Function at 0x3000265a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push esi
push edi
push dword [ebp + 0xc]
call fcn.30001ca8
mov edi, eax
mov eax, dword [ebp + 0x18]
xor esi, esi
mov dword [ebp - 0x18], edi
cmp eax, esi
je 0x3000268c
cmp word [eax], si
je 0x3000268c
push eax
call fcn.30001ca8
mov ecx, eax
inc ecx
inc ecx
mov dword [ebp - 8], ecx
jmp 0x30002691
mov dword [ebp - 8], esi
mov ecx, esi
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], esi
cmp eax, esi
je 0x300026ad
mov dword [ebp - 0x1c], 1
cmp word [eax], si
jne 0x300026b0
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, 0x7d00
mov dword [ebp - 0xc], esi
cmp edi, eax
ja 0x300028d1
mov edx, dword [ebp + 0x14]
cmp edx, eax
ja 0x300028d1
cmp ecx, eax
ja 0x300028d1
add ecx, edi
lea edi, [ecx + edx + 4]
mov dword [ebp - 0x20], edi
cmp edi, 0x3fffffff
jae 0x300028d1
push ebx
lea eax, [edi + edi + 2]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
cmp ebx, esi
je 0x300028d0
push 0x44
pop esi
push esi
lea eax, [ebp - 0x78]
push eax
call fcn.30001e9d
xor eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov word [ebp - 0x48], ax
lea eax, [edi + 1]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x78], esi
push ebx
call fcn.300020c8
push 0x3000164c
push ebx
call fcn.30001ff6
mov esi, eax
test esi, esi
jne 0x30002765
push 0x30001644
push ebx
call fcn.30001ff6
mov esi, eax
test esi, esi
jne 0x30002765
mov eax, dword [ebp - 0x18]
lea esi, [ebx + eax*2]
cmp word [esi - 2], 0x20
je 0x30002775
push 0x20
pop eax
mov word [esi], ax
inc esi
inc esi
jmp 0x30002775
xor eax, eax
cmp word [esi], 0x22
sete al
lea eax, [eax + eax + 2]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], 0
je 0x300027f1
mov eax, dword [ebp + 0x14]
add eax, 8
push eax
push dword [ebp + 0x18]
call fcn.30002148
mov dword [ebp - 4], eax
test eax, eax
je 0x300027f1
mov eax, dword [ebp + 0x18]
cmp word [eax], 0x22
jne 0x300027ae
mov ecx, dword [ebp - 8]
cmp word [eax + ecx*2 - 6], 0x22
jne 0x300027ae
mov dword [ebp - 0xc], 1
jmp 0x300027b2
and dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x300027eb
mov ecx, dword [ebp - 8]
lea edi, [ecx + eax + 4]
push edi
push 0x3000163c
push dword [ebp - 4]
call fcn.30002113
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.30002113
push edi
push 0x30001638
push dword [ebp - 4]
call fcn.30002113
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push esi
push edi
push dword [ebp - 0x18]
push ebx
call fcn.3000256c
test eax, eax
je 0x300028bc
push ebx
call fcn.30001ca8
lea eax, [ebx + eax*2]
jmp 0x30002826
add eax, 0xfffffffe
cmp word [eax], 0x20
jne 0x3000282a
xor ecx, ecx
mov word [eax], cx
cmp eax, ebx
ja 0x30002818
cmp dword [ebp - 0x1c], 0
je 0x30002876
mov edi, dword [ebp + 0x1c]
jmp 0x30002872
cmp word [edi], 0
je 0x30002876
push 0x20
push edi
call fcn.30001e37
mov esi, eax
sub esi, edi
sar esi, 1
test esi, esi
jle 0x30002876
push 0
push 0
push esi
push edi
push ebx
call fcn.30001ff6
push eax
push dword [ebp - 0x20]
push ebx
call fcn.30001ca8
push eax
push ebx
call fcn.3000256c
test eax, eax
je 0x300028bc
lea edi, [edi + esi*2 + 2]
test edi, edi
jne 0x30002835
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
xor esi, esi
cmp dword [ebp + 8], esi
je 0x300028bc
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
push esi
push 0x400
push esi
push esi
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, esi
je 0x300028bc
push dword [ebp - 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x30]
call esi
mov dword [ebp - 0x24], 1
push ebx
call fcn.3000367a
cmp dword [ebp - 4], 0
je 0x300028d0
push dword [ebp - 4]
call fcn.3000367a
pop ebx
mov eax, dword [ebp - 0x24]
pop edi
pop esi
leave
ret 0x1c