Function at 0x757604
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x40
push 0
push 0
dec ecx
jne 0x75760c
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x7584e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x773c58]
mov eax, dword [eax]
call fcn.005fe630
mov edx, dword [0x5f8248]
call fcn.00408284
mov ebx, eax
test ebx, ebx
je 0x7584b7
mov edx, 0x7584fc
mov eax, ebx
call fcn.005fe7bc
call fcn.005fd7f0
mov edx, dword [0x5f8fec]
call fcn.00408284
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x7584b7
mov eax, dword [ebp - 0x38]
call fcn.005ffd58
dec eax
test eax, eax
jl 0x7584b7
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x3c], 0
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
call fcn.005ffd50
mov edx, dword [0x5f8248]
call fcn.00408284
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x7584ab
xor edx, edx
push ebp
push 0x75770c
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x75851c
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
lea edx, [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx - 0x24]
movzx eax, byte [0x758540]
push eax
lea eax, [ebp - 0xac]
push eax
xor ecx, ecx
mov edx, 0x758550
mov eax, dword [ebp - 0x24]
call fcn.0042c1c4
mov edx, dword [ebp - 0xac]
lea eax, [ebp - 0x24]
call fcn.0040a174
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x75772a
xor ecx, ecx
push ebp
push 0x75848e
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov edx, 0x758560
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
lea edx, [ebp - 0xb0]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0xb0]
lea edx, [ebp - 8]
call fcn.006ce370
mov edx, 0x758574
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
lea edx, [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x10]
cmp word [eax], 0x22
jne 0x757798
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.0040ad30
mov edx, dword [ebp - 0x10]
mov eax, edx
test eax, eax
je 0x7577a6
sub eax, 4
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 2], 0x22
jne 0x7577ca
mov eax, edx
test eax, eax
je 0x7577bc
sub eax, 4
mov eax, dword [eax]
lea edx, [ebp - 0x10]
mov ecx, 1
xchg edx, eax
call fcn.0040ad30
lea edx, [ebp - 0xb4]
mov eax, dword [ebp - 0x10]
call fcn.006ce324
mov edx, dword [ebp - 0xb4]
lea eax, [ebp - 0x10]
call fcn.0040a174
lea eax, [ebp - 0xc]
call fcn.006ce2e8
lea eax, [ebp - 0x54]
push eax
call sub.ole32.dll_CoCreateGuid
cmp dword [ebp - 0x24], 0
je 0x75780a
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x24]
call fcn.0040ab20
jmp 0x757833
push dword [ebp - 0xc]
lea edx, [ebp - 0xb8]
lea eax, [ebp - 0x54]
call fcn.006ce3d4
push dword [ebp - 0xb8]
push 0x758594
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040ac00
lea edx, [ebp - 0xbc]
mov eax, dword [ebp - 0xc]
call fcn.00424ff8
mov eax, dword [ebp - 0xbc]
mov edx, 0x758594
call fcn.0040acb0
je 0x757860
lea eax, [ebp - 0xc]
mov edx, 0x758594
call fcn.0040ab20
lea ecx, [ebp - 0xc4]
mov edx, 5
mov eax, dword [ebp - 8]
call fcn.0043edf0
mov eax, dword [ebp - 0xc4]
lea edx, [ebp - 0xc0]
call fcn.00423490
mov eax, dword [ebp - 0xc0]
mov edx, 0x7585ac
call fcn.0040acb0
je 0x757c28
xor eax, eax
push ebp
push 0x757acc
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.006c942c
mov eax, dword [ebp - 0x20]
mov edx, 0x7585c4
call fcn.0040acb0
je 0x757989
mov ebx, 1
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0x20]
push 0x7585e0
mov edx, 0x75863c
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
lea edx, [ebp - 0xd4]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0xd4]
lea edx, [ebp - 0xd0]
call fcn.006ce370
push dword [ebp - 0xd0]
push 0x758650
lea edx, [ebp - 0xd8]
mov eax, ebx
call fcn.004241bc
push dword [ebp - 0xd8]
push 0x758664
lea eax, [ebp - 0xcc]
mov edx, 6
call fcn.0040ac00
mov edx, dword [ebp - 0xcc]
mov eax, dword [0x773310]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 8]
call fcn.006c5438
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.006c942c
mov eax, dword [ebp - 0x20]
mov edx, 0x7585c4
call fcn.0040acb0
je 0x757989
imul eax, ebx, 0x1388
push eax
call sub.KERNEL32.DLL_Sleep_1
inc ebx
cmp ebx, 7
jne 0x7578ce
mov eax, dword [ebp - 0x20]
mov edx, 0x7585c4
call fcn.0040acb0
je 0x757abf
lea eax, [ebp - 0xdc]
push eax
push dword [ebp - 0x20]
push 0x758680
mov edx, 0x75863c
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
lea edx, [ebp - 0xe8]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0xe8]
lea edx, [ebp - 0xe4]
call fcn.006ce370
push dword [ebp - 0xe4]
push 0x758650
lea eax, [ebp - 0xe0]
mov edx, 4
call fcn.0040ac00
