Function at 0x834d20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x834d29
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov ebx, eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x1c]
xor eax, eax
push ebp
push 0x8351cd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
mov edx, dword [0x87ef54]
call fcn.00442958
lea edx, [ebp - 0x24]
mov eax, esi
call fcn.00445848
je 0x834d9e
mov eax, 0x87ef58
mov edx, dword [0x87ef54]
call fcn.0040a948
mov eax, 0x87ef54
mov edx, esi
call fcn.00441fcc
lea edx, [ebp - 0x28]
mov eax, dword [ebx + 0x3f8]
call fcn.00552d94
mov edx, dword [ebp - 0x28]
mov eax, dword [ebx + 0x400]
call fcn.00552de8
lea eax, [ebp - 8]
mov edx, esi
call fcn.00441fcc
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, 0x8351ec
call fcn.00435f78
test al, al
je 0x83500c
mov esi, dword [ebp - 8]
test esi, esi
je 0x834dcb
sub esi, 4
mov esi, dword [esi]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
mov edx, 0x11
mov eax, dword [ebp - 8]
call fcn.0040b4f8
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.0040a990
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, 0x83521c
call fcn.00435f78
test al, al
je 0x834ee0
lea eax, [ebp - 0xc]
push eax
mov edx, 0x835224
lea eax, [ebp - 8]
xor ecx, ecx
call fcn.00435818
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x834e1f
sub eax, 4
mov eax, dword [eax]
cmp eax, 4
jne 0x834ee0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 0x2c]
mov edx, 0x835234
call fcn.0040b328
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebx + 0x3f8]
call fcn.00552de8
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [0x87ef50]
call fcn.00552de8
call fcn.00834608
test al, al
je 0x834e9c
mov eax, dword [ebp - 0xc]
push dword [eax + 0xc]
push 0x835248
mov eax, dword [ebp - 0xc]
push dword [eax + 4]
push 0x835248
mov eax, dword [ebp - 0xc]
push dword [eax + 8]
lea eax, [ebp - 0x30]
mov edx, 5
call fcn.0040b3b0
mov eax, dword [ebp - 0x30]
push eax
call fcn.0057ad68
pop edx
call fcn.0057a81c
jmp 0x834ee0
push 0
push 0
push 0x835258
mov eax, dword [ebp - 0xc]
push dword [eax + 4]
push 0x83526c
mov eax, dword [ebp - 0xc]
push dword [eax + 8]
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.0040b3b0
mov eax, dword [ebp - 0x34]
call fcn.0040b0c4
push eax
mov eax, dword [0x87ef5c]
call fcn.0040b0c4
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, 0x835284
call fcn.00435f78
test al, al
je 0x835007
lea eax, [ebp - 0xc]
push eax
mov edx, 0x835224
lea eax, [ebp - 8]
xor ecx, ecx
call fcn.00435818
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x834f16
sub eax, 4
mov eax, dword [eax]
cmp eax, 4
jne 0x835007
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 0x38]
mov edx, 0x835298
call fcn.0040b328
mov edx, dword [ebp - 0x38]
mov eax, dword [ebx + 0x3f8]
call fcn.00552de8
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [0x87ef50]
call fcn.00552de8
call fcn.00834608
test al, al
je 0x834f93
mov eax, dword [ebp - 0xc]
push dword [eax + 0xc]
push 0x835248
mov eax, dword [ebp - 0xc]
push dword [eax + 4]
push 0x835248
mov eax, dword [ebp - 0xc]
push dword [eax + 8]
lea eax, [ebp - 0x3c]
mov edx, 5
call fcn.0040b3b0
mov eax, dword [ebp - 0x3c]
push eax
call fcn.0057ad68
pop edx
call fcn.0057a81c
jmp 0x835007
mov al, 0x12
call fcn.00834624
test al, al
je 0x834fb9
push 1
lea edx, [ebp - 0x40]
mov eax, dword [0x87ef60]
call fcn.0042888c
mov eax, dword [ebp - 0x40]
xor ecx, ecx
xor edx, edx
call fcn.0076a608
push 0
push 0
push 0x8352ac
mov eax, dword [ebp - 0xc]
push dword [eax + 8]
push 0x8352cc
push dword [0x87ef60]
push 0x8352e0
mov eax, dword [ebp - 0xc]
push dword [eax + 4]
push 0x8352f4
lea eax, [ebp - 0x44]
mov edx, 7
call fcn.0040b3b0
mov eax, dword [ebp - 0x44]
call fcn.0040b0c4
push eax
push 0x835318
push 0
push 0
call sub.shell32.dll_ShellExecuteW
mov word [edi], 0xffff
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, 0x83532c
call fcn.00435f78
test al, al
je 0x835058
mov eax, dword [ebx + 0x3f8]
mov edx, 0x835348
call fcn.00552de8
push 1
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040b0c4
push eax
push 0x835350
mov eax, dword [0x87ef50]
call fcn.0055ca2c
push eax
call sub.shell32.dll_ShellExecuteW
mov word [edi], 0xffff
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, 0x835368
call fcn.00435f78
test al, al
je 0x835178
mov eax, dword [ebx + 0x3f8]
mov edx, 0x8353a4
call fcn.00552de8
lea edx, [ebp - 0x48]
mov eax, 0x8353b8
call fcn.0076e478
mov eax, dword [ebp - 0x48]
mov edx, 0x8353d8
call fcn.0040b4c0
jne 0x8350c4
push 1
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040b0c4
push eax
push 0x835350
mov eax, dword [0x87ef50]
call fcn.0055ca2c
push eax
call sub.shell32.dll_ShellExecuteW
jmp 0x835173
mov esi, dword [ebp - 8]
test esi, esi
je 0x8350d0
sub esi, 4
mov esi, dword [esi]
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
mov edx, 0x18
mov eax, dword [ebp - 8]
call fcn.0040b4f8
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.0040a990
lea eax, [ebp - 0x4c]
mov ecx, dword [ebp - 8]
mov edx, 0x8353e8
call fcn.0040b328
mov edx, dword [ebp - 0x4c]
lea ecx, [ebp - 4]
mov eax, dword [ebx + 0x3ec]
call fcn.006fcc2c
mov dl, 1
mov eax, dword [0x7f1bd0]
call fcn.007fbe78
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.007fa7c8
lea ecx, [ebp - 0x50]
mov edx, 0x835444
call fcn.00833d38
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 4]
call fcn.0040a990
push 1
push 0
push 0
lea eax, [ebp - 0x54]
mov ecx, dword [ebp - 4]
mov edx, 0x835464
call fcn.0040b328
mov eax, dword [ebp - 0x54]
call fcn.0040b0c4
push eax
push 0x835350
mov eax, dword [0x87ef50]
call fcn.0055ca2c
push eax
call sub.shell32.dll_ShellExecuteW
mov word [edi], 0xffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8351d4
lea eax, [ebp - 0x54]
mov edx, 0xb
call fcn.0040a5b8
lea eax, [ebp - 0x28]
call fcn.0040a558
lea eax, [ebp - 0x24]
call fcn.0043c0e4
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040a5b8
lea eax, [ebp - 0xc]
mov edx, dword [0x412740]
call fcn.0040da34
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a5b8
pop eax
jmp eax