Function at 0x402c90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4055d5
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push ebx
push esi
push edi
mov eax, dword [0x409008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
call fcn.00401210
mov ecx, eax
test ecx, ecx
je 0x402f7c
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov edi, 1
mov eax, dword [esi - 8]
mov ecx, edi
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x402d02
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00403d80
mov esi, dword [ebp - 0x10]
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [esi - 8]
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
push esi
call ebx
add esp, 8
test eax, eax
js 0x402f72
cmp eax, dword [esi - 8]
jg 0x402f72
mov dword [esi - 0xc], eax
mov ecx, edi
mov byte [eax + esi], 0
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x402d58
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00403d80
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push dword [esi - 8]
push esi
call ebx
add esp, 8
test eax, eax
js 0x402f72
cmp eax, dword [esi - 8]
jg 0x402f72
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
call fcn.00401210
mov ecx, eax
test ecx, ecx
je 0x402f86
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 1
mov ecx, 1
mov eax, dword [edi - 8]
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
jge 0x402dc2
push 0x104
lea ecx, [ebp - 0x18]
call fcn.00403d80
mov edi, dword [ebp - 0x18]
push str.SFW.exe
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
push dword [edi - 8]
push edi
call ebx
add esp, 8
test eax, eax
js 0x402f72
cmp eax, dword [edi - 8]
jg 0x402f72
mov dword [edi - 0xc], eax
mov byte [eax + edi], 0
call fcn.00401210
mov ecx, eax
test ecx, ecx
je 0x402f90
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1c]
push dword [eax + 4]
lea eax, [ebp - 0x14]
push edi
push str.__s___s
push eax
call fcn.00404070
push 0x40
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x80], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x14]
add esp, 0x1c
cmp dword [eax - 4], 1
jle 0x402e51
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00403b50
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x80]
push ecx
push esi
push 0
push 0
push 0
push 0
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x402eff
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.00403a60
push ecx
mov byte [ebp - 4], 3
lea eax, [ebp - 0x18]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.00403a60
push ecx
mov byte [ebp - 4], 4
mov ebx, esp
mov dword [ebp - 0x24], ebx
call fcn.00401210
mov ecx, eax
test ecx, ecx
je 0x402f9a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov eax, str.CreateProcess
mov byte [ebp - 4], 5
mov ecx, ebx
test eax, 0xffff0000
jne 0x402ed6
movzx eax, ax
push eax
call fcn.00403c00
jmp 0x402ee2
push 0xd
push str.CreateProcess
call fcn.00403f20
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov byte [ebp - 4], 2
call fcn.00402fb0
mov dword [ebp - 0x1c], 0
jmp 0x402f05
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
or ebx, 0xffffffff
mov edx, dword [ebp - 0x14]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x402f26
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x402f41
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x402f5d
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.004010e0
push 0x80004005
call fcn.004010e0
push 0x80004005
call fcn.004010e0
push 0x80004005
call fcn.004010e0
push 0x80004005
call fcn.004010e0
int3