Function at 0x4045d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x90
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
mov dword [esp + 4], 1
lea eax, [ebp - 0x18]
mov dword [esp], eax
call dbg.pipe_create
test eax, eax
je 0x404606
mov eax, 0xffffffff
jmp 0x4047f6
mov dword [esp + 4], 0
lea eax, [ebp - 0x20]
mov dword [esp], eax
call dbg.pipe_create
test eax, eax
je 0x404632
lea eax, [ebp - 0x18]
mov dword [esp], eax
call dbg.pipe_close
mov eax, 0xffffffff
jmp 0x4047f6
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov ebx, eax
mov esi, dword [ebp - 0x1c]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
je 0x4047cf
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x64]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], 0x100
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x64]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40479a
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
lea edx, [eax + 4]
mov eax, dword [ebp - 0x14]
mov dword [edx], eax
mov eax, 0
jmp 0x4047f6
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
sub eax, 2
cmp eax, 1
ja 0x4047b1
mov eax, dword [ebp + 0x14]
mov byte [eax], 7
jmp 0x4047bd
mov dword [esp], str.CreateProcess
call dbg.syserror
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
jmp 0x4047db
mov dword [esp], str.DuplicateHandle
call dbg.syserror
lea eax, [ebp - 0x20]
mov dword [esp], eax
call dbg.pipe_close
lea eax, [ebp - 0x18]
mov dword [esp], eax
call dbg.pipe_close
mov eax, 0xffffffff
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret