Function at 0x7b8144
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x7b83dd
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x7b83b8
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x7b835e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
cmp byte [eax + 0x1dc], 0
jne 0x7b81a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.0040a34c
jmp 0x7b83bf
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x68]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
jne 0x7b81c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.0040a34c
jmp 0x7b83bf
mov eax, dword [ebp - 8]
call fcn.007b6f98
test al, al
je 0x7b81df
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.0040a34c
jmp 0x7b83bf
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x16c]
call fcn.006694e4
mov eax, dword [ebp - 8]
call fcn.007b9704
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x16c]
call fcn.006694d0
jmp 0x7b833e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x170]
mov edx, dword [eax]
call dword [edx + 0x74]
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x1d8]
jne 0x7b823e
push 0x1f4
call sub.KERNEL32.DLL_Sleep
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x16c]
call fcn.0066cc20
jmp 0x7b833e
mov eax, dword [0x7e6468]
push dword [eax]
push 0x7b83f8
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x170]
mov ecx, dword [eax]
call dword [ecx + 0x88]
push dword [ebp - 0x60]
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040be98
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x44
call fcn.00408108
mov dword [ebp - 0x5c], 0x44
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040bba4
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x7b832b
xor eax, eax
push ebp
push 0x7b8324
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x170]
mov edx, dword [eax]
call dword [edx + 0x74]
mov edx, dword [ebp - 8]
mov dword [edx + 0x1d8], eax
mov eax, dword [ebp - 8]
call fcn.007b792c
test al, al
je 0x7b8304
jmp 0x7b82f2
push 0x3e8
call sub.KERNEL32.DLL_Sleep
push 0x64
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
je 0x7b82e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b8330
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
call fcn.0042f380
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x16c]
call fcn.0066cc20
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x16c]
cmp byte [eax + 0xad], 0
je 0x7b8208
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7b8392
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x16c]
call fcn.006694e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b83bf
mov eax, dword [ebp - 8]
mov byte [eax + 0x1dc], 1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b83e4
lea eax, [ebp - 0x60]
call fcn.0040ac20
lea eax, [ebp - 4]
call fcn.0040ac20
ret