5
mov eax, dword [0x2e03cee8]
call dword [eax + 0xca4]
test ax, ax
je 0x2e017f8d
mov eax, dword [0x2e03cee8]
call dword [eax + 0xca8]
test eax, eax
je 0x2e017f8d
mov eax, dword [0x2e03cee8]
call dword [eax + 0xca8]
mov edx, dword [eax]
push 1
push ebp
mov ecx, eax
call dword [edx + 0xb8]
jmp 0x2e017f9e
push 1
push edi
push edi
push ebp
push 0x2e02b988
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebp
jmp 0x2e0180ac
mov ebx, dword [sym.imp.USER32.dll_FindWindowA]
push edi
mov ebp, 0x2e02b9e8
push ebp
call ebx
mov dword [esp + 0x14], eax
cmp eax, edi
jne 0x2e018012
push edi
push 8
push esi
call fcn.2e001175
push eax
push esi
push dword [esp + 0x38]
call fcn.2e014f3f
add esp, 0x18
test eax, eax
jne 0x2e018012
mov ecx, dword [esp + 0x24]
call fcn.2e017d1e
test ax, ax
jne 0x2e0180a8
call fcn.2e01790c
test ax, ax
je 0x2e018012
xor esi, esi
cmp esi, 0x28
jge 0x2e018012
push edi
push 0xfa
call dword [sym.imp.KERNEL32.dll_SleepEx]
push edi
push ebp
call ebx
inc esi
mov dword [esp + 0x14], eax
cmp eax, edi
je 0x2e017ff4
mov eax, dword [0x2e03cee8]
call dword [eax + 0xca4]
test ax, ax
je 0x2e01807f
mov eax, dword [0x2e03cee8]
call dword [eax + 0xca8]
test eax, eax
je 0x2e01807f
mov esi, dword [esp + 0x2c]
mov eax, dword [esi + 4]
cmp eax, edi
je 0x2e018063
push str._blank
push eax
call fcn.2e014ad1
pop ecx
pop ecx
test eax, eax
je 0x2e018060
push 0x2e02b7f0
push dword [esi + 4]
call fcn.2e014ad1
pop ecx
pop ecx
test eax, eax
jne 0x2e018063
xor edi, edi
inc edi
mov eax, dword [0x2e03cee8]
call dword [eax + 0xca8]
mov edx, dword [eax]
push edi
push dword [esp + 0x14]
mov ecx, eax
call dword [edx + 0xb8]
jmp 0x2e0180a8
cmp dword [esp + 0x14], edi
jne 0x2e0180ba
push dword [esp + 0x24]
call fcn.2e009bfd
pop ecx
test ax, ax
je 0x2e0180a8
push 1
push edi
push edi
push dword [esp + 0x1c]
push 0x2e02b988
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [esp + 0x10]
mov eax, dword [0x2e03eb8c]
call dword [eax + 0xc]
pop ecx
xor eax, eax
inc eax
jmp 0x2e018132
push 0x2e02b9dc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, edi
je 0x2e0180dd
push 0x2e02b9c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x2e0180dd
push 0xffffffffffffffff
call eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
push dword [esp + 0x10]
movzx esi, ax
mov eax, dword [0x2e03eb8c]
call dword [eax + 0xc]
pop ecx
cmp si, di
jne 0x2e018100
xor eax, eax
jmp 0x2e018132
mov eax, dword [esp + 0x2c]
mov eax, dword [eax + 4]
cmp eax, edi
je 0x2e018115
push eax
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
movzx edi, ax
movzx eax, di
push eax
movzx eax, si
push eax
push 0x4ca
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_PostMessageA]
neg eax
sbb eax, eax
neg eax
pop esi
pop edi
pop ebp
pop ebx
pop ecx
pop ecx
ret