Function at 0x687b14
Capabilities:
Create process on windows
Create process suspended
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x17
push 0
push 0
dec ecx
jne 0x687b1c
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x688294
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.006872c0
mov edx, 0x1dd
mov eax, dword [0x73fc28]
call fcn.004af53c
test byte [esi + 0x3fc], 4
je 0x687db0
mov edx, dword [esi + 0x3d8]
mov eax, esi
call fcn.00687044
mov dl, 1
mov eax, dword [esi + 0x3ac]
call fcn.0048abd8
lea eax, [ebp - 0x64]
push eax
mov eax, dword [esi + 0x3e0]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0x11
lea edx, [ebp - 0x6c]
xor ecx, ecx
mov eax, 0x6882b0
call fcn.00415cb4
mov edx, dword [ebp - 0x64]
mov eax, dword [esi + 0x3a8]
call fcn.004aff00
push 0x6882f0
push dword [esi + 0x3f4]
push 0x68830c
lea eax, [ebp - 0x70]
mov edx, 3
call fcn.004078b0
mov eax, dword [ebp - 0x70]
push eax
push 2
mov ecx, 0x68831c
mov edx, dword [esi + 0x3d8]
mov eax, esi
call fcn.00685abc
mov cl, 1
mov dl, 1
mov eax, dword [0x684bbc]
call fcn.004425f0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0x40
lea edx, [esi + 0x3d8]
mov ecx, dword [0x6847c0]
call fcn.004082f0
mov eax, dword [ebp - 8]
mov byte [eax + 0xf], 0
mov eax, dword [ebp - 8]
call fcn.00443228
mov eax, dword [ebp - 8]
call fcn.00443274
lea eax, [esi + 0x3d8]
mov edx, dword [ebp - 8]
add edx, 0x40
mov ecx, dword [0x6847c0]
call fcn.004082f0
mov eax, dword [ebp - 8]
call fcn.004050dc
push 0x6882f0
push dword [esi + 0x3f4]
push 0x68830c
lea eax, [ebp - 0x74]
mov edx, 3
call fcn.004078b0
mov eax, dword [ebp - 0x74]
push eax
push 2
mov ecx, 0x688344
mov edx, dword [esi + 0x3d8]
mov eax, esi
call fcn.00685abc
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00404a3c
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x24], 0x40
mov word [ebp - 0x20], 0
push 0
push 2
mov ecx, 0x688368
mov edx, dword [esi + 0x3d8]
mov eax, esi
call fcn.00685abc
mov dl, 1
mov eax, dword [esi + 0x3ac]
call fcn.0048abd8
mov edx, 0x688390
mov eax, dword [esi + 0x3a8]
call fcn.004aff00
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0x68830c
push dword [esi + 0x3e4]
push 0x6883e8
push dword [esi + 0x3f0]
lea eax, [ebp - 0x78]
mov edx, 4
call fcn.004078b0
mov eax, dword [ebp - 0x78]
call fcn.00407374
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x687db0
mov eax, dword [0x6a7520]
mov eax, dword [eax]
call fcn.004e0ac4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 4], 0x103
je 0x687d0e
cmp dword [ebp - 4], 0
jne 0x687d4e
push 0
push 2
mov ecx, 0x6883fc
mov edx, dword [esi + 0x3d8]
mov eax, esi
call fcn.00685abc
jmp 0x687d9e
push 0x688420
lea eax, [ebp - 0x90]
mov edx, dword [ebp - 4]
mov cl, 4
call fcn.00427408
lea eax, [ebp - 0x90]
lea edx, [ebp - 0x80]
call fcn.004285d4
push dword [ebp - 0x80]
push 0x68830c
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.004078b0
mov eax, dword [ebp - 0x7c]
push eax
push 2
mov ecx, 0x688448
mov edx, dword [esi + 0x3d8]
mov eax, esi
call fcn.00685abc
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x73fce0]
