Function at 0x430d0c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1b
push 0
push 0
dec ecx
jne 0x430d14
push ecx
push ebx
xor eax, eax
push ebp
push 0x4315f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x431608
call fcn.00421c08
mov byte [ebp - 1], 0
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x436f6c]
call fcn.00405708
mov edx, 0x43162c
call fcn.00404d78
call fcn.004032e4
call fcn.0042da58
test al, al
je 0x431571
lea eax, [ebp - 0x24]
call fcn.0042cb30
cmp dword [ebp - 0x24], 0
je 0x431571
lea eax, [ebp - 0x28]
call fcn.0042cbb4
cmp dword [ebp - 0x28], 0
je 0x431571
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x436f6c]
call fcn.00405708
mov edx, 0x431654
call fcn.00404d78
call fcn.004032e4
mov bl, 1
lea ecx, [ebp - 8]
xor edx, edx
mov eax, 0x43167c
call fcn.0042c30c
call fcn.0042ce90
test al, al
je 0x430dd9
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, 0x431688
call fcn.0042c30c
jmp 0x430de8
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, 0x431694
call fcn.0042c30c
call fcn.0042cdac
test al, al
je 0x430e1a
call fcn.0042ce90
test al, al
je 0x430e0b
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, 0x4316a0
call fcn.0042c30c
jmp 0x430e1a
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, 0x4316ac
call fcn.0042c30c
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
call fcn.0042d3bc
mov eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004049a8
mov eax, dword [ebp - 0x34]
mov edx, 0x4316b8
pop ecx
call fcn.004140e8
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 8]
call fcn.00404734
call fcn.0042cccc
test al, al
je 0x430eda
mov eax, dword [0x437070]
cmp dword [eax], 1
je 0x430eda
mov bl, 1
call fcn.0042cdac
test al, al
je 0x430ea1
lea eax, [ebp - 0x38]
call fcn.0042bf70
mov eax, dword [ebp - 0x38]
push eax
call fcn.0042c18c
push eax
push 0
lea eax, [ebp - 0x3c]
call fcn.0042c110
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 8]
mov eax, 2
call fcn.004136d4
jmp 0x430ecc
lea eax, [ebp - 0x40]
call fcn.0042bf70
mov eax, dword [ebp - 0x40]
push eax
call fcn.0042c18c
push eax
push 0
lea eax, [ebp - 0x44]
call fcn.0042c098
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 8]
xor eax, eax
call fcn.00413768
mov ebx, eax
push 0
push 0x1f4
xor eax, eax
call fcn.00413234
test bl, bl
je 0x431571
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x436f6c]
call fcn.00405708
mov edx, 0x4316cc
call fcn.00404d78
call fcn.004032e4
mov eax, 2
call fcn.0042db00
mov edx, 1
mov eax, 0x29
call fcn.00421ce8
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x48]
call fcn.0042cbb4
mov eax, dword [ebp - 0x48]
push eax
lea eax, [ebp - 0x4c]
call fcn.0042cb30
mov eax, dword [ebp - 0x4c]
mov cl, 2
pop edx
call fcn.004302fc
mov ebx, eax
mov edx, 2
mov eax, 0x29
call fcn.00421ce8
lea ecx, [ebp - 8]
xor edx, edx
mov eax, 0x4316f4
call fcn.0042c30c
call fcn.0042cf70
test al, al
je 0x430f78
lea ecx, [ebp - 8]
xor edx, edx
mov eax, 0x431700
call fcn.0042c30c
push 0
push 0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x54]
call fcn.0042d3bc
mov ecx, dword [ebp - 0x54]
mov edx, 0x4316b8
mov eax, dword [ebp - 8]
call fcn.004140e8
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 8]
call fcn.00404734
test bl, bl
je 0x43102d
call fcn.0042ce90
test al, al
je 0x43102d
mov eax, dword [0x437070]
cmp dword [eax], 1
je 0x43102d
mov bl, 1
call fcn.0042cf70
test al, al
je 0x430ff7
lea eax, [ebp - 0x58]
call fcn.0042bf70
mov eax, dword [ebp - 0x58]
push eax
call fcn.0042c18c
push eax
push 0
lea eax, [ebp - 0x5c]
