Function at 0x431260
Capabilities:
Accept command line arguments
Create a process with modified i/o handles and window
Create process on windows
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0xfe0]
mov eax, 0x1060
call fcn.0043f040
mov eax, dword [0x446b10]
xor eax, ebp
mov dword [ebp + 0xfdc], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call fcn.004382ad
mov edi, 0x800
push edi
mov dword [0x4c566c], eax
mov eax, dword [ebp + 0xfe8]
push ebx
push 0x4c4260
mov dword [0x4c35c8], 1
mov dword [0x4d9960], eax
mov dword [0x4c5ee4], 4
mov byte [0x4c5268], bl
mov byte [0x4c3a38], bl
mov byte [0x4c5670], bl
call sub.MSVCR80.dll_memset
push edi
push ebx
mov esi, 0x4c4a60
push esi
call sub.MSVCR80.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 0x18
push 0xfffffffffffffff5
mov dword [0x4c5264], ebx
mov byte [0x4c3638], bl
call edi
push 0xfffffffffffffff4
mov dword [0x4d9964], eax
call edi
cmp dword [0x4c566c], ebx
mov dword [0x4d9968], eax
je 0x431328
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x4c5264
push eax
mov dword [ebp - 0x2c], eax
call fcn.004310cb
jmp 0x43133c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x4c5264
push eax
mov dword [ebp - 0x28], eax
call fcn.00431162
cmp dword [0x4c5edc], ebx
mov edi, eax
jne 0x431370
mov dword [0x44696c], ebx
mov dword [0x446970], ebx
mov dword [0x446974], ebx
mov dword [0x446978], ebx
mov dword [0x44697c], ebx
mov dword [0x446980], ebx
mov dword [0x446984], ebx
cmp dword [0x4d9964], 0xffffffff
je 0x4314d6
cmp edi, ebx
je 0x43139c
jle 0x431388
call fcn.00430638
call fcn.00430658
xor eax, eax
cmp edi, 1
setne al
push eax
call dword [sym.imp.MSVCR80.dll_exit]
test byte [0x4c5ee4], 4
jne 0x431451
xor edi, edi
inc edi
cmp byte [0x4c4260], bl
jne 0x4313bd
call fcn.00430658
push 1
jmp 0x431396
cmp byte [0x4c4a60], bl
mov dword [0x4c5ef0], ebx
je 0x43140a
push esi
call fcn.004253bf
cmp eax, ebx
mov dword [0x4c5ef0], eax
jne 0x431426
push esi
push 0x1de
call fcn.0041f4d9
push eax
lea eax, [ebp - 0x24]
push 0x1000
push eax
call dword [sym.imp.MSVCR80.dll_sprintf_s]
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
push ebx
mov dword [0x4c5f38], ebx
call fcn.0040d954
jmp 0x4313b9
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov dword [0x4c5efc], eax
mov dword [0x4c5f38], eax
mov dword [0x4c35c0], ebx
mov dword [0x4c35c4], ebx
call fcn.004254fc
cmp eax, 1
jne 0x431446
push 0x4c4260
call fcn.0042f763
mov edi, eax
neg edi
sbb edi, edi
inc edi
call fcn.0042a182
call fcn.0042a4c7
push edi
jmp 0x431396
xor eax, eax
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
pop esi
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
push ebx
push eax
call sub.MSVCR80.dll_memset
or dword [ebp - 0x44], 0xffffffff
or dword [ebp - 0x48], 0xffffffff
or dword [ebp - 0x40], 0xffffffff
add esp, 0xc
cmp dword [0x4c566c], ebx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push 8
push 1
push ebx
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x54], 0x101
mov word [ebp - 0x50], 5
push ebx
je 0x4314c4
push dword [ebp - 0x2c]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4314d0
push 0x1df
call fcn.0041f4ea
push eax
call dword [sym.imp.MSVCR80.dll_printf]
pop ecx
jmp 0x4313b9
push dword [ebp - 0x28]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x4314a9
push ebx
jmp 0x431396
cmp byte [0x4c4260], bl
mov dword [0x4c5f38], 0xfde9
mov dword [0x4c5ee4], 4
mov dword [0x4c35c4], ebx
je 0x431557
push 0x2e
push 0x4c4260
call dword [sym.imp.MSVCR80.dll_strrchr]
cmp eax, ebx
pop ecx
pop ecx
je 0x431557
mov esi, dword [sym.imp.MSVCR80.dll__stricmp]
lea edi, [eax + 1]
push 0x4081a4
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x431530
push 0x4081a0
push edi
call esi
test eax, eax
pop ecx
pop ecx
jne 0x431557
call fcn.00431d6d
or eax, 0x10
push eax
push 0x1dd
call fcn.0041f37e
push eax
push 0x1dc
call fcn.0041f37e
push eax
push ebx
call fcn.00438e84
jmp 0x431593
call fcn.004254fc
cmp eax, 1
jne 0x43158e
call fcn.004380ba
cmp byte [0x4c4260], bl
je 0x43157f
mov esi, 0x4c4260
push esi
call fcn.00431d01
push esi
call fcn.0042f763
call fcn.00435161
call fcn.0042a182
call fcn.0043658d
call fcn.0042a4c7
mov ecx, dword [ebp + 0xfdc]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0043eef0
add ebp, 0xfe0
leave
ret 0x10