Function at 0x423390
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
xor esi, esi
push edi
push 0x44
lea eax, [ebp - 0x80]
push esi
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call fcn.00408720
xor eax, eax
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
mov eax, dword [ebx + 8]
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x10], esi
push dword [eax + 0x24]
push dword [eax + 0x14]
call fcn.0041ddaa
mov esi, eax
test esi, esi
jns 0x423400
mov eax, dword [ebx + 8]
push dword [eax]
push 0x447a1a
jmp 0x4236fa
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx + 8]
mov eax, dword [eax + 0x70]
mov eax, dword [eax]
push dword [eax + 0x18]
push dword [ebp - 0x1c]
call fcn.00431306
mov esi, eax
test esi, esi
jns 0x423427
push 0x4479f8
jmp 0x42374e
mov eax, dword [ebx + 0xc]
dec eax
je 0x42345a
dec eax
je 0x42344f
sub eax, 3
je 0x423444
mov esi, 0x8000ffff
push 0x4479c0
jmp 0x42374e
mov eax, dword [ebx + 8]
mov edi, dword [eax + 0x90]
jmp 0x423463
mov eax, dword [ebx + 8]
mov edi, dword [eax + 0x8c]
jmp 0x423463
mov eax, dword [ebx + 8]
mov edi, dword [eax + 0x94]
test edi, edi
je 0x4234e1
cmp word [edi], 0
je 0x4234e1
push 0
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp + 0xc]
call fcn.00414064
mov esi, eax
test esi, esi
jns 0x42348c
push 0x44799e
jmp 0x42374e
push dword [ebp - 0x14]
lea eax, [ebp - 8]
push dword [ebp - 4]
push 0x44798c
push eax
call fcn.0043007e
mov esi, eax
add esp, 0x10
test esi, esi
js 0x4234fc
push 0
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
call fcn.00416828
mov esi, eax
test esi, esi
jns 0x4234c8
push 0x44795e
jmp 0x42374e
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
push dword [ebp - 4]
push 0x44798c
push eax
call fcn.0043007e
add esp, 0x10
jmp 0x423516
push dword [ebp - 4]
mov edi, 0x443656
lea eax, [ebp - 8]
push edi
push eax
call fcn.0043007e
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x423506
push 0x447938
jmp 0x42374e
push dword [ebp - 4]
lea eax, [ebp - 0xc]
push edi
push eax
call fcn.0043007e
add esp, 0xc
mov esi, eax
test esi, esi
jns 0x423526
push 0x447908
jmp 0x42374e
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x42358c
mov ecx, dword [ebx + 8]
cmp dword [ecx + 0xa0], 1
jne 0x42358c
push eax
push 0x402edc
push dword [ebp - 8]
mov edi, 0x4478ee
lea eax, [ebp - 8]
push edi
push eax
call fcn.0043007e
mov esi, eax
add esp, 0x14
test esi, esi
jns 0x423564
push 0x4478a4
jmp 0x42374e
push dword [ebx + 0x10]
lea eax, [ebp - 0xc]
push 0x402edc
push dword [ebp - 0xc]
push edi
push eax
call fcn.0043007e
mov esi, eax
add esp, 0x14
test esi, esi
jns 0x42358c
push 0x447850
jmp 0x42374e
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebx + 0xc]
call fcn.00418ea2
push eax
mov eax, dword [ebx + 8]
push dword [eax]
push dword [ebp + 0x10]
call fcn.004191f4
push eax
push 0x2000012d
push 1
call fcn.0040bfb2
mov eax, dword [ebx + 8]
mov eax, dword [eax + 0xa0]
add esp, 0x1c
cmp eax, 1
jne 0x4235f2
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.0042c07c
mov esi, eax
test esi, esi
jns 0x4236ce
push dword [ebp - 4]
push 0x447820
jmp 0x4236fa
push 2
pop edi
cmp eax, edi
jne 0x423625
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.0042bb4c
mov esi, eax
test esi, esi
jns 0x4236ce
push dword [ebp - 4]
push 0x4477fe
jmp 0x4236fa
lea eax, [ebp - 0x2c]
push eax
xor esi, esi
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push 0x8000000
push esi
push esi
push esi
push dword [ebp - 8]
mov dword [ebp - 0x80], 0x44
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x42368b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x423664
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x42366f
mov esi, 0x80004005
push esi
push 0x1f4
push 0x4473d0
call fcn.004315c0
push dword [ebp - 4]
push 0x4477d8
jmp 0x4236fa
xor esi, esi
push dword [ebp + 0x18]
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], 0x32
call dword [ebp + 0x14]
cmp eax, 1
je 0x4236af
cmp eax, esi
jne 0x423705
lea eax, [ebp - 0x10]
push eax
push 0x1f4
push dword [ebp - 0x2c]
call fcn.0042e9a8
mov esi, eax
cmp esi, 0x80070102
je 0x423689
test esi, esi
js 0x423729
mov edi, dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebx + 8]
call fcn.004232c8
mov esi, eax
test esi, esi
jns 0x423733
push esi
push 0x209
push 0x4473d0
call fcn.004315c0
push dword [ebp - 0x10]
push 0x4477ba
push esi
call fcn.00430a6a
add esp, 0xc
jmp 0x423765
xor ecx, ecx
cmp eax, edi
setne cl
lea esi, [ecx - 0x7ff8f9be]
push esi
push 0x1fe
push 0x4473d0
call fcn.004315c0
push 0x447784
jmp 0x42374e
push dword [ebp - 4]
push 0x447754
jmp 0x4236fa
mov eax, dword [ebx + 0xc]
cmp eax, 2
jne 0x423758
push dword [ebx + 8]
call fcn.00427b64
mov esi, eax
test esi, esi
jns 0x423765
push 0x44771e
push esi
call fcn.00430a6a
pop ecx
pop ecx
jmp 0x423765
cmp eax, 1
jne 0x423765
push dword [ebx + 8]
call fcn.00427c4e
xor edi, edi
cmp dword [ebp - 0x14], edi
je 0x423774
push dword [ebp - 0x14]
call fcn.0042eb62
cmp dword [ebp - 0x18], edi
je 0x423781
push dword [ebp - 0x18]
call fcn.0042eb62
cmp dword [ebp - 0x1c], edi
je 0x42378e
push dword [ebp - 0x1c]
call fcn.0042eb62
cmp dword [ebp - 4], edi
je 0x42379b
push dword [ebp - 4]
call fcn.0042eb62
cmp dword [ebp - 8], edi
je 0x4237a8
push dword [ebp - 8]
call fcn.0042eb62
cmp dword [ebp - 0xc], edi
je 0x4237b5
push dword [ebp - 0xc]
call fcn.0042eb62
cmp dword [ebp - 0x28], edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4237c9
push dword [ebp - 0x28]
call edi
and dword [ebp - 0x28], 0
cmp dword [ebp - 0x2c], 0
je 0x4237d4
push dword [ebp - 0x2c]
call edi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18