Function at 0x601bc130
Capabilities:
Create process on windows

Disassembly:
jmp 0x601c6300
sub esp, 0x64
push ebx
push ebp
push esi
push edi
xor esi, esi
push 8
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
xor ebx, ebx
mov dword [esp + 0x20], esi
call sym.nspr4.dll_PR_Malloc
mov edi, eax
add esp, 4
cmp edi, esi
mov dword [esp + 0x18], edi
jne 0x601c633b
push esi
push 0xffffe890
call sym.nspr4.dll_PR_SetError
jmp 0x601c64fa
mov ecx, dword [esp + 0x7c]
lea eax, [esp + 0x10]
push eax
push ecx
call fcn.601c65a0
add esp, 8
cmp eax, 0xffffffff
jne 0x601c6362
push esi
push 0xffffe890
call sym.nspr4.dll_PR_SetError
jmp 0x601c64fa
mov edi, dword [esp + 0x80]
mov ebp, dword [esp + 0x84]
cmp edi, esi
jne 0x601c6391
cmp ebp, esi
je 0x601c640e
cmp dword [ebp + 0x10], esi
je 0x601c640e
call dword [sym.imp.MSVCRT.dll___p__environ]
mov edi, dword [eax]
cmp edi, esi
je 0x601c640e
cmp dword [edi], 0
je 0x601c639f
mov eax, dword [edi + esi*4 + 4]
inc esi
test eax, eax
jne 0x601c6396
lea eax, [esi + 1]
test ebp, ebp
mov dword [esp + 0x7c], eax
je 0x601c63b6
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x601c63b6
inc eax
mov dword [esp + 0x7c], eax
lea edx, [eax*4]
push edx
call sym.nspr4.dll_PR_Malloc
add esp, 4
xor edx, edx
test esi, esi
mov ebx, eax
jle 0x601c63df
mov ecx, edi
mov edx, esi
sub ecx, ebx
mov edi, dword [ecx + eax]
mov dword [eax], edi
add eax, 4
dec esi
jne 0x601c63d4
test ebp, ebp
je 0x601c63ee
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x601c63ee
mov dword [ebx + edx*4], eax
inc edx
mov eax, dword [esp + 0x7c]
push 0x601c6850
dec eax
push 4
push eax
push ebx
mov dword [ebx + edx*4], 0
call dword [sym.imp.MSVCRT.dll_qsort]
add esp, 0x10
xor esi, esi
lea ecx, [esp + 0x14]
push ecx
push ebx
call fcn.601c6700
add esp, 8
cmp eax, 0xffffffff
jne 0x601c642c
push esi
push 0xffffe890
jmp 0x601c64f1
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x30]
cmp ebp, esi
rep stosd dword es:[edi], eax
mov dword [esp + 0x30], 0x44
je 0x601c64bc
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff6
xor edi, edi
call esi
push 0xfffffffffffffff5
mov dword [esp + 0x6c], eax
call esi
push 0xfffffffffffffff4
mov dword [esp + 0x70], eax
call esi
mov dword [esp + 0x70], eax
mov eax, dword [ebp]
test eax, eax
je 0x601c647b
mov edx, dword [eax + 4]
mov edi, 1
mov eax, dword [edx + 0x18]
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 4]
test eax, eax
je 0x601c6491
mov ecx, dword [eax + 4]
mov edi, 1
mov edx, dword [ecx + 0x18]
mov dword [esp + 0x6c], edx
mov eax, dword [ebp + 8]
test eax, eax
je 0x601c64a4
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x70], ecx
jmp 0x601c64a8
test edi, edi
je 0x601c64b3
mov eax, dword [esp + 0x5c]
or ah, 1
mov dword [esp + 0x5c], eax
mov edx, dword [ebp + 0xc]
xor esi, esi
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
push esi
push 1
push esi
push esi
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x601c654b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xffffe896
call sym.nspr4.dll_PR_SetError
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
add esp, 8
cmp eax, esi
je 0x601c6512
push eax
call sym.nspr4.dll_PR_Free
add esp, 4
mov dword [esp + 0x10], esi
cmp ebx, esi
je 0x601c651f
push ebx
call sym.nspr4.dll_PR_Free
add esp, 4
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x601c6534
push eax
call sym.nspr4.dll_PR_Free
add esp, 4
mov dword [esp + 0x14], esi
cmp edi, esi
je 0x601c6541
push edi
call sym.nspr4.dll_PR_Free
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x64
ret
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov ecx, dword [esp + 0x28]
mov dword [edi + 4], ecx
mov edx, dword [esp + 0x10]
push edx
call sym.nspr4.dll_PR_Free
add esp, 4
cmp ebx, esi
mov dword [esp + 0x10], esi
je 0x601c6585
push ebx
call sym.nspr4.dll_PR_Free
add esp, 4
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x601c6596
push eax
call sym.nspr4.dll_PR_Free
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret