Function at 0x77c0f290
Capabilities:
Create process on windows

Disassembly:
push 0xa4
push 0x77be44d0
call fcn.77c07420
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x34], edi
cmp dword [ebp + 8], edi
je 0x77c0f6c6
mov esi, dword [ebp + 0xc]
cmp esi, edi
je 0x77c0f6c6
mov al, byte [esi]
cmp al, 0x77
je 0x77c0f2cb
cmp al, 0x72
jne 0x77c0f6c6
mov al, byte [esi + 1]
cmp al, 0x74
jne 0x77c0f2d9
mov ecx, 0x4000
jmp 0x77c0f2e2
cmp al, 0x62
jne 0x77c0f2e2
mov ecx, 0x8000
or ecx, 0x80
push ecx
push 0x400
lea eax, [ebp - 0x40]
push eax
call sym.msvcrt.dll__pipe
add esp, 0xc
cmp eax, 0xffffffff
je 0x77c0f6c6
xor ebx, ebx
cmp byte [esi], 0x77
jne 0x77c0f316
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], edi
inc ebx
mov dword [ebp - 0x28], ebx
jmp 0x77c0f323
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edi
inc ebx
push 9
call fcn.77c0a535
pop ecx
test eax, eax
jne 0x77c0f348
push dword [ebp - 0x40]
call sym.msvcrt.dll__close
push dword [ebp - 0x3c]
call sym.msvcrt.dll__close
pop ecx
pop ecx
xor eax, eax
jmp 0x77c0f6c9
push 9
call sym.msvcrt.dll__lock
pop ecx
mov dword [ebp - 4], edi
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], ebx
call dword [sym.imp._CKERNEL.dll_GetCurrentProcess]
mov dword [ebp - 0x44], eax
mov esi, dword [ebp - 0x24]
lea esi, [ebp + esi*4 - 0x40]
mov eax, dword [esi]
push 2
push ebx
push edi
lea ecx, [ebp - 0x30]
push ecx
push dword [ebp - 0x44]
mov ecx, eax
sar ecx, 5
and eax, 0x1f
lea eax, [eax + eax*8]
mov ecx, dword [ecx*4 + sym.msvcrt.dll___pioinfo]
push dword [ecx + eax*4]
push dword [ebp - 0x44]
call dword [sym.imp._CKERNEL.dll_DuplicateHandle]
test eax, eax
je 0x77c0f691
push dword [esi]
call sym.msvcrt.dll__close
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x50], edi
push dword [ebp + 0xc]
mov eax, dword [ebp - 0x28]
push dword [ebp + eax*4 - 0x40]
call sym.msvcrt.dll__fdopen
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp eax, edi
je 0x77c0f691
xor edi, edi
call fcn.77c0f238
mov dword [ebp - 0x48], eax
test eax, eax
je 0x77c0f67a
push 0x77be1fac
call sym.msvcrt.dll_getenv
pop ecx
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x77c0f415
call sym.msvcrt.dll__errno
cmp dword [eax], 2
je 0x77c0f3ff
call sym.msvcrt.dll__errno
cmp dword [eax], 0xd
jne 0x77c0f415
test byte [0x77c31a19], 0x80
mov eax, 0x77be1f9c
jne 0x77c0f412
mov eax, 0x77be1f94
mov dword [ebp - 0x1c], eax
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0xb4]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xb4], 0x44
mov dword [ebp - 0x88], 0x100
mov eax, dword [sym.msvcrt.dll___pioinfo]
cmp dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0x30]
je 0x77c0f446
mov ecx, dword [eax]
mov dword [ebp - 0x7c], ecx
cmp dword [ebp - 0x2c], ebx
mov ecx, dword [ebp - 0x30]
je 0x77c0f454
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x78], ecx
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x1c]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x77c0f463
sub eax, ecx
mov ecx, eax
mov eax, dword [ebp + 8]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x77c0f474
sub eax, esi
lea eax, [eax + ecx + 5]
push eax
call sym.msvcrt.dll_malloc
pop ecx
mov ebx, eax
mov dword [ebp - 0x38], ebx
test ebx, ebx
je 0x77c0f67a
mov ecx, dword [ebp - 0x1c]
mov edx, ebx
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x77c0f49a
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x77c0f4a7
mov esi, 0x77be44c4
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 8]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c0f4bb
sub eax, esi
mov edi, ebx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x77c0f4c7
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor edi, edi
push edi
push dword [ebp - 0x1c]
call sym.msvcrt.dll__access
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x77c0f513
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0xb4]
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp._CKERNEL.dll_CreateProcessA]
mov dword [ebp - 0x34], eax
jmp 0x77c0f646
push 0x77be1f34
call sym.msvcrt.dll_getenv
mov dword [ebp - 0x54], eax
mov dword [esp], 0x104
call sym.msvcrt.dll_malloc
pop ecx
mov ebx, eax
mov dword [ebp - 0x5c], ebx
test ebx, ebx
jne 0x77c0f544
push dword [ebp - 0x38]
call sym.msvcrt.dll_free
pop ecx
jmp 0x77c0f67a
push 0x103
push ebx
push dword [ebp - 0x54]
call fcn.77c076ca
add esp, 0xc
mov dword [ebp - 0x54], eax
test eax, eax
je 0x77c0f63a
cmp byte [ebx], 0
je 0x77c0f63a
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c0f56e
sub eax, esi
lea esi, [eax + ebx - 1]
mov dword [ebp - 0x70], esi
mov al, byte [esi]
cmp al, 0x5c
jne 0x77c0f59f
push 0x5c
push ebx
call sym.msvcrt.dll__mbsrchr
pop ecx
pop ecx
cmp esi, eax
je 0x77c0f5b5
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x77c0f595
jmp 0x77c0f5ae
cmp al, 0x2f
je 0x77c0f5b5
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x77c0f5a6
mov esi, 0x77be1f30
movsw word es:[edi], word [esi]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c0f5ba
sub eax, edx
mov edi, eax
mov eax, dword [ebp - 0x1c]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c0f5cb
sub eax, esi
add eax, edi
cmp eax, 0x104
jae 0x77c0f63a
mov eax, dword [ebp - 0x1c]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c0f5e2
sub eax, edx
mov edi, ebx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x77c0f5ee
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
push ebx
call sym.msvcrt.dll__access
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x77c0f544
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0xb4]
push eax
xor eax, eax
push eax
push eax
push eax
push 1
push eax
push eax
push dword [ebp - 0x38]
push ebx
call dword [sym.imp._CKERNEL.dll_CreateProcessA]
mov dword [ebp - 0x34], eax
push ebx
call sym.msvcrt.dll_free
pop ecx
mov ebx, dword [ebp - 0x38]
xor edi, edi
push ebx
call sym.msvcrt.dll_free
pop ecx
push dword [ebp - 0x30]
mov esi, dword [sym.imp._CKERNEL.dll_CloseHandle]
call esi
push dword [ebp - 0x68]
call esi
cmp dword [ebp - 0x34], edi
je 0x77c0f675
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x48]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ecx], eax
jmp 0x77c0f6bd
mov eax, dword [ebp - 0x48]
mov dword [eax], edi
push dword [ebp - 0x20]
call sym.msvcrt.dll_fclose
pop ecx
mov eax, dword [ebp - 0x28]
and dword [ebp + eax*4 - 0x50], 0
and dword [ebp - 0x20], 0
xor edi, edi
mov eax, dword [ebp - 0x24]
shl eax, 2
cmp dword [ebp + eax - 0x50], edi
je 0x77c0f6a7
push dword [ebp + eax - 0x40]
call sym.msvcrt.dll__close
pop ecx
mov eax, dword [ebp - 0x28]
shl eax, 2
cmp dword [ebp + eax - 0x50], edi
je 0x77c0f6bd
push dword [ebp + eax - 0x40]
call sym.msvcrt.dll__close
pop ecx
or dword [ebp - 4], 0xffffffff
call fcn.77c0f6cf
mov eax, dword [ebp - 0x20]
call fcn.77c0745b
ret