test eax, eax
je 0x687dd4
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x687dd4
mov eax, 0x73fce0
mov edx, dword [0x73fce0]
call fcn.004065cc
test eax, eax
je 0x687ddd
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x687e1f
push 1
push 0
push 0
mov eax, dword [0x73fce0]
call fcn.00407374
push eax
push 0x688464
push 0
call sub.shell32.dll_ShellExecuteW
push 0x7d0
call sub.kernel32.dll_Sleep_2
push 1
push 0
push 0
push 0x688470
push 0x688464
push 0
call sub.shell32.dll_ShellExecuteW
push 0
mov eax, dword [0x6a7520]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x73fc28]
call fcn.004dc070
mov eax, dword [esi + 0x404]
call fcn.00408af4
dec eax
test al, al
jb 0x688238
inc eax
mov byte [ebp - 0xa], al
mov byte [ebp - 9], 0
movzx eax, byte [ebp - 9]
mov edx, dword [esi + 0x404]
mov eax, dword [edx + eax*8 + 4]
call fcn.00408af4
dec eax
test al, al
jb 0x68822c
inc eax
mov byte [ebp - 0xb], al
mov bl, 0
movzx eax, byte [ebp - 9]
mov edx, dword [esi + 0x404]
mov eax, dword [edx + eax*8 + 4]
movzx edx, bl
lea edi, [edx + edx*4]
test byte [eax + edi*8 + 0x24], 4
jne 0x687f07
movzx eax, byte [ebp - 9]
mov edx, dword [esi + 0x404]
mov eax, dword [edx + eax*8 + 4]
movzx edx, bl
lea edx, [edx + edx*4]
test byte [eax + edx*8 + 0x24], 2
jne 0x687f07
movzx eax, byte [ebp - 9]
mov edx, dword [esi + 0x404]
mov eax, dword [edx + eax*8 + 4]
movzx edx, bl
lea edx, [edx + edx*4]
test byte [eax + edx*8 + 0x24], 0x10
jne 0x687f07
movzx eax, byte [ebp - 9]
mov edx, dword [esi + 0x404]
mov eax, dword [edx + eax*8 + 4]
movzx edx, bl
lea edx, [edx + edx*4]
test byte [eax + edx*8 + 0x24], 0x80
jne 0x687f07
movzx eax, byte [ebp - 9]
mov edx, dword [esi + 0x404]
mov eax, dword [edx + eax*8 + 4]
movzx edx, bl
lea edx, [edx + edx*4]
test byte [eax + edx*8 + 0x25], 1
je 0x688222
xor edx, edx
mov eax, dword [esi + 0x3ac]
call fcn.0048aac0
mov edx, 0x64
mov eax, dword [esi + 0x3ac]
call fcn.0048aa44
mov dl, 1
mov eax, dword [esi + 0x3ac]
call fcn.0048abd8
lea eax, [ebp - 0x94]
push eax
movzx eax, byte [ebp - 9]
mov edx, dword [esi + 0x404]
mov eax, dword [edx + eax*8 + 4]
mov eax, dword [eax + edi*8 + 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0x11
lea edx, [ebp - 0x6c]
mov eax, 0x6882b0
xor ecx, ecx
call fcn.00415cb4
mov edx, dword [ebp - 0x94]
mov eax, dword [esi + 0x3a8]
call fcn.004aff00
movzx eax, byte [ebp - 9]
mov edx, dword [esi + 0x404]
mov eax, dword [edx + eax*8 + 4]
mov edx, dword [eax + edi*8]
mov eax, esi
call fcn.00687044
push 0x6882f0
movzx eax, byte [ebp - 9]
mov edx, dword [esi + 0x404]
mov eax, dword [edx + eax*8 + 4]
push dword [eax + edi*8 + 0x1c]
push 0x68830c
lea eax, [ebp - 0x98]
mov edx, 3
call fcn.004078b0
mov eax, dword [ebp - 0x98]
push eax
push 2
movzx eax, byte [ebp - 9]
mov edx, dword [esi + 0x404]
mov eax, dword [edx + eax*8 + 4]
mov edx, dword [eax + edi*8]
mov ecx, 0x68831c
mov eax, esi
call fcn.00685abc
mov cl, 1
mov dl, 1
mov eax, dword [0x684bbc]
call fcn.004425f0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0x40
movzx edx, byte [ebp - 9]
mov ecx, dword [esi + 0x404]
mov edx, dword [ecx + edx*8 + 4]
