Function at 0x9fbf50
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0xa8a118
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xcb4
push ebx
push ebp
push esi
xor esi, esi
push edi
lea ecx, [esp + 0x484]
mov dword [esp + 0x1c], esi
call fcn.00a155c0
lea ecx, [esp + 0x274]
mov dword [esp + 0xccc], esi
call fcn.00a155c0
mov ebx, dword [esp + 0xcf8]
mov byte [esp + 0xccc], 1
cmp ebx, esi
je 0x9fc030
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x11
mov esi, ebx
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebx + 8]
call ebp
mov edi, eax
mov dword [esp + 0x18], edi
push esi
lea ecx, [esp + 0x488]
mov byte [esp + 0xcd0], 2
call fcn.00a163c0
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
call esi
mov ebx, dword [ebx + 0xc]
call ebp
mov edi, eax
mov dword [esp + 0x18], edi
push ebx
lea ecx, [esp + 0x278]
mov byte [esp + 0xcd0], 3
call fcn.00a163c0
push edi
mov byte [esp + 0xcd0], 1
call esi
lea edx, [esp + 0x20]
mov eax, dword [esp + 0x48c]
mov ecx, dword [esp + 0x27c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x1c], edx
lea ecx, [esp + 0x64]
call fcn.00a155c0
mov ebp, dword [esp + 0xcf4]
lea ecx, [esp + 0xab4]
push ebp
mov byte [esp + 0xcd0], 4
call fcn.00a15040
mov edi, dword [esp + 0xcdc]
mov ebx, dword [eax + 8]
push edi
lea ecx, [esp + 0x8a8]
mov byte [esp + 0xcd0], 5
call fcn.00a15040
mov ecx, dword [esp + 0xcd8]
mov eax, dword [eax + 8]
push ecx
lea ecx, [esp + 0x698]
mov byte [esp + 0xcd0], 6
mov dword [esp + 0x1c], eax
call fcn.00a15040
mov esi, dword [esp + 0xcfc]
lea edx, [esp + 0x64]
lea ecx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0xcf4]
push esi
push edx
mov edx, dword [esp + 0xcf8]
push ebx
mov ebx, dword [esp + 0xd04]
mov eax, dword [eax + 8]
push ebx
push ecx
mov ecx, dword [esp + 0xd00]
push edx
mov edx, dword [esp + 0xd00]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
push ecx
push eax
mov byte [esp + 0xcfc], 7
call fcn.009fbf00
add esp, 0x30
lea ecx, [esp + 0x694]
test al, al
sete byte [esp + 0x13]
mov byte [esp + 0xccc], 6
call fcn.00a155e0
lea ecx, [esp + 0x8a4]
mov byte [esp + 0xccc], 5
call fcn.00a155e0
lea ecx, [esp + 0xab4]
mov byte [esp + 0xccc], 4
call fcn.00a155e0
mov al, byte [esp + 0x13]
test al, al
je 0x9fc1c5
mov eax, dword [esp + 0xcd4]
push esi
test eax, eax
je 0x9fc186
mov edx, dword [esp + 0xcfc]
mov ecx, dword [esp + 0xcf0]
push edx
mov edx, dword [esp + 0xcf0]
push ebp
push ebx
mov ebx, dword [esp + 0xce8]
push ecx
mov ecx, dword [esp + 0xcf8]
push edx
mov edx, dword [esp + 0xcf8]
push ecx
push edx
push edi
push ebx
call eax
mov dword [esp + 0x14], eax
jmp 0x9fc1cc
mov eax, dword [esp + 0xcfc]
mov ecx, dword [esp + 0xcf0]
mov edx, dword [esp + 0xcec]
push eax
mov eax, dword [esp + 0xcec]
push ebp
push ebx
push ecx
mov ecx, dword [esp + 0xcf4]
push edx
mov edx, dword [esp + 0xcf0]
push eax
push ecx
push edi
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [esp + 0x14], eax
jmp 0x9fc232
mov ebx, dword [esp + 0xcd8]
mov eax, dword [esp + 0xcd4]
test eax, eax
je 0x9fc232
mov eax, dword [0xaa2204]
mov ecx, dword [eax]
shr ecx, 0x1c
test cl, 1
je 0x9fc232
mov eax, dword [esp + 0x14]
mov ebp, 0xaa1d48
test eax, eax
je 0x9fc1f8
mov ebp, str._success_
test edi, edi
jne 0x9fc201
mov edi, 0xaa00c0
test ebx, ebx
jne 0x9fc20a
mov ebx, 0xaa00c0
mov edx, dword [esp + 0x6c]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esi + 8]
push eax
push ecx
push ebp
push edx
push edi
push ebx
push str.CreateProcessA_app_s_cmdline_s_____x__s__h0x_x__pid0x_x___GetLastError_x___ls_n
call fcn.009fe320
add esp, 0x24
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x64]
mov byte [esp + 0xccc], 1
call fcn.00a155e0
lea ecx, [esp + 0x274]
mov byte [esp + 0xccc], 0
call fcn.00a155e0
lea ecx, [esp + 0x484]
mov dword [esp + 0xccc], 0xffffffff
call fcn.00a155e0
mov ecx, dword [esp + 0xcc4]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xcc0
ret 0x2c