Function at 0x6a54e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x70
push 0
push 0
dec ecx
jne 0x6a54e9
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6a5e96
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x78]
mov edx, 0x6a5eb8
call fcn.00409ce4
mov dword [ebp - 0x7c], 0x1325e4
mov byte [ebp - 0x7d], 0
cmp dword [0x6dc414], 0xffffffff
jne 0x6a553c
cmp dword [0x6dc410], 0xffab7b61
jae 0x6a5542
jmp 0x6a553e
jge 0x6a5542
mov byte [ebp - 0x7d], 1
mov eax, dword [0x6dc418]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jge 0x6a5573
cmp byte [ebp - 0x7d], 0
je 0x6a5573
mov eax, dword [ebp - 0x7c]
mov ecx, 0x6d7477
cdq
idiv ecx
cmp edx, 0x2cda88
sete byte [0x6dc40c]
jmp 0x6a5e34
mov eax, dword [ebp - 0x78]
mov edx, 0x6a5efc
call fcn.0040a818
je 0x6a559f
cmp dword [0x6dc414], 0xffffffff
jne 0x6a5596
cmp dword [0x6dc410], 0xffffffff
jae 0x6a559f
jmp 0x6a5598
jge 0x6a559f
mov byte [0x6dc40d], 1
lea eax, [ebp - 0x318]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
call fcn.0040a4dc
mov eax, dword [ebp - 0x318]
lea edx, [ebp - 0x314]
call fcn.00423394
mov eax, dword [ebp - 0x314]
lea edx, [ebp - 0x58]
call fcn.0042323c
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 0x58]
call fcn.00424c50
push 0
push 0x16df00
lea edx, [ebp - 0x31c]
mov eax, 0x6a5f2c
call fcn.0067d9b4
mov edx, dword [ebp - 0x31c]
lea eax, [ebp - 0x64]
call fcn.0042d6a8
mov byte [ebp - 0x49], al
cmp byte [ebp + 8], 0
je 0x6a5b85
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x84]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x14]
call fcn.0040a4dc
lea eax, [ebp - 0x84]
lea edx, [ebp - 0x320]
call fcn.0042e634
cmp dword [ebp - 0x320], 0
je 0x6a57a7
push 0
push 0x199a2f
lea edx, [ebp - 0x324]
mov eax, 0x6a5f58
call fcn.0067d9b4
mov eax, dword [ebp - 0x324]
push eax
lea eax, [ebp - 0x328]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
call fcn.0040a4dc
mov edx, dword [ebp - 0x328]
lea eax, [ebp - 0x54]
pop ecx
call fcn.0040a6e0
xor eax, eax
push ebp
push 0x6a5791
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x330]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
call fcn.0040a4dc
mov eax, dword [ebp - 0x330]
lea edx, [ebp - 0x32c]
call fcn.00424c04
mov eax, dword [ebp - 0x32c]
push eax
push 0
push 0
push 0x1980cc
push 0
push 0x1980cc
call fcn.0067d81c
push eax
push 5
mov eax, dword [ebp - 0x54]
push eax
push 0
push 0x1a229a
push 0
push 0x1a229a
call fcn.0067d81c
push eax
push 0
push 0x1d5515
lea edx, [ebp - 0x338]
mov eax, 0x6a5f70
call fcn.0067d9b4
push dword [ebp - 0x338]
lea eax, [ebp - 0x33c]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
call fcn.0040a4dc
push dword [ebp - 0x33c]
push 0
push 0x160c9b
lea edx, [ebp - 0x340]
mov eax, 0x6a5f84
call fcn.0067d9b4
push dword [ebp - 0x340]
lea eax, [ebp - 0x334]
mov edx, 3
call fcn.0040a768
mov eax, dword [ebp - 0x334]
push eax
lea eax, [ebp - 0x344]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x14]
call fcn.0040a4dc
mov ecx, dword [ebp - 0x344]
mov edx, dword [ebp - 0x54]
pop eax
call fcn.00688140
mov dl, 1
mov eax, dword [ebp - 0x54]
call fcn.00424654
test al, al
jne 0x6a5787
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6a5e34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6a57b5
lea eax, [ebp - 0x54]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
call fcn.0040a4dc
cmp byte [ebp - 0x49], 0
je 0x6a57e2
push 0
push 0x19fa0e
lea edx, [ebp - 0x348]
mov eax, 0x6a5fa8
call fcn.0067d9b4
mov eax, dword [ebp - 0x348]