lea edx, [edx + edi*8]
mov ecx, dword [0x6847c0]
call fcn.004082f0
mov eax, dword [ebp - 8]
mov byte [eax + 0xf], 0
mov eax, dword [ebp - 8]
call fcn.00443228
mov eax, dword [ebp - 8]
call fcn.00443274
movzx eax, byte [ebp - 9]
mov edx, dword [esi + 0x404]
mov eax, dword [edx + eax*8 + 4]
lea eax, [eax + edi*8]
mov edx, dword [ebp - 8]
add edx, 0x40
mov ecx, dword [0x6847c0]
call fcn.004082f0
mov eax, dword [ebp - 8]
call fcn.004050dc
push 0x6882f0
movzx eax, byte [ebp - 9]
mov edx, dword [esi + 0x404]
mov eax, dword [edx + eax*8 + 4]
push dword [eax + edi*8 + 0x1c]
push 0x68830c
lea eax, [ebp - 0x9c]
mov edx, 3
call fcn.004078b0
mov eax, dword [ebp - 0x9c]
push eax
push 2
movzx eax, byte [ebp - 9]
mov edx, dword [esi + 0x404]
mov eax, dword [edx + eax*8 + 4]
mov edx, dword [eax + edi*8]
mov ecx, 0x688344
mov eax, esi
call fcn.00685abc
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00404a3c
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x24], 0x40
mov word [ebp - 0x20], 0
push 0
push 2
movzx eax, byte [ebp - 9]
mov edx, dword [esi + 0x404]
mov eax, dword [edx + eax*8 + 4]
mov edx, dword [eax + edi*8]
mov ecx, 0x688368
mov eax, esi
call fcn.00685abc
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0x68830c
movzx eax, byte [ebp - 9]
mov edx, dword [esi + 0x404]
mov eax, dword [edx + eax*8 + 4]
push dword [eax + edi*8 + 0xc]
push 0x6883e8
movzx eax, byte [ebp - 9]
mov edx, dword [esi + 0x404]
mov eax, dword [edx + eax*8 + 4]
push dword [eax + edi*8 + 0x18]
lea eax, [ebp - 0xa0]
mov edx, 4
call fcn.004078b0
mov eax, dword [ebp - 0xa0]
call fcn.00407374
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x688222
mov eax, dword [0x6a7520]
mov eax, dword [eax]
call fcn.004e0ac4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 4], 0x103
je 0x688152
cmp dword [ebp - 4], 0
jne 0x6881a3
push 0
push 2
movzx eax, byte [ebp - 9]
mov edx, dword [esi + 0x404]
mov eax, dword [edx + eax*8 + 4]
movzx edx, bl
lea edx, [edx + edx*4]
mov edx, dword [eax + edx*8]
mov ecx, 0x6883fc
mov eax, esi
call fcn.00685abc
jmp 0x688210
push 0x688420
lea eax, [ebp - 0xb8]
mov edx, dword [ebp - 4]
mov cl, 4
call fcn.00427408
lea eax, [ebp - 0xb8]
lea edx, [ebp - 0xa8]
call fcn.004285d4
push dword [ebp - 0xa8]
push 0x68830c
lea eax, [ebp - 0xa4]
mov edx, 3
call fcn.004078b0
mov eax, dword [ebp - 0xa4]
push eax
push 2
movzx eax, byte [ebp - 9]
mov edx, dword [esi + 0x404]
mov eax, dword [edx + eax*8 + 4]
movzx edx, bl
lea edx, [edx + edx*4]
mov edx, dword [eax + edx*8]
mov ecx, 0x688448
mov eax, esi
call fcn.00685abc
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
inc ebx
dec byte [ebp - 0xb]
jne 0x687e7c
inc byte [ebp - 9]
dec byte [ebp - 0xa]
jne 0x687e5a
mov eax, esi
call fcn.00688aec
mov eax, dword [0x6a7520]
mov eax, dword [eax]
call fcn.004e0e68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68829b
lea eax, [ebp - 0xb8]
call fcn.00422448
lea eax, [ebp - 0xa8]
mov edx, 6
call fcn.004072e0
lea eax, [ebp - 0x90]
call fcn.00422448
lea eax, [ebp - 0x80]
mov edx, 5
call fcn.004072e0
lea eax, [ebp - 0x64]
call fcn.004072d8
ret