Function at 0x431a70
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x324
mov eax, dword [0x4fa5ac]
xor eax, esp
mov dword [esp + 0x320], eax
push ebx
push esi
push edi
push 0x104
lea eax, [esp + 0x128]
xor edi, edi
push eax
push edi
mov esi, ecx
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, 7
xor ecx, ecx
lea eax, [esp + 0x124]
mov dword [esp + 0x120], ebx
mov dword [esp + 0x11c], edi
mov word [esp + 0x10c], cx
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x431ad0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x128]
push edx
lea ecx, [esp + 0x110]
call fcn.00402040
push 1
push 0xffffffffffffffff
push 0x4a368c
lea ecx, [esp + 0x114]
call fcn.0040fd70
cmp eax, 0xffffffff
jne 0x431b2f
cmp dword [esp + 0x120], 8
jb 0x431b28
mov eax, dword [esp + 0x10c]
push eax
call fcn.004390ba
add esp, 4
xor al, al
jmp 0x431de7
mov ecx, dword [esp + 0x11c]
inc eax
cmp eax, ecx
ja 0x431b4c
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x110]
call fcn.004016b0
jmp 0x431b5c
sub eax, ecx
push edi
push eax
lea ecx, [esp + 0x110]
call fcn.004080b0
push edi
lea ecx, [esp + 0x4c]
push ecx
lea ecx, [esp + 0x44]
mov dword [esp + 0x44], 0x4a8bd4
mov dword [esp + 0x4c], 0x4a69c4
mov dword [esp + 0x98], 0x4a8acc
call fcn.004310a0
mov edx, dword [esp + 0x3c]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x48]
mov dword [esp + eax + 0x3c], 0x4a8ba0
call fcn.0042ec70
mov edx, dword [esp + 0x44]
mov ecx, dword [esi]
mov dword [esp + 0x48], 0x4a8b44
mov dword [esp + 0x84], edi
mov dword [esp + 0x88], edi
mov eax, dword [edx + 4]
mov edx, dword [esp + eax + 0x54]
mov ecx, dword [ecx + 8]
lea eax, [esp + eax + 0x44]
and edx, 0xfffff9ff
or edx, 0x800
mov dword [eax + 0x10], edx
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x334]
mov eax, dword [eax + 4]
push edx
push 0x4a6f9c
push ecx
lea eax, [esp + eax + 0x50]
mov esi, 8
or dword [eax + 0x10], esi
push 0x4a8be0
lea eax, [esp + 0x118]
push eax
lea ecx, [esp + 0x58]
push 0x4a8bdc
push ecx
call fcn.00431140
add esp, 8
push eax
call fcn.00431330
add esp, 8
push eax
call fcn.00431140
add esp, 8
mov ecx, eax
call fcn.00431940
push eax
call fcn.00431580
add esp, 8
mov ecx, eax
call fcn.00431940
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x4c]
call fcn.0042fa00
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], esi
jae 0x431c5c
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.0043dd99
add esp, 4
mov ebp, eax
cmp dword [esp + 0x2c], esi
jb 0x431c7b
mov eax, dword [esp + 0x18]
push eax
call fcn.004390ba
add esp, 4
push 0x40
lea edx, [esp + 0xd0]
xor ecx, ecx
push edi
push edx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], edi
mov word [esp + 0x24], cx
call fcn.004395a0
add esp, 0xc
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0xcc]
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
push ebp
push edi
mov dword [esp + 0xf0], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x431d17
push ebp
call fcn.00439bda
add esp, 4
lea ecx, [esp + 0x94]
call fcn.0042f0f0
lea edx, [esp + 0x94]
push edx
mov dword [esp + 0x98], vtable.std::ios_base.0
call fcn.00438aad
add esp, 4
cmp dword [esp + 0x124], esi
jb 0x431d10
mov eax, dword [esp + 0x110]
push eax
call fcn.004390ba
add esp, 4
xor al, al
jmp 0x431de6
mov ecx, dword [esp + 0x30]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [esp + 0x10]
mov esi, eax
mov eax, dword [esp + 0x30]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
push ecx
setne bl
call edi
mov edx, dword [esp + 0x34]
push edx
call edi
cmp esi, 0x102
jne 0x431d97
push ebp
call fcn.00439bda
add esp, 4
lea ecx, [esp + 0x94]
call fcn.0042f0f0
lea eax, [esp + 0x94]
push eax
mov dword [esp + 0x98], vtable.std::ios_base.0
call fcn.00438aad
add esp, 4
lea ecx, [esp + 0x10c]
call fcn.00437940
xor al, al
jmp 0x431de6
test bl, bl
je 0x431da6
cmp dword [esp + 0x10], 0
jne 0x431da6
mov bl, 1
jmp 0x431da8
xor bl, bl
push ebp
call fcn.00439bda
add esp, 4
lea ecx, [esp + 0x94]
call fcn.0042f0f0
lea ecx, [esp + 0x94]
push ecx
mov dword [esp + 0x98], vtable.std::ios_base.0
call fcn.00438aad
add esp, 4
lea ecx, [esp + 0x10c]
call fcn.00437940
mov al, bl
pop ebp
mov ecx, dword [esp + 0x32c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00439589
add esp, 0x324
ret 4