call fcn.0068e908
mov dword [ebp - 0x24], eax
jmp 0x6a57f8
push 0
push 0x1d14de
push 0
push 0x1d14de
call fcn.0067d81c
mov dword [ebp - 0x24], eax
push 0
push 0x157268
lea edx, [ebp - 0x2c]
mov eax, 0x6a5fdc
call fcn.0067d9b4
push 0
push 0x1ba1e0
lea edx, [ebp - 0x74]
mov eax, 0x6a600c
call fcn.0067d9b4
push 0
push 0x131be6
lea edx, [ebp - 0x34c]
mov eax, 0x6a6030
call fcn.0067d9b4
push dword [ebp - 0x34c]
push dword [ebp - 0x54]
push 0
push 0xf61fb
lea edx, [ebp - 0x350]
mov eax, 0x6a6064
call fcn.0067d9b4
push dword [ebp - 0x350]
lea eax, [ebp - 0x40]
mov edx, 3
call fcn.0040a768
push 5
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
push eax
mov eax, dword [ebp - 0x40]
call fcn.0040a478
push eax
mov eax, dword [ebp - 0x2c]
call fcn.0040a478
push eax
mov eax, dword [ebp - 0x74]
call fcn.0040a478
push eax
push 0
call sub.shell32.dll_ShellExecuteW
call fcn.004270a4
fstp qword [ebp - 0x38]
wait
push 0
push 0x14d37e
push 0
push 0x14d37e
call fcn.0067d81c
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
push 0
push 0x194896
push 0
push 0x19476a
call fcn.0067d81c
call fcn.00477d8c
xor eax, eax
push ebp
push 0x6a5a7b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x2bc], 0x22c
push 0xffffffffffffffff
push 0xffe33d59
push 0
push 0x1cc2a7
call fcn.0067d81c
mov edx, eax
mov eax, 2
call fcn.0067d6ac
mov dword [ebp - 0x48], eax
xor eax, eax
push ebp
push 0x6a5a6a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2bc]
mov eax, dword [ebp - 0x48]
call fcn.0067d6cc
test eax, eax
je 0x6a5a53
lea eax, [ebp - 0x88]
lea edx, [ebp - 0x298]
mov ecx, 0x104
call fcn.0040a530
lea eax, [ebp - 0x88]
lea edx, [ebp - 0x8c]
call fcn.0042e504
lea eax, [ebp - 0x8c]
lea edx, [ebp - 0x3c]
call fcn.0042e634
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x64]
call fcn.0040a818
jne 0x6a59d4
lea edx, [ebp - 0x358]
mov eax, dword [ebp - 0x2b4]
call fcn.0069fc28
mov eax, dword [ebp - 0x358]
lea edx, [ebp - 0x354]
call fcn.00423394
mov eax, dword [ebp - 0x354]
lea edx, [ebp - 0x6c]
call fcn.0042323c
mov eax, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x58]
call fcn.0040a818
jne 0x6a59d4
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x2b4]
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push eax
push 0
push 0x410
call sub.kernel32.dll_OpenProcess
mov edx, dword [ebp - 8]
mov dword [edx + 0x38], eax
mov byte [ebp - 0xd], 1
jmp 0x6a5a53
cmp byte [ebp - 0x49], 0
je 0x6a5a35
push 0
push 0xf8ece
lea edx, [ebp - 0x35c]
mov eax, 0x6a607c
call fcn.0067d9b4
mov edx, dword [ebp - 0x35c]
mov eax, dword [ebp - 0x3c]
call fcn.0040a818
jne 0x6a5a35
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x2b4]
je 0x6a5a35
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x2b4]
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push eax
push 0
push 0x410
call sub.kernel32.dll_OpenProcess
mov edx, dword [ebp - 8]
mov dword [edx + 0x38], eax
mov byte [ebp - 0xd], 1
jmp 0x6a5a53
lea edx, [ebp - 0x2bc]
mov eax, dword [ebp - 0x48]
call fcn.0067d6ec
cmp eax, 1
sbb eax, eax
neg eax
or al, byte [ebp - 0xd]
je 0x6a592c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a5a71
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_CloseHandle
ret
push 0
push 0x186055
lea edx, [ebp - 0x60]
mov eax, 0x6a60dc
call fcn.0067d9b4
xor eax, eax
mov dword [ebp - 0x20], eax
push 0
push 0x1ab31b
lea edx, [ebp - 0x50]
mov eax, 0x6a610c
call fcn.0067d9b4
mov eax, dword [ebp - 0x50]
call fcn.0040a478
push eax
