Function at 0x66adec
Capabilities:
Create process on windows
Create thread
Resume thread

Disassembly:
push 0x190
mov eax, 0x7b00e1
call fcn.00645f96
mov esi, dword [ebp + 8]
mov ecx, esi
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x100], edi
mov dword [ebp - 0x114], eax
call fcn.00663864
test al, al
jne 0x66b915
lea ecx, [ebp - 0xd0]
call fcn.00408cc0
xor eax, eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], eax
call fcn.00408cc0
lea ecx, [ebp - 0x90]
call fcn.00408cc0
lea ecx, [ebp - 0xb0]
call fcn.00408cc0
push 7
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 3
push eax
mov ecx, esi
call fcn.006627a1
push str.WX_DDE
push eax
mov byte [ebp - 4], 4
call fcn.0066645b
pop ecx
pop ecx
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
mov bl, al
call fcn.00408e36
test bl, bl
je 0x66afe9
push 0x100
lea ecx, [ebp - 0x50]
call fcn.00663a17
mov ebx, 0x100
lea ecx, [ebp - 0x90]
push ebx
call fcn.00663a17
push ebx
lea ecx, [ebp - 0xb0]
call fcn.00663a17
lea eax, [ebp - 0x110]
mov ecx, esi
push eax
call fcn.004474bf
push 7
lea ecx, [ebp - 0x13c]
push ecx
mov ecx, eax
call fcn.00674284
mov ecx, eax
call fcn.00661922
lea ecx, [ebp - 0x13c]
mov esi, eax
call fcn.0042aafd
lea ecx, [ebp - 0x110]
call fcn.0042aafd
movzx eax, word [esi]
test ax, ax
je 0x66afbb
push 0x23
pop edi
cmp ax, di
je 0x66af1a
movzx eax, ax
lea ecx, [ebp - 0xd0]
push eax
call fcn.00669851
add esi, 2
movzx eax, word [esi]
test ax, ax
jne 0x66aefb
mov edi, dword [ebp - 0x100]
xor ebx, ebx
cmp word [esi], bx
je 0x66afbb
add esi, 2
movzx eax, word [esi]
test ax, ax
je 0x66afbb
push 0x23
pop edi
cmp ax, di
je 0x66af59
movzx eax, ax
lea ecx, [ebp - 0x50]
push eax
call fcn.00669851
add esi, 2
movzx eax, word [esi]
test ax, ax
jne 0x66af3d
mov edi, dword [ebp - 0x100]
cmp word [esi], bx
je 0x66afbb
add esi, 2
movzx eax, word [esi]
test ax, ax
je 0x66afbb
push 0x23
pop edi
cmp ax, di
je 0x66af91
movzx eax, ax
lea ecx, [ebp - 0x90]
push eax
call fcn.00669851
add esi, 2
movzx eax, word [esi]
test ax, ax
jne 0x66af72
mov edi, dword [ebp - 0x100]
cmp word [esi], bx
je 0x66afbb
add esi, 2
jmp 0x66afb3
movzx eax, ax
lea ecx, [ebp - 0xb0]
push eax
call fcn.00669851
lea esi, [esi + 2]
movzx eax, word [esi]
test ax, ax
jne 0x66afa1
mov ebx, dword [ebp + 0xc]
test bl, 1
jne 0x66aff8
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0066b91d
add esp, 0xc
test al, al
je 0x66aff8
or edi, 0xffffffff
jmp 0x66b8e8
push esi
lea ecx, [ebp - 0xd0]
call fcn.00408ed9
mov ebx, dword [ebp + 0xc]
xor esi, esi
lea ecx, [ebp - 0x128]
mov dword [ebp - 0xfc], esi
call fcn.0066a590
lea ecx, [ebp - 0x120]
call fcn.0066a590
lea ecx, [ebp - 0x130]
call fcn.0066a590
mov byte [ebp - 4], 7
test edi, edi
je 0x66b074
mov ecx, edi
call fcn.006bd6ae
test al, al
je 0x66b074
lea ecx, [ebp - 0x128]
call fcn.0066a8b4
test al, al
je 0x66b398
lea ecx, [ebp - 0x120]
call fcn.0066a8b4
test al, al
je 0x66b398
lea ecx, [ebp - 0x130]
call fcn.0066a8b4
test al, al
je 0x66b398
inc esi
mov dword [ebp - 0xfc], esi
push 0x44
lea eax, [ebp - 0x19c]
push 0
push eax
call fcn.00646d30
add esp, 0xc
mov dword [ebp - 0x19c], 0x44
test esi, esi
je 0x66b123
push 0
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x170], 0x100
call fcn.0066a696
xor esi, esi
mov dword [ebp - 0x164], eax
inc esi
lea ecx, [ebp - 0x120]
push esi
