Function at 0x4319b0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x394
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x40
lea eax, [ebp - 0x390]
mov dword [ebp - 0x394], 0x44
push 0
push eax
call fcn.005f46f0
add esp, 0xc
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
jne 0x431a0d
lea eax, [esi - 0xd]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
call fcn.004317c0
push esi
test eax, eax
jns 0x431a31
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, 0xfffffffb
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push 0x73c670
lea eax, [ebp - 0x32c]
push str.__ws___d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x8000
lea eax, [ebp - 0x338]
push 0
push eax
call fcn.0061b2e6
add esp, 0x1c
test eax, eax
jns 0x431a7f
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
call fcn.0060a381
pop esi
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push 0x8000
lea eax, [ebp - 0x340]
push 0
push eax
call fcn.0061b2e6
add esp, 0xc
test eax, eax
jns 0x431acf
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 0x338]
call fcn.0062aab7
push dword [ebp - 0x334]
call fcn.0062aab7
add esp, 8
call fcn.0060a381
pop esi
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x340]
xor eax, eax
mov word [ebp - 0x364], ax
call fcn.0061b16e
push dword [ebp - 0x334]
mov dword [ebp - 0x35c], eax
call fcn.0061b16e
add esp, 8
or dword [ebp - 0x368], 0x181
mov dword [ebp - 0x358], eax
lea eax, [ebp - 0x350]
push eax
lea eax, [ebp - 0x394]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x32c]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
jne 0x431b4d
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
push esi
call ebx
push dword [ebp - 0x34c]
call ebx
push dword [ebp - 0x340]
call fcn.0062aab7
push dword [ebp - 0x334]
call fcn.0062aab7
push 0x6e9f40
push dword [ebp - 0x338]
call fcn.0065fe9a
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x431b9c
push dword [ebp - 0x338]
call fcn.0062aab7
jmp 0x431bbb
push 0x6ec308
push dword [ebp - 0x33c]
call fcn.0065fe9a
mov esi, eax
add esp, 8
test esi, esi
jne 0x431bf5
push edi
call fcn.0060b444
push dword [ebp - 0x33c]
call fcn.0062aab7
add esp, 8
push 8
push dword [ebp - 0x350]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push dword [ebp - 0x350]
call ebx
pop edi
pop ebx
mov eax, 0xfffffffb
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push 0
push 4
push 0
push edi
call fcn.0061b707
push 0
push 4
push 0
push esi
call fcn.0061b707
mov eax, dword [ebp - 0x350]
push str.PING_n
push esi
mov dword [0x73c668], edi
mov dword [0x73c66c], esi
mov dword [0x73c8f8], eax
call fcn.004125e0
push dword [0x73c668]
lea eax, [ebp - 0x24]
push 0x20
push eax
call fcn.0061ab04
add esp, 0x34
test eax, eax
je 0x431c63
cmp dword [ebp - 0x24], 0x474e4f50
jne 0x431c63
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x330]
push eax
push dword [ebp - 0x350]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
mov ecx, dword [ebp - 0x330]
test eax, eax
mov edx, 0xfffffff8
cmove ecx, edx
mov dword [ebp - 0x330], ecx
call fcn.00431cb0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x330]
xor ecx, ebp
pop edi
pop ebx
pop esi
call fcn.004aa758
mov esp, ebp
pop ebp
ret