call fcn.0042c110
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 8]
mov eax, 2
call fcn.004136d4
jmp 0x431022
lea eax, [ebp - 0x60]
call fcn.0042bf70
mov eax, dword [ebp - 0x60]
push eax
call fcn.0042c18c
push eax
push 0
lea eax, [ebp - 0x64]
call fcn.0042c098
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 8]
xor eax, eax
call fcn.00413768
mov ebx, eax
push 0
push 0x64
xor eax, eax
call fcn.00413234
test bl, bl
je 0x431571
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x436f6c]
call fcn.00405708
mov edx, 0x43170c
call fcn.00404d78
call fcn.004032e4
lea eax, [ebp - 0x68]
call fcn.0042bd6c
mov eax, dword [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
call fcn.0042bcf0
mov eax, dword [ebp - 0x6c]
push eax
lea eax, [ebp - 0x70]
call fcn.0042bc74
mov eax, dword [ebp - 0x70]
pop edx
pop ecx
call fcn.00428688
xor ebx, ebx
push 1
push 1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x74]
call fcn.0042d33c
mov eax, dword [ebp - 0x74]
mov cl, 1
mov edx, 0x431734
call fcn.00428f1c
mov eax, dword [ebp - 0x18]
call fcn.004191fc
test al, al
je 0x4310b3
mov ebx, 1
push 0x431740
push dword [ebp - 0x18]
push 0x431768
lea eax, [ebp - 0x7c]
call fcn.0042d124
push dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
mov edx, 4
call fcn.00404a1c
mov eax, dword [ebp - 0x78]
call fcn.00421c08
lea eax, [ebp - 0x80]
call fcn.0042d124
mov eax, dword [ebp - 0x80]
mov edx, 0x43177c
call fcn.00404aa8
jne 0x4311aa
lea ecx, [ebp - 8]
xor edx, edx
mov eax, 0x431798
call fcn.0042c30c
push 0
push 0
lea eax, [ebp - 0x84]
push eax
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 0x18]
call fcn.00408a9c
mov ecx, dword [ebp - 0x88]
mov edx, 0x4316b8
mov eax, dword [ebp - 8]
call fcn.004140e8
mov edx, dword [ebp - 0x84]
lea eax, [ebp - 8]
call fcn.00404734
mov eax, dword [0x436f6c]
mov edx, 0x4317a4
call fcn.00404d78
mov edx, dword [ebp - 8]
call fcn.00404d78
mov dl, 0x3c
call fcn.004031e4
call fcn.004032e4
jmp 0x43119e
lea eax, [ebp - 0x8c]
call fcn.0042bf70
mov eax, dword [ebp - 0x8c]
push eax
call fcn.0042c18c
push eax
push 0
lea eax, [ebp - 0x90]
call fcn.0042c110
mov ecx, dword [ebp - 0x90]
mov edx, dword [ebp - 8]
xor eax, eax
call fcn.004136d4
mov eax, dword [ebp - 0x18]
call fcn.004191fc
test al, al
jne 0x431169
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x436f6c]
call fcn.00405708
mov edx, 0x4317b0
call fcn.00404d78
call fcn.004032e4
lea eax, [ebp - 0x94]
call fcn.0042d124
mov eax, dword [ebp - 0x94]
mov edx, 0x4317d8
call fcn.00404aa8
jne 0x4311f5
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 0x18]
call fcn.00419690
lea eax, [ebp - 0x98]
call fcn.0042d124
mov eax, dword [ebp - 0x98]
mov edx, 0x4317f0
call fcn.00404aa8
jne 0x43121c
mov dl, 1
mov eax, dword [ebp - 0x18]
call fcn.00419700
lea eax, [ebp - 0x9c]
call fcn.0042d124
mov eax, dword [ebp - 0x9c]
mov edx, 0x431808
call fcn.00404aa8
jne 0x431243
mov dl, 1
mov eax, dword [ebp - 0x18]
call fcn.0041975c
lea eax, [ebp - 0xa0]
call fcn.0042d124
mov eax, dword [ebp - 0xa0]
mov edx, 0x431828
call fcn.00404aa8
je 0x43126a
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004192ac
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x436f6c]
call fcn.00405708
mov edx, 0x431840
call fcn.00404d78
call fcn.004032e4
mov eax, 0x431868
call fcn.00421c08
cmp ebx, 1
jne 0x4312ac
mov eax, dword [ebp - 0x18]
call fcn.004191fc
test al, al
jne 0x4312ac
mov ebx, 2
call fcn.0042d1a4
test al, al
je 0x4312ba
cmp ebx, 2
je 0x4312be
xor eax, eax
jmp 0x4312c0
mov al, 1
mov byte [ebp - 0x1d], al