mov edx, dword [ebp - 0xe0]
mov eax, dword [0x773310]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 8]
call fcn.006c5438
lea eax, [ebp - 0xf0]
mov ecx, 0x758700
mov edx, dword [ebp - 0x20]
call fcn.0040ab78
mov eax, dword [ebp - 0xf0]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xec]
push eax
mov edx, 0x75863c
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
lea edx, [ebp - 0xf4]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov edx, dword [ebp - 0xf4]
mov eax, dword [0x773310]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, 0x75875c
call fcn.006c5810
mov edx, 0x75863c
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
lea edx, [ebp - 0xfc]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0xfc]
lea edx, [ebp - 0xf8]
call fcn.006ce370
mov eax, dword [ebp - 0xf8]
call fcn.0042442c
call fcn.00757410
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7584ab
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x757c28
lea ecx, [ebp - 0x12c]
mov edx, 5
mov eax, dword [ebp - 8]
call fcn.0043edf0
mov eax, dword [ebp - 0x12c]
lea edx, [ebp - 0x128]
call fcn.00423490
mov eax, dword [ebp - 0x128]
mov edx, 0x7585ac
call fcn.0040acb0
jne 0x757ff5
xor eax, eax
push ebp
push 0x757e94
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.006c974c
mov eax, dword [ebp - 0x1c]
mov edx, 0x7585c4
call fcn.0040acb0
je 0x757d51
mov ebx, 1
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x1c]
push 0x7585e0
mov edx, 0x75863c
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
lea edx, [ebp - 0x13c]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.006ce370
push dword [ebp - 0x138]
push 0x758650
lea edx, [ebp - 0x140]
mov eax, ebx
call fcn.004241bc
push dword [ebp - 0x140]
push 0x758664
lea eax, [ebp - 0x134]
mov edx, 6
call fcn.0040ac00
mov edx, dword [ebp - 0x134]
mov eax, dword [0x773310]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 8]
call fcn.006c5438
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.006c974c
mov eax, dword [ebp - 0x1c]
mov edx, 0x7585c4
call fcn.0040acb0
je 0x757d51
imul eax, ebx, 0x1388
push eax
call sub.KERNEL32.DLL_Sleep_1
inc ebx
cmp ebx, 7
jne 0x757c96
mov eax, dword [ebp - 0x1c]
mov edx, 0x7585c4
call fcn.0040acb0
je 0x757e87
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0x1c]
push 0x758680
mov edx, 0x75863c
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
lea edx, [ebp - 0x150]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
call fcn.006ce370
push dword [ebp - 0x14c]
push 0x758650
lea eax, [ebp - 0x148]
mov edx, 4
call fcn.0040ac00
mov edx, dword [ebp - 0x148]
mov eax, dword [0x773310]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 8]
call fcn.006c5438
lea eax, [ebp - 0x158]
mov ecx, 0x758700
mov edx, dword [ebp - 0x1c]
call fcn.0040ab78
mov eax, dword [ebp - 0x158]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x154]
push eax
mov edx, 0x75863c
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
lea edx, [ebp - 0x15c]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov edx, dword [ebp - 0x15c]
mov eax, dword [0x773310]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, 0x75875c
call fcn.006c5810
mov edx, 0x75863c
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
lea edx, [ebp - 0x164]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x164]
lea edx, [ebp - 0x160]
call fcn.006ce370
mov eax, dword [ebp - 0x160]
call fcn.0042442c
call fcn.00757410
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7584ab
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x757ff5
push 0
lea edx, [ebp - 0x194]
mov eax, dword [ebp - 0xc]
call fcn.006c8a4c
mov eax, dword [ebp - 0x194]
push eax
mov eax, dword [ebp - 0xc]
call fcn.006c89f0
push edx
push eax
lea eax, [ebp - 0x198]
call fcn.004241e4
mov eax, dword [ebp - 0x198]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x190]
push eax
mov edx, 0x75863c
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
lea edx, [ebp - 0x19c]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov edx, dword [ebp - 0x19c]
mov eax, dword [0x773310]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, 0x75897c
call fcn.006c5810
push 0
call sub.ole32.dll_CoInitialize
push 5
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0xc]
call fcn.00424f58
mov eax, dword [ebp - 0x1a0]
call fcn.0040a90c
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040a90c
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040a90c
push eax
push 0x758984
push 0
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
call sub.ole32.dll_CoUninitialize
cmp ebx, 0x20