call fcn.0066a696
push esi
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x160], eax
call fcn.0066a696
push 0
push esi
push esi
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x15c], eax
call fcn.0066a696
mov esi, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push eax
call esi
push 0
push 1
push 0
lea ecx, [ebp - 0x120]
call fcn.0066a696
push eax
call esi
push 0
push 1
push 0
lea ecx, [ebp - 0x130]
call fcn.0066a696
push eax
call esi
mov esi, dword [ebp - 0xfc]
test bl, 0x20
jne 0x66b131
test esi, esi
je 0x66b141
test bl, 2
jne 0x66b141
or dword [ebp - 0x170], 1
xor eax, eax
mov word [ebp - 0x16c], ax
push 4
test bl, 4
lea ecx, [ebp - 0x118]
pop ebx
mov eax, 0x204
cmovne ebx, eax
push 0
or ebx, 0x4000000
call fcn.006735d0
mov esi, dword [ebp - 0x114]
mov byte [ebp - 4], 0xb
mov byte [ebp - 0xf1], 0
test esi, esi
je 0x66b37c
mov ecx, esi
call fcn.00663864
neg al
sbb al, al
add esi, 0x20
inc al
mov dword [ebp - 0xf8], esi
mov ecx, esi
mov byte [ebp - 0xf1], al
call fcn.0066ac8a
test al, al
jne 0x66b376
lea eax, [ebp - 0x138]
mov dword [ebp - 0x104], 1
push eax
mov ecx, esi
or ebx, 0x400
call fcn.00730485
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x108], eax
lea eax, [ebp - 0x138]
mov dword [ebp - 0x10c], ecx
mov ecx, esi
push eax
call fcn.00715c08
push eax
lea ecx, [ebp - 0x10c]
call fcn.00681b5d
test al, al
je 0x66b257
lea ecx, [ebp - 0x10c]
call fcn.006a5d21
mov esi, eax
lea ecx, [esi + 0x20]
call fcn.006bff2f
mov ecx, esi
mov edi, eax
call fcn.006bff2f
add eax, 2
lea ecx, [ebp - 0x10c]
add eax, dword [ebp - 0x104]
add eax, edi
mov dword [ebp - 0x104], eax
call fcn.0066a6a3
mov esi, dword [ebp - 0xf8]
lea eax, [ebp - 0x138]
push eax
mov ecx, esi
call fcn.00715c08
push eax
lea ecx, [ebp - 0x10c]
call fcn.00681b5d
test al, al
jne 0x66b1f3
mov edi, dword [ebp - 0x100]
push dword [ebp - 0x104]
lea ecx, [ebp - 0x118]
call fcn.0066aca9
lea ecx, [ebp - 0x118]
call fcn.0066385d
mov dword [ebp - 0x104], eax
mov ecx, esi
lea eax, [ebp - 0x138]
push eax
call fcn.00730485
mov ecx, dword [eax]
mov dword [ebp - 0x10c], ecx
mov ecx, dword [eax + 4]
lea eax, [ebp - 0x138]
mov dword [ebp - 0x108], ecx
mov ecx, esi
push eax
call fcn.00715c08
push eax
lea ecx, [ebp - 0x10c]
call fcn.00681b5d
test al, al
je 0x66b36b
mov edi, dword [ebp - 0xf8]
lea ecx, [ebp - 0x10c]
call fcn.006a5d21
mov esi, eax
lea eax, [ebp - 0x70]
push 0x7d5b64
push esi
push eax
call fcn.00661abc
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 0xc
push ecx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00661a1c
add esp, 0x18
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0x30]
call fcn.006bff2f
lea ecx, [ebp - 0x30]
lea esi, [eax + 1]
push esi
call fcn.00669d63
push eax
mov eax, dword [ebp - 0x104]
push eax
call fcn.0040a3c5
mov eax, dword [ebp - 0x104]
lea ecx, [ebp - 0x30]
add esp, 0xc
lea eax, [eax + esi*2]
mov dword [ebp - 0x104], eax
call fcn.00408e36
lea ecx, [ebp - 0x10c]
call fcn.0066a6a3
lea eax, [ebp - 0x138]
mov ecx, edi
push eax
call fcn.00715c08
push eax
lea ecx, [ebp - 0x10c]
call fcn.00681b5d
test al, al
jne 0x66b2c0
mov edi, dword [ebp - 0x100]
mov eax, dword [ebp - 0x104]
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x114]
test edi, edi
je 0x66b449
mov ecx, edi
call fcn.006ce9ce
cmp eax, 0x14
ja 0x66b40d
or ebx, 0x40
jmp 0x66b449
push str.Failed_to_redirect_the_child_process_IO
lea ecx, [ebp - 0x30]
call fcn.00408c6d
lea ecx, [ebp - 0x70]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0xf0]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0xa
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x144]
push eax
call fcn.0066154b
lea ecx, [ebp - 0x144]
call fcn.00661721
lea ecx, [ebp - 0xf0]
call fcn.00408e36
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0x30]
call fcn.00408e36
and bl, 1
movsx edi, bl
neg edi
sbb edi, edi
jmp 0x66b8c7
cmp eax, 0x28
ja 0x66b41a
or ebx, 0x4000
jmp 0x66b449
cmp eax, 0x3c
jbe 0x66b446
cmp eax, 0x50
ja 0x66b42c
or ebx, 0x8000
jmp 0x66b449
cmp eax, 0x63
ja 0x66b439
or ebx, 0x80
jmp 0x66b449
cmp eax, 0x64
ja 0x66b446
or ebx, 0x100
jmp 0x66b449
or ebx, 0x20
cmp byte [ebp - 0xf1], 0
je 0x66b45b
mov ecx, esi
call fcn.00669d63
jmp 0x66b45d
xor eax, eax
lea ecx, [ebp - 0x154]
push ecx
lea ecx, [ebp - 0x19c]
push ecx
push eax
lea ecx, [ebp - 0x118]
call fcn.0066385d
push eax
push ebx
mov ebx, dword [ebp - 0xfc]
lea ecx, [ebp - 0xd0]
push ebx
push 0
push 0
call fcn.00669d63
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
setne al
mov byte [ebp - 0xf1], al
test ebx, ebx
je 0x66b4e3
push 0
lea ecx, [ebp - 0x128]
call fcn.0066a959
push eax
call edi
push 1
lea ecx, [ebp - 0x120]
call fcn.0066a959
push eax
call edi
push 1
lea ecx, [ebp - 0x130]
call fcn.0066a959
push eax
call edi
mov al, byte [ebp - 0xf1]
test al, al
jne 0x66b5b5
test ebx, ebx
je 0x66b51f
push 1
lea ecx, [ebp - 0x128]
call fcn.0066a959
push eax
call edi
push 0
lea ecx, [ebp - 0x120]
call fcn.0066a959
push eax
call edi
push 0
lea ecx, [ebp - 0x130]
call fcn.0066a959
push eax
call edi
push str.Execution_of_command__s_failed
lea ecx, [ebp - 0x30]
call fcn.00408c6d
lea ecx, [ebp - 0xf0]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x70]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0xf
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x144]
push eax
call fcn.0066154b
sub esp, 0xc
lea ecx, [ebp - 0xd0]
push esp
call fcn.004474bf
lea eax, [ebp - 0x144]
push eax
call fcn.00690d81
add esp, 0x10
lea ecx, [ebp - 0x144]
call fcn.00661721
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0xf0]
call fcn.00408e36
lea ecx, [ebp - 0x30]
call fcn.00408e36
mov ebx, dword [ebp + 0xc]
and bl, 1
movsx edi, bl
neg edi
sbb edi, edi
jmp 0x66b8b8
lea ecx, [ebp - 0x110]
call fcn.0069e7f1
lea ecx, [ebp - 0x13c]
call fcn.0069e7f1
mov byte [ebp - 4], 0x11
test ebx, ebx
je 0x66b6aa
push 0x20
call fcn.00645626
mov esi, eax
pop ecx
mov dword [ebp - 0xf8], esi
xor ebx, ebx
mov byte [ebp - 4], 0x12
test esi, esi
je 0x66b60d
push ebx
lea ecx, [ebp - 0x120]
call fcn.0066a959
push eax
mov ecx, esi
call fcn.0066a59a
mov dword [ebp - 0xf8], eax
jmp 0x66b613
mov dword [ebp - 0xf8], ebx
push 0x20
mov byte [ebp - 4], 0x11
call fcn.00645626
mov esi, eax
pop ecx
mov dword [ebp - 0xfc], esi
mov byte [ebp - 4], 0x13
test esi, esi
je 0x66b645
push ebx
lea ecx, [ebp - 0x130]
call fcn.0066a959
push eax
mov ecx, esi
call fcn.0066a59a
mov ebx, eax
push 0x14
mov byte [ebp - 4], 0x11
call fcn.00645626
mov esi, eax
pop ecx
mov dword [ebp - 0xfc], esi
mov byte [ebp - 4], 0x14
test esi, esi
je 0x66b678
push 1
lea ecx, [ebp - 0x128]
call fcn.0066a959
push eax
mov ecx, esi
call fcn.0066a5b8