lea edx, [ebp - 0xa4]
mov al, 1
call fcn.004148c4
mov eax, dword [ebp - 0xa4]
push eax
lea eax, [ebp - 0xa8]
call fcn.0042cbb4
mov ecx, dword [ebp - 0xa8]
lea eax, [ebp - 0x14]
pop edx
call fcn.004049a8
push 0x43188c
lea eax, [ebp - 0xac]
call fcn.0042cac8
push dword [ebp - 0xac]
push 0x4318a8
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404a1c
mov eax, 3
call fcn.0042db00
mov edx, 1
mov eax, 0x2a
call fcn.00421ce8
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x436f6c]
call fcn.00405708
mov edx, 0x4318b4
call fcn.00404d78
call fcn.004032e4
mov eax, dword [ebp - 0x10]
push eax
call fcn.0042d054
xor al, 1
push eax
lea edx, [ebp - 0xb0]
mov eax, dword [0x436fa8]
mov eax, dword [eax]
call fcn.00425ef0
mov eax, dword [ebp - 0xb0]
push eax
lea eax, [ebp - 0xb4]
call fcn.0042b460
mov eax, dword [ebp - 0xb4]
mov edx, dword [ebp - 0x14]
pop ecx
call fcn.0042e298
mov byte [ebp - 1], al
lea eax, [ebp - 0xb8]
call fcn.0042b460
mov eax, dword [ebp - 0xb8]
xor ecx, ecx
xor edx, edx
call fcn.004176ec
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x436f6c]
call fcn.00405708
mov edx, 0x4318dc
call fcn.00404d78
call fcn.004032e4
mov edx, 2
mov eax, 0x2a
call fcn.00421ce8
cmp byte [ebp - 1], 0
je 0x4313f1
call fcn.0042d438
call fcn.0042c6b8
mov eax, dword [ebp - 0x14]
call fcn.004088f4
lea ecx, [ebp - 8]
xor edx, edx
mov eax, 0x431904
call fcn.0042c30c
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, 0x431910
call fcn.0042c30c
push 0
push 0
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0xc0]
call fcn.0042d3bc
mov ecx, dword [ebp - 0xc0]
mov edx, 0x4316b8
mov eax, dword [ebp - 8]
call fcn.004140e8
mov edx, dword [ebp - 0xbc]
lea eax, [ebp - 8]
call fcn.00404734
mov bl, 1
cmp byte [ebp - 1], 0
je 0x431501
call fcn.0042d270
test al, al
jne 0x431471
mov eax, dword [0x437070]
cmp dword [eax], 1
jne 0x431501
cmp byte [ebp - 0x1d], 0
je 0x4314c9
lea eax, [ebp - 0xc4]
call fcn.0042bf70
mov eax, dword [ebp - 0xc4]
push eax
call fcn.0042c18c
push eax
push 0
lea eax, [ebp - 0xc8]
call fcn.0042c098
mov eax, dword [ebp - 0xc8]
push eax
lea eax, [ebp - 0xcc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004049a8
mov edx, dword [ebp - 0xcc]
mov eax, 1
pop ecx
call fcn.00413768
mov ebx, eax
jmp 0x431501
lea eax, [ebp - 0xd0]
call fcn.0042bf70
mov eax, dword [ebp - 0xd0]
push eax
call fcn.0042c18c
push eax
push 0
lea eax, [ebp - 0xd4]
call fcn.0042c110
mov ecx, dword [ebp - 0xd4]
mov edx, dword [ebp - 8]
mov eax, 1
call fcn.004136d4
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x436f6c]
call fcn.00405708
mov edx, 0x43191c
call fcn.00404d78
call fcn.004032e4
mov eax, dword [0x436f6c]
mov dl, byte [ebp - 0x1d]
call fcn.00403234
mov dl, 0x20
call fcn.004031e4
mov edx, ebx
call fcn.00403234
mov edx, 0x431944
call fcn.00404d78
mov edx, dword [ebp - 0x18]
call fcn.00404d78
mov dl, 0x3c
call fcn.004031e4
call fcn.004032e4
test byte [ebp - 0x1d], bl
je 0x431571
push 5
mov eax, dword [ebp - 0x18]
call fcn.00404b5c
push eax
call sub.kernel32.dll_WinExec
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x436f6c]
call fcn.00405708
mov edx, 0x431950
call fcn.00404d78
call fcn.004032e4
lea edx, [ebp - 0xdc]
cmp byte [ebp - 1], 1
cmc
sbb eax, eax
call fcn.004142a0
mov ecx, dword [ebp - 0xdc]
lea eax, [ebp - 0xd8]
mov edx, 0x431978
call fcn.004049a8
mov eax, dword [ebp - 0xd8]
call fcn.00421c08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4315f8
lea eax, [ebp - 0xdc]
mov edx, 0x2f
call fcn.004046c0
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.004046c0
ret