Function at 0x427176
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
xor ebx, ebx
push edi
push 0x44
lea eax, [ebp - 0x88]
push ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
call fcn.00408720
xor eax, eax
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x44]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push 0x25
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
call fcn.004307b4
mov edi, eax
cmp edi, ebx
jge 0x4271e0
push 0x44972a
jmp 0x427304
lea eax, [ebp - 8]
push eax
push 0x449718
push dword [ebp - 0x10]
call fcn.004307ea
mov edi, eax
cmp edi, ebx
jge 0x427201
push 0x4496f6
jmp 0x427304
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
dec eax
je 0x42729a
dec eax
je 0x427220
mov edi, 0x8000ffff
push 0x4496c6
jmp 0x427304
lea eax, [ebp - 0x14]
push eax
mov eax, dword [esi + 8]
push dword [eax + 0x24]
push 1
call fcn.004207cc
mov edi, eax
cmp edi, ebx
jge 0x42724f
mov eax, dword [esi + 8]
push dword [eax]
push 0x4478e6
push edi
call fcn.00431454
add esp, 0xc
jmp 0x427527
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x70]
mov eax, dword [eax]
push dword [eax + 0x18]
push dword [ebp - 0x14]
call fcn.004307ea
mov edi, eax
cmp edi, ebx
jge 0x427276
push 0x4478c4
jmp 0x427304
push dword [ebp - 0xc]
lea eax, [ebp - 4]
push dword [ebp - 8]
push 0x44968a
push eax
call fcn.0042ff34
mov edi, eax
add esp, 0x10
cmp edi, ebx
jge 0x4272c4
push 0x449664
jmp 0x427304
mov eax, dword [esi + 8]
push dword [eax + 0x8c]
lea eax, [ebp - 4]
push dword [ebp - 8]
push 0x44960e
push eax
call fcn.0042ff34
mov edi, eax
add esp, 0x10
cmp edi, ebx
jge 0x4272c4
push 0x4495e6
jmp 0x427304
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x427311
cmp word [eax], bx
je 0x427311
push ebx
push 0x4495d8
lea eax, [ebp - 4]
push eax
call fcn.0042fb8a
mov edi, eax
cmp edi, ebx
jge 0x4272ec
push 0x4495a6
jmp 0x427304
push ebx
push dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
call fcn.0042fb8a
mov edi, eax
cmp edi, ebx
jge 0x427311
push 0x449576
push edi
call fcn.00431454
pop ecx
pop ecx
jmp 0x427527
mov eax, dword [ebp - 0xc]
cmp eax, ebx
jne 0x427321
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x8c]
push dword [ebp - 4]
push eax
push dword [esi + 0x10]
call fcn.0041bce6
push eax
mov eax, dword [esi + 8]
push dword [eax]
push dword [ebp + 0xc]
call fcn.0041c036
push eax
push 0x2000012d
push 1
call fcn.0040c33a
add esp, 0x1c
lea eax, [ebp - 0x1c]
push eax
lea ebx, [ebp - 0x24]
call fcn.00426fdc
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jge 0x427371
push 0x449536
push edi
call fcn.00431454
pop ecx
pop ecx
jmp 0x427525
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x88]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x88], 0x44
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4273e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4273b4
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x4273bf
mov edi, 0x80004005
push edi
push 0x145
push 0x4493aa
call fcn.00431468
push dword [ebp - 8]
push 0x4476a4
push edi
call fcn.00431454
add esp, 0xc
jmp 0x427525
push 2
pop edi
push dword [ebp + 0x14]
xor ebx, ebx
lea eax, [ebp - 0x44]
inc ebx
push eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], 0x32
call dword [ebp + 0x10]
cmp eax, ebx
je 0x42740a
test eax, eax
jne 0x427473
lea eax, [ebp - 0x18]
push eax
push 0x1f4
push dword [ebp - 0x34]
call fcn.0042e8b6
mov edi, eax
cmp edi, 0x80070102
je 0x4273e5
test edi, edi
js 0x42749a
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x4274a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42744e
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
js 0x427459
mov edi, 0x80004005
push edi
push 0x15c
push 0x4493aa
call fcn.00431468
push 0x449514
jmp 0x427364
xor ecx, ecx
cmp eax, edi
setne cl
lea edi, [ecx - 0x7ff8f9be]
push edi
push 0x14f
push 0x4493aa
call fcn.00431468
push 0x4494de
jmp 0x427364
push dword [ebp - 8]
push 0x447620
jmp 0x4273d7
mov eax, dword [ebp - 0x18]
mov ecx, 0xbc2
cmp eax, 0x80070bc2
jne 0x4274bb
mov eax, ecx
mov dword [ebp - 0x18], eax
xor edi, edi
cmp eax, edi
je 0x4274ec
cmp eax, ebx
je 0x4274ef
cmp eax, ecx
je 0x4274e5
cmp eax, 0x240005
je 0x4274e5
cmp eax, 0x240006
je 0x4274ec
cmp eax, 0x80240017
je 0x4274ef
mov edi, 0x8000ffff
jmp 0x427525
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
jmp 0x4274f9
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
cmp dword [ebp - 0x20], edi
je 0x427525
mov eax, dword [esi + 0x10]
cmp eax, 2
jne 0x427519
push dword [esi + 8]
call fcn.00428026
mov edi, eax
test edi, edi
jns 0x427525
push 0x4475ea
jmp 0x427364
cmp eax, ebx
jne 0x427525
push dword [esi + 8]
call fcn.00428110
xor ebx, ebx
cmp dword [ebp - 0x14], ebx
je 0x427534
push dword [ebp - 0x14]
call fcn.0042ea70
cmp dword [ebp - 0xc], ebx
je 0x427541
push dword [ebp - 0xc]
call fcn.0042ea70
cmp dword [ebp - 0x10], ebx
je 0x42754e
push dword [ebp - 0x10]
call fcn.0042ea70
cmp dword [ebp - 8], ebx
je 0x42755b
push dword [ebp - 8]
call fcn.0042ea70
cmp dword [ebp - 4], ebx
je 0x427568
push dword [ebp - 4]
call fcn.0042ea70
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x34], ebx
je 0x42757b
push dword [ebp - 0x34]
call esi
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x30], ebx
je 0x427588
push dword [ebp - 0x30]
call esi
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x1c], ebx
je 0x427597
push 4
push dword [ebp - 0x24]
call fcn.00426f74
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14