Function at 0x645ea0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6a1d8c
push eax
mov al, byte [0x6e268d]
mov dword fs:[0], esp
sub esp, 0xfc
push ebx
xor ebx, ebx
cmp al, bl
je 0x645efd
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffffe
push ebx
call dword [sym.imp.user32.dll_EnumDisplaySettingsA]
mov ecx, dword [esp + 0xb8]
mov eax, dword [0x6e2670]
cmp ecx, eax
je 0x645f58
lea edx, [esp + 0x50]
push 4
mov word [esp + 0x78], 0x94
mov dword [esp + 0x7c], 0x1c0000
push edx
jmp 0x645f52
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffffe
push ebx
call dword [sym.imp.user32.dll_EnumDisplaySettingsA]
mov ecx, dword [esp + 0xbc]
mov eax, dword [0x6e2668]
cmp ecx, eax
jne 0x645f3c
mov edx, dword [esp + 0xc0]
mov eax, dword [0x6e266c]
cmp edx, eax
jne 0x645f3c
mov eax, dword [esp + 0xb8]
mov ecx, dword [0x6e2670]
cmp eax, ecx
je 0x645f58
lea ecx, [esp + 0x50]
push 4
mov word [esp + 0x78], 0x94
mov dword [esp + 0x7c], 0x1c0000
push ecx
call dword [sym.imp.user32.dll_ChangeDisplaySettingsA]
mov ecx, dword [0x818984]
cmp ecx, ebx
je 0x645f68
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [0x818988]
mov dword [0x818984], ebx
cmp ecx, ebx
je 0x645f7e
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [0x818990]
mov dword [0x818988], ebx
cmp ecx, ebx
je 0x645f95
mov edx, dword [ecx]
push 1
call dword [edx + 4]
mov eax, dword [0x818794]
mov dword [0x818990], ebx
cmp eax, ebx
je 0x645fd0
mov al, byte [eax + 0x7ac]
lea edx, [esp + 8]
mov byte [esp + 8], al
mov ecx, dword [esp + 8]
push 4
and ecx, 0xff
push edx
push 0x6d8f84
mov dword [esp + 0x14], ecx
call fcn.00646c70
add esp, 0xc
mov eax, dword [0x81898c]
cmp eax, ebx
je 0x645ff7
mov eax, dword [eax + 0x1c8]
push 4
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0x6d78d0
call fcn.00646c70
add esp, 0xc
mov eax, dword [0x8189a8]
cmp eax, ebx
je 0x64601b
mov ecx, dword [eax + 0x24]
lea edx, [esp + 8]
push 4
push edx
push 0x6d8410
mov dword [esp + 0x14], ecx
call fcn.00646e40
add esp, 0xc
mov eax, dword [0x818794]
push esi
cmp eax, ebx
je 0x646096
mov eax, dword [eax + 0x490]
mov esi, dword [0x8186f0]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x3c]
push eax
push ecx
lea ecx, [esi + 0x14]
call fcn.004531c0
mov esi, dword [esi + 0x18]
mov eax, dword [esp + 0x3c]
cmp eax, esi
je 0x646096
lea esi, [eax + 0x10]
cmp esi, ebx
je 0x646096
lea ecx, [esp + 0x54]
call fcn.00571d40
add esi, 0x264
lea ecx, [esp + 0x54]
push esi
mov dword [esp + 0x110], ebx
call fcn.00438e90
lea ecx, [esp + 0x54]
call fcn.00571e00
lea ecx, [esp + 0x54]
mov dword [esp + 0x10c], 0xffffffff
call fcn.00571db0
mov ecx, dword [0x818978]
cmp ecx, ebx
je 0x6460a6
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [0x8189b8]
mov dword [0x818978], ebx
cmp eax, ebx
je 0x6462ca
mov al, byte [esp + 0xb]
push ebp
push edi
mov byte [esp + 0x18], al
mov edi, 0x6d7ba0
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x20], ebx
mov ebp, ecx
lea ecx, [esp + 0x1c]
push ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.00403350
test al, al
je 0x646113
mov edi, dword [esp + 0x1c]
mov ecx, ebp
mov edx, ecx
mov esi, 0x6d7ba0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
call fcn.00403330
mov eax, dword [0x8189b8]
mov dword [esp + 0x114], 1
mov esi, dword [eax + 0x44]
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x646191
cmp esi, ebx
je 0x646191
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x1c]
cmp eax, ebx
jne 0x64614c
mov eax, 0x6a3560
push 0x10
lea ecx, [esp + 0x2c]
push eax
push ecx
call dword [sym.imp.kernel32.dll_lstrcpynA]
mov al, byte [esi + 0xa0]
lea edx, [esp + 0x44]
push edx
mov ecx, esi
mov byte [esp + 0x3c], al
call fcn.00401640
mov ecx, dword [eax]
push 0x1c
mov dword [esp + 0x40], ecx
lea ecx, [esp + 0x2c]
mov edx, dword [eax + 4]
lea eax, [esp + 0x2c]
push eax
push ecx
mov dword [esp + 0x4c], edx
call fcn.00646c70
add esp, 0xc
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x114], 0xffffffff
cmp eax, ebx
je 0x6461c1
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x6461b8
cmp al, 0xff
je 0x6461b8
dec al
mov byte [ecx], al
jmp 0x6461c1
push ecx
call fcn.006713a0
add esp, 4
mov edi, 0x6d7b94
or ecx, 0xffffffff
xor eax, eax
mov dl, byte [esp + 0x13]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
lea ecx, [esp + 0x1c]
push ebp
mov byte [esp + 0x20], dl
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.00403350
test al, al
je 0x646219
mov edi, dword [esp + 0x1c]
mov ecx, ebp
mov eax, ecx
mov esi, 0x6d7b94
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
call fcn.00403330
mov ecx, dword [0x8189b8]
mov eax, dword [esp + 0x20]
cmp eax, ebx
mov dword [esp + 0x114], 2
mov esi, dword [ecx + 0x70]
je 0x646298
cmp esi, ebx
je 0x646298
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x1c]
cmp eax, ebx
jne 0x646253
mov eax, 0x6a3560
push 0x10
lea edx, [esp + 0x2c]
push eax
push edx
call dword [sym.imp.kernel32.dll_lstrcpynA]
mov al, byte [esi + 0xa0]
mov ecx, esi
mov byte [esp + 0x38], al
lea eax, [esp + 0x44]
push eax
call fcn.00401640
mov ecx, dword [eax]
push 0x1c
mov dword [esp + 0x40], ecx
lea ecx, [esp + 0x2c]
mov edx, dword [eax + 4]
lea eax, [esp + 0x2c]
push eax
push ecx
mov dword [esp + 0x4c], edx
call fcn.00646c70
add esp, 0xc
mov eax, dword [esp + 0x1c]
pop edi
cmp eax, ebx
mov dword [esp + 0x110], 0xffffffff
pop ebp
je 0x6462ca
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x6462c1
cmp al, 0xff
je 0x6462c1
dec al
mov byte [ecx], al
jmp 0x6462ca
push ecx
call fcn.006713a0
add esp, 4
mov dl, byte [esp + 0xb]
mov dword [esp + 0x48], ebx
mov byte [esp + 0x44], dl
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
lea eax, [esp + 0x44]
mov dword [esp + 0x10c], 3
push eax
push 0x125d
call fcn.00615080
mov eax, dword [esp + 0x50]
add esp, 8
cmp eax, ebx
jne 0x646308
mov eax, 0x6a3560
push 1
push ebx
push ebx
push eax
push 0x6d6400
push ebx
call dword [sym.imp.shell32.dll_ShellExecuteA]
call fcn.00402300
mov ecx, dword [0x8189a8]
cmp ecx, ebx
je 0x64632f
mov edx, dword [ecx]
push 1
call dword [edx + 4]
mov ecx, dword [0x8189ac]
mov dword [0x8189a8], ebx
cmp ecx, ebx
je 0x646346
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov ecx, dword [0x8189b4]
mov dword [0x8189ac], ebx
cmp ecx, ebx
je 0x64635d
mov edx, dword [ecx]
push 1
call dword [edx + 4]
mov ecx, dword [0x8189b0]
mov dword [0x8189b4], ebx
cmp ecx, ebx
je 0x646374
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov ecx, dword [0x8189b8]
mov dword [0x8189b0], ebx
cmp ecx, ebx
je 0x64638b
mov edx, dword [ecx]
push 1
call dword [edx + 4]
mov ecx, dword [0x8189bc]
mov dword [0x8189b8], ebx
cmp ecx, ebx
je 0x6463a2
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov ecx, dword [0x8189c0]
mov dword [0x8189bc], ebx
cmp ecx, ebx
je 0x6463b9
mov edx, dword [ecx]
push 1
call dword [edx + 4]
mov ecx, dword [0x8189c4]
mov dword [0x8189c0], ebx
cmp ecx, ebx
je 0x6463d0
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov ecx, dword [0x8189c8]
mov dword [0x8189c4], ebx
cmp ecx, ebx
je 0x6463e7
mov edx, dword [ecx]
push 1
call dword [edx + 4]
mov ecx, dword [0x8189cc]
mov dword [0x8189c8], ebx
cmp ecx, ebx
je 0x6463fe
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov ecx, dword [0x818998]
mov dword [0x8189cc], ebx
cmp ecx, ebx
je 0x646415
mov edx, dword [ecx]
push 1
call dword [edx + 4]
mov ecx, dword [0x81899c]
mov dword [0x818998], ebx
cmp ecx, ebx
je 0x64642c
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov ecx, dword [0x818994]
cmp ecx, ebx
je 0x64643d
mov edx, dword [ecx]
push 1
call dword [edx + 4]
mov esi, dword [0x818980]
mov dword [0x818994], ebx
cmp esi, ebx
je 0x64645d
mov ecx, esi
call fcn.0063fff0
push esi
call fcn.006713a0
add esp, 4
mov ecx, dword [0x81898c]
mov dword [0x818980], ebx
cmp ecx, ebx
pop esi
je 0x646475
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov ecx, dword [0x8189d0]
mov dword [0x81898c], ebx
cmp ecx, ebx
je 0x64648c
mov edx, dword [ecx]
push 1
call dword [edx + 4]
mov ecx, dword [0x8189d4]
mov dword [0x8189d0], ebx
cmp ecx, ebx
je 0x6464a2
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [0x8189d8]
mov dword [0x8189d4], ebx
cmp ecx, ebx
je 0x6464b8
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [0x8189dc]
mov dword [0x8189d8], ebx
cmp ecx, ebx
je 0x6464ce
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [0x8189dc], ebx
call fcn.00613ca0
mov ecx, dword [0x6e29b4]
cmp ecx, ebx
je 0x6464e9
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0x44]
mov dword [0x6e29b4], ebx
cmp ecx, ebx
mov dword [esp + 0x108], 0xffffffff
je 0x646532
mov al, byte [ecx - 1]
cmp al, bl
je 0x646528
cmp al, 0xff
je 0x646528
dec al
pop ebx
mov byte [ecx - 1], al
mov ecx, dword [esp + 0xfc]
mov dword fs:[0], ecx
add esp, 0x108
ret
dec ecx
push ecx
call fcn.006713a0
add esp, 4
mov ecx, dword [esp + 0x100]
pop ebx
mov dword fs:[0], ecx
add esp, 0x108
ret