mov eax, dword [ebp - 0x60]
call fcn.0040a478
push eax
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00413e50
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x6a5be7
lea eax, [ebp - 0x5c]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call dword [ebp - 0x18]
jmp 0x6a5bec
xor eax, eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x6a5c2d
push 0
push 0x1373d6
lea edx, [ebp - 0x70]
mov eax, 0x6a6144
call fcn.0067d9b4
mov eax, dword [ebp - 0x70]
call fcn.0040a478
push eax
mov eax, dword [ebp - 0x60]
call fcn.0040a478
push eax
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00413e50
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
push eax
call dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
test eax, eax
je 0x6a5c3b
cmp word [eax], 0
jne 0x6a5c47
lea eax, [ebp - 0x44]
call fcn.004098bc
jmp 0x6a5c85
push 0
push 0x18a8d8
lea edx, [ebp - 0x364]
mov eax, 0x6a619c
call fcn.0067d9b4
mov eax, dword [ebp - 0x364]
push eax
lea eax, [ebp - 0x368]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x14]
call fcn.0040a4dc
mov ecx, dword [ebp - 0x368]
lea eax, [ebp - 0x44]
pop edx
call fcn.0040a6e0
cmp byte [ebp - 0x49], 0
je 0x6a5d0f
push 0
push 0x1a5c50
lea edx, [ebp - 0x36c]
mov eax, 0x6a61c0
call fcn.0067d9b4
push dword [ebp - 0x36c]
push dword [ebp - 0x44]
push 0
push 0x17b994
lea edx, [ebp - 0x370]
mov eax, 0x6a61f0
call fcn.0067d9b4
push dword [ebp - 0x370]
lea eax, [ebp - 0x374]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
call fcn.0040a4dc
push dword [ebp - 0x374]
push 0
push 0x1ba6a1
lea edx, [ebp - 0x378]
mov eax, 0x6a620c
call fcn.0067d9b4
push dword [ebp - 0x378]
lea eax, [ebp - 0x68]
mov edx, 5
call fcn.0040a768
jmp 0x6a5d70
push 0
push 0x15b4f5
lea edx, [ebp - 0x37c]
mov eax, 0x6a622c
call fcn.0067d9b4
push dword [ebp - 0x37c]
lea eax, [ebp - 0x380]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
call fcn.0040a4dc
push dword [ebp - 0x380]
push 0
push 0x141b97
lea edx, [ebp - 0x384]
mov eax, 0x6a6244
call fcn.0067d9b4
push dword [ebp - 0x384]
push dword [ebp - 0x44]
lea eax, [ebp - 0x68]
mov edx, 4
call fcn.0040a768
lea edi, [ebp - 0x300]
xor eax, eax
mov ecx, 0x11
rep stosd dword es:[edi], eax
mov dword [ebp - 0x300], 0x44
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x300]
push eax
push 0
push 0
push 0xffffffffffffffff
push 0xfff0bb0d
push 0
push 0xf44f3
call fcn.0067d81c
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x68]
call fcn.0040a478
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x6a5ddb
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x310]
mov dword [eax + 0x38], edx
jmp 0x6a5ded
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp dword [ebp - 0x5c], 0
je 0x6a5e34
cmp dword [ebp - 0x20], 0
je 0x6a5e34
push 0
push 0x10114b
lea edx, [ebp - 0x28]
mov eax, 0x6a6264
call fcn.0067d9b4
mov eax, dword [ebp - 0x28]
call fcn.0040a478
push eax
mov eax, dword [ebp - 0x60]
call fcn.0040a478
push eax
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00413e50
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
push eax
call dword [ebp - 0x1c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a5e9d
lea eax, [ebp - 0x384]
mov edx, 0x1d
call fcn.0040991c
lea eax, [ebp - 0x90]
mov edx, 4
call fcn.0040991c
lea eax, [ebp - 0x78]
mov edx, 7
call fcn.0040991c
lea eax, [ebp - 0x58]
mov edx, 3
call fcn.0040991c
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.0040991c
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.0040991c
ret