jmp 0x66b67a
xor eax, eax
mov esi, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0x100]
push ebx
push eax
push esi
mov byte [ebp - 4], 0x11
call fcn.00682209
push esi
lea ecx, [ebp - 0x110]
call fcn.00727611
push ebx
lea ecx, [ebp - 0x13c]
call fcn.00727611
push 0x66ba2d
push dword [0x9da014]
push 0x9dbaec
call fcn.00675d10
mov ebx, eax
push 0x1c
mov dword [ebp - 0xfc], ebx
call fcn.00645626
add esp, 0x10
test eax, eax
je 0x66b6e0
mov ecx, eax
call fcn.0066a555
mov esi, eax
jmp 0x66b6e2
xor esi, esi
mov eax, dword [ebp - 0x154]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x14c]
mov dword [esi + 0xc], eax
mov dword [esi], ebx
mov ebx, dword [ebp + 0xc]
mov al, bl
and al, 1
mov byte [esi + 0x18], al
mov eax, dword [ebp - 0x100]
test eax, eax
je 0x66b71d
push dword [ebp - 0x14c]
mov ecx, eax
call fcn.00731be6
mov eax, dword [ebp - 0x100]
push 0
mov ecx, ebx
and ecx, 1
mov dword [ebp - 0x114], ecx
pop ecx
cmovne eax, ecx
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x158]
push eax
xor eax, eax
push eax
push esi
push 0x66b9a8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [ebp - 0x150]
mov dword [ebp - 0xf8], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x150]
call edi
mov edi, dword [ebp - 0xf8]
test edi, edi
jne 0x66b784
push dword [ebp - 0xfc]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 1
mov ecx, esi
call fcn.0066a6e4
jmp 0x66b7dc
lea eax, [ebp - 0xf8]
mov ecx, 0x9dbaf4
push eax
call fcn.00681874
lea ecx, [ebp - 0x50]
mov dword [esi + 8], edi
call fcn.00663864
test al, al
jne 0x66b7d3
push 0x2710
push dword [ebp - 0x154]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
test eax, eax
jne 0x66b7d3
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0066b91d
add esp, 0xc
cmp dword [ebp - 0x114], 0
jne 0x66b7e7
mov edi, dword [ebp - 0x14c]
jmp 0x66b89a
call fcn.0066891b
mov edi, eax
test edi, edi
je 0x66b897
and dword [ebp - 0xf8], 0
mov eax, ebx
and eax, 8
mov dword [ebp - 0xfc], eax
jne 0x66b817
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x4c]
mov dword [ebp - 0xf8], eax
cmp byte [esi + 0x18], 0
je 0x66b873
and ebx, 0x10
lea ecx, [ebp - 0x110]
call fcn.0066abf2
test al, al
jne 0x66b846
lea ecx, [ebp - 0x13c]
call fcn.0066abf2
test al, al
jne 0x66b846
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0
push dword [esi]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test ebx, ebx
jne 0x66b86d
call fcn.00667319
test eax, eax
je 0x66b86d
push ebx
mov ecx, eax
call fcn.00677cce
cmp byte [esi + 0x18], 0
jne 0x66b820
cmp dword [ebp - 0xfc], 0
jne 0x66b889
mov eax, dword [edi]
mov ecx, edi
push dword [ebp - 0xf8]
call dword [eax + 0x50]
mov edi, dword [esi + 0x14]
mov ecx, esi
push 1
call fcn.0066a6e4
jmp 0x66b89a
or edi, 0xffffffff
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x10
call fcn.0066a675
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0xb
call fcn.0066a675
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 7
call fcn.006735e7
lea ecx, [ebp - 0x130]
call fcn.0066a63a
lea ecx, [ebp - 0x120]
call fcn.0066a63a
lea ecx, [ebp - 0x128]
call fcn.0066a63a
lea ecx, [ebp - 0xb0]
call fcn.00408e36
lea ecx, [ebp - 0x90]
call fcn.00408e36
lea ecx, [ebp - 0x50]
call fcn.00408e36
lea ecx, [ebp - 0xd0]
call fcn.00408e36
mov eax, edi
jmp 0x66b917
xor eax, eax
call fcn.00645f45
ret