jge 0x7581f6
mov edx, 0x75863c
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
lea edx, [ebp - 0x1a8]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x1a8]
lea edx, [ebp - 0x1a4]
call fcn.006ce370
mov eax, dword [ebp - 0x1a4]
call fcn.0042442c
call fcn.00757410
lea edx, [ebp - 0x1b4]
mov eax, ebx
call fcn.004241bc
mov ecx, dword [ebp - 0x1b4]
lea eax, [ebp - 0x1b0]
mov edx, 0x75899c
call fcn.0040ab78
mov eax, dword [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x1ac]
push eax
mov edx, 0x75863c
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
lea edx, [ebp - 0x1bc]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x1bc]
lea edx, [ebp - 0x1b8]
call fcn.006ce370
mov edx, dword [ebp - 0x1b8]
mov eax, dword [0x773310]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, 0x75875c
call fcn.006c5af8
lea eax, [ebp - 0x1c0]
push eax
push 0x758a10
mov edx, 0x75863c
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
lea edx, [ebp - 0x1cc]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x1cc]
lea edx, [ebp - 0x1c8]
call fcn.006ce370
push dword [ebp - 0x1c8]
push 0x758a54
lea edx, [ebp - 0x1d0]
mov eax, ebx
call fcn.004241bc
push dword [ebp - 0x1d0]
lea eax, [ebp - 0x1c4]
mov edx, 4
call fcn.0040ac00
mov edx, dword [ebp - 0x1c4]
mov eax, dword [0x773310]
mov eax, dword [eax]
mov eax, dword [eax + 4]
xor ecx, ecx
call fcn.006c5438
jmp 0x758484
mov edx, 0x75863c
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
lea edx, [ebp - 0x1d8]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov edx, dword [ebp - 0x1d8]
lea ecx, [ebp - 0x1d4]
mov eax, dword [0x773310]
mov eax, dword [eax]
mov eax, dword [eax + 4]
call fcn.006c5018
push 0
lea eax, [ebp - 0x1dc]
push eax
mov edx, 0x75863c
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
lea edx, [ebp - 0x1e4]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x1e4]
lea edx, [ebp - 0x1e0]
call fcn.006ce370
mov edx, dword [ebp - 0x1e0]
mov eax, dword [0x773310]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, 0x75897c
call fcn.006c5af8
mov eax, dword [ebp - 0x34]
call fcn.00759284
test al, al
je 0x758301
mov edx, 0x75863c
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
lea edx, [ebp - 0x1ec]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov edx, dword [ebp - 0x1ec]
lea ecx, [ebp - 0x1e8]
mov eax, dword [0x773310]
mov eax, dword [eax]
mov eax, dword [eax + 4]
call fcn.006c5228
mov edx, 0x75863c
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
lea edx, [ebp - 0x1f4]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x1f4]
lea edx, [ebp - 0x1f0]
call fcn.006ce370
mov eax, dword [ebp - 0x1f0]
call fcn.0042442c
call fcn.00757410
xor edx, edx
push ebp
push 0x7583cd
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x14]
call fcn.00409d4c
mov edx, 0x758a68
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
mov edx, dword [0x5f8fec]
call fcn.00408284
mov edi, eax
mov eax, edi
call fcn.005ffd58
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x7583b5
inc ebx
xor esi, esi
cmp dword [ebp - 0x14], 0
jne 0x758371
mov edx, esi
mov eax, edi
call fcn.005ffd50
lea edx, [ebp - 0x1f8]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x1f8]
lea edx, [ebp - 0x14]
call fcn.006ce370
jmp 0x7583b1
push dword [ebp - 0x14]
push 0x758a8c
mov edx, esi
mov eax, edi
call fcn.005ffd50
lea edx, [ebp - 0x200]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x200]
lea edx, [ebp - 0x1fc]
call fcn.006ce370
push dword [ebp - 0x1fc]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040ac00
inc esi
dec ebx
jne 0x758347
cmp dword [ebp - 0x14], 0
je 0x7583c3
mov eax, dword [ebp - 0x14]
call fcn.006cb498
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7583f5
xor edx, edx
push ebp
push 0x75845f
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x18]
call fcn.00409d4c
mov edx, 0x758a9c
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
test eax, eax
jne 0x758447
mov edx, 0x75863c
mov eax, dword [ebp - 0x34]
call fcn.005fe7bc
call fcn.005fd7f0
lea edx, [ebp - 0x204]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x204]
lea edx, [ebp - 0x18]
call fcn.006ce370
cmp dword [ebp - 0x18], 0
je 0x758455
mov eax, dword [ebp - 0x18]
call fcn.006cb7ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x758484
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7584ab
inc dword [ebp - 0x3c]
dec dword [ebp - 0x44]
jne 0x75768b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7584e9
lea eax, [ebp - 0x204]
mov edx, 0x57
call fcn.00409dac
lea eax, [ebp - 0x30]
mov edx, 0xc
call fcn.00409dac
ret