Function at 0x64611a1f
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x646170a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor esi, esi
mov dword [ebp - 0x218], edx
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], ecx
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x270]
xor ebx, ebx
push 0x44
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea edi, [ebp - 0x228]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64611aa5
test byte [eax + 0x1c], 2
je 0x64611aa5
cmp byte [eax + 0x19], 5
jb 0x64611aa5
push dword [eax + 0x14]
mov edx, 0x64602ff8
push dword [eax + 0x10]
push 0x47
pop ecx
call fcn.64604423
push 0x20019
push 0
mov edx, 0x64602d68
mov ecx, 0x80000000
call fcn.6460f309
mov edi, eax
test edi, edi
jne 0x64611b08
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x64617004]
cmp ecx, 0x64617004
je 0x64611ce5
test byte [ecx + 0x1c], 2
je 0x64611ce5
cmp byte [ecx + 0x19], 2
jb 0x64611ce5
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x48
mov edx, 0x64602ff8
pop ecx
call fcn.64604441
jmp 0x64611ce5
push ecx
push 0
xor edx, edx
mov ecx, edi
push 0
inc edx
call fcn.6460f394
mov ebx, eax
test ebx, ebx
jne 0x64611ba4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64611b55
test byte [eax + 0x1c], 2
je 0x64611b55
cmp byte [eax + 0x19], 2
jb 0x64611b55
push esi
push dword [eax + 0x14]
mov edx, 0x64602ff8
push dword [eax + 0x10]
push 0x49
pop ecx
call fcn.64604441
push ecx
push 0
push 0
push 2
pop edx
mov ecx, edi
call fcn.6460f394
mov ebx, eax
test ebx, ebx
jne 0x64611ba4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64611ce5
test byte [eax + 0x1c], 2
je 0x64611ce5
cmp byte [eax + 0x19], 2
jb 0x64611ce5
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x4a
jmp 0x64611af8
push 0x64602db8
push ebx
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x64611bed
mov esi, 0x65b
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64611ce5
test byte [eax + 0x1c], 2
je 0x64611ce5
cmp byte [eax + 0x19], 2
jb 0x64611ce5
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x4b
jmp 0x64611af8
push dword [ebp - 0x214]
xor ecx, ecx
push dword [ebp - 0x218]
mov word [eax], cx
lea eax, [ebp - 0x210]
push ebx
push 0x64602dc4
push 0x104
push eax
call fcn.64604343
add esp, 0x18
test eax, eax
jns 0x64611c63
mov ecx, eax
movzx esi, ax
and ecx, 0x1fff0000
cmp ecx, 0x70000
je 0x64611c31
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64611ce5
test byte [eax + 0x1c], 2
je 0x64611ce5
cmp byte [eax + 0x19], 2
jb 0x64611ce5
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x4c
jmp 0x64611af8
push 9
pop eax
mov word [ebp - 0x240], ax
xor ecx, ecx
lea eax, [ebp - 0x228]
mov dword [ebp - 0x270], 0x44
push eax
lea eax, [ebp - 0x270]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x210]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x64611ccd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64611ce5
test byte [eax + 0x1c], 2
je 0x64611ce5
cmp byte [eax + 0x19], 2
jb 0x64611ce5
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x4d
jmp 0x64611af8
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call fcn.6460ce5b
test edi, edi
je 0x64611cf7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.64615f50
mov esp, ebp
pop ebp
ret