Function at 0x4243e8
Capabilities:
Create process on windows

Disassembly:
push 0xcdc
mov eax, 0x4529d1
call fcn.00444eac
mov esi, ecx
mov dword [ebp - 0xc94], esi
cmp dword [esi + 4], 0xffffffff
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xc90], eax
mov dword [ebp - 0xc8c], edi
je 0x424455
call fcn.00423d5f
test al, al
jne 0x424455
push 0x413ac8
push 0x43
lea ecx, [ebp - 0xc84]
call fcn.0042479b
mov esi, eax
mov ecx, 0xc2
lea edi, [ebp - 0x36c]
rep movsd dword es:[edi], dword [esi]
push 0x457f20
lea eax, [ebp - 0x36c]
push eax
call fcn.00444df7
and dword [ebp - 0x1c], 0
push 7
pop eax
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov word [ebp - 0x2c], cx
and dword [ebp - 4], ecx
cmp dword [ebx + 0x10], ecx
je 0x4244e3
cmp dword [edi + 0x10], ecx
je 0x4244f6
cmp dword [edi + 0x14], 8
jb 0x424480
mov ecx, dword [edi]
jmp 0x424482
mov ecx, edi
push 0x20
pop edx
cmp dx, word [ecx]
je 0x4244e3
and dword [ebp - 0x38], 0
mov dword [ebp - 0x34], eax
xor eax, eax
mov word [ebp - 0x48], ax
lea eax, [ebp - 0x48]
push eax
push ebx
mov byte [ebp - 4], 1
call fcn.00423437
push edi
lea eax, [ebp - 0x48]
push eax
push 0x413b60
lea eax, [ebp - 0x64]
push eax
call fcn.00424818
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.004206b8
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.004214d1
push 0
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0
call fcn.004214d1
jmp 0x4244f6
cmp dword [edi + 0x10], 0
je 0x4244f6
push 0xffffffffffffffff
push 0
push edi
lea ecx, [ebp - 0x2c]
call fcn.00420931
push 0x44
pop edi
push edi
lea eax, [ebp - 0xce8]
push 0
push eax
call fcn.004456bd
mov dword [ebp - 0xce8], edi
xor eax, eax
lea edi, [ebp - 0xca4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
cmp byte [ebp + 8], 0
stosd dword es:[edi], eax
je 0x4245ff
cmp dword [esi + 0x18], 0
jne 0x424531
xor eax, eax
jmp 0x42453c
lea eax, [esi + 8]
cmp dword [eax + 0x14], 8
jb 0x42453c
mov eax, dword [eax]
cmp dword [ebp - 0x1c], 0
jne 0x424546
xor edi, edi
jmp 0x424552
cmp dword [ebp - 0x18], 8
mov edi, dword [ebp - 0x2c]
jae 0x424552
lea edi, [ebp - 0x2c]
cmp dword [ebx + 0x14], 8
jb 0x424562
mov ecx, dword [ebx]
mov dword [ebp - 0xc88], ecx
jmp 0x424568
mov dword [ebp - 0xc88], ebx
mov esi, dword [ebp - 0xc90]
mov esi, dword [esi + 8]
lea ecx, [ebp - 0xca4]
push ecx
lea ecx, [ebp - 0xce8]
push ecx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
or eax, 0x8000000
push eax
xor eax, eax
push eax
push eax
push eax
push edi
push dword [ebp - 0xc88]
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x4246db
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0xc8c]
mov esi, eax
push ebx
push 0x413b70
push esi
push 0xf
lea ecx, [ebp - 0x36c]
call fcn.004248e1
cmp byte [ebp + 0x18], 0
je 0x4246cb
mov ecx, 0xc2
lea esi, [ebp - 0x36c]
lea edi, [ebp - 0x674]
rep movsd dword es:[edi], dword [esi]
push 0x457f20
lea eax, [ebp - 0x674]
jmp 0x42444f
cmp dword [esi + 0x18], 0
jne 0x424609
xor eax, eax
jmp 0x424614
lea eax, [esi + 8]
cmp dword [eax + 0x14], 8
jb 0x424614
mov eax, dword [eax]
cmp dword [ebp - 0x1c], 0
jne 0x42461e
xor edi, edi
jmp 0x42462a
cmp dword [ebp - 0x18], 8
mov edi, dword [ebp - 0x2c]
jae 0x42462a
lea edi, [ebp - 0x2c]
cmp dword [ebx + 0x14], 8
jb 0x42463a
mov ecx, dword [ebx]
mov dword [ebp - 0xc88], ecx
jmp 0x424640
mov dword [ebp - 0xc88], ebx
lea ecx, [ebp - 0xca4]
push ecx
lea ecx, [ebp - 0xce8]
push ecx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
or eax, 0x8000000
push eax
xor eax, eax
push eax
push eax
push eax
push edi
push dword [ebp - 0xc88]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4246e1
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push dword [ebp - 0xc8c]
mov edi, eax
push ebx
push 0x413bf0
call esi
push eax
push 0xf
lea ecx, [ebp - 0x674]
call fcn.00424980
cmp byte [ebp + 0x18], 0
je 0x4246c9
mov ecx, 0xc2
lea esi, [ebp - 0x674]
lea edi, [ebp - 0x97c]
rep movsd dword es:[edi], dword [esi]
push 0x457f20
lea eax, [ebp - 0x97c]
jmp 0x42444f
mov esi, edi
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004214d1
mov eax, esi
jmp 0x42470b
mov esi, dword [ebp - 0xc94]
mov eax, dword [ebp - 0xca4]
push dword [ebp - 0xca0]
mov dword [esi + 4], eax
mov dword [esi + 0x28], 0x103
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004214d1
xor eax, eax
call fcn.00444f2f
ret 0x14