Function at 0x4c7c8370
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x674
push ebx
push esi
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x272]
push ebx
push eax
mov word [ebp - 0x274], bx
call sub.msvcrt.dll_memset
xor eax, eax
push 0x1fe
lea ecx, [ebp - 0x672]
push ebx
push ecx
mov word [ebp - 0x28], bx
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
mov word [ebp - 0x674], bx
call sub.msvcrt.dll_memset
push 0x1fe
lea edx, [ebp - 0x472]
push ebx
push edx
mov word [ebp - 0x474], bx
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 8]
add esp, 0x24
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrW]
test eax, eax
je 0x4c7c841e
push 0xbe
push 0x4c78595c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4c78142c
call fcn.4c7c02b0
add esp, 0x10
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp word [esi], bx
jne 0x4c7c842a
push 0xc3
jmp 0x4c7c83fb
lea eax, [ebp - 0x274]
push eax
push 0x2a
push esi
call fcn.4c7c0750
test eax, eax
je 0x4c7c85c2
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
push 0x4c785958
lea ecx, [ebp - 0x274]
push ecx
call esi
push 0x4c785948
lea edx, [ebp - 0x274]
push edx
call esi
push 0x4c785958
lea eax, [ebp - 0x274]
push eax
call esi
mov edi, dword [ebp + 0xc]
test edi, edi
jns 0x4c7c8487
push 0x4c785920
lea ecx, [ebp - 0x274]
push ecx
jmp 0x4c7c8493
push 0x4c7824c0
lea edx, [ebp - 0x274]
push edx
call esi
push 0x4c785958
lea eax, [ebp - 0x274]
push eax
call esi
movzx edx, di
mov edi, dword [sym.imp.msvcrt.dll__itow]
push 0xa
lea ecx, [ebp - 0x28]
push ecx
push edx
call edi
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x274]
push ecx
call esi
push 0x4c785958
lea edx, [ebp - 0x274]
push edx
call esi
push 0xa
lea eax, [ebp - 0x28]
push eax
push ebx
call edi
add esp, 0xc
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x274]
push edx
call esi
push 0x4c785958
lea eax, [ebp - 0x274]
push eax
call esi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x474]
push ecx
lea edx, [ebp - 0x674]
push edx
push ebx
push ebx
push eax
call dword [sym.imp.msvcrt.dll__wsplitpath]
add esp, 0x14
lea ecx, [ebp - 0x674]
push ecx
lea edx, [ebp - 0x274]
push edx
call esi
lea eax, [ebp - 0x474]
push eax
lea ecx, [ebp - 0x274]
push ecx
call esi
push 0x40
lea edx, [ebp - 0x68]
push ebx
push edx
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
add esp, 0xc
lea eax, [ebp + 8]
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x6c], 0x44
mov dword [ebp + 8], ebx
call fcn.4c7c81b0
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
je 0x4c7c859a
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x6c]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x274]
push eax
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edx, dword [ebp + 8]
push edx
call esi
jmp 0x4c7c85b6
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x6c]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x274]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [ebp - 0x10]
push eax
call esi
mov ecx, dword [ebp - 0xc]
push ecx
call esi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc