Function at 0x76bd84
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x43
push 0
push 0
dec ecx
jne 0x76bd8c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x76cd19
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
xor edx, edx
call fcn.005fe7d0
mov edx, dword [0x5f83e4]
call fcn.0040844c
mov ebx, eax
test ebx, ebx
je 0x76cce1
mov edx, 0x76cd34
mov eax, ebx
call fcn.005fe9c0
call fcn.005fda5c
mov edx, dword [0x5f9544]
call fcn.0040844c
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x76cce1
mov eax, dword [ebp - 0x3c]
call fcn.005ffe90
dec eax
test eax, eax
jl 0x76cce1
inc eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x40], 0
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
call fcn.005ffe88
mov edx, dword [0x5f83e4]
call fcn.0040844c
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x76ccd5
xor edx, edx
push ebp
push 0x76be8f
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x76cd54
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
lea edx, [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx - 0x24]
movzx eax, byte [0x76cd78]
push eax
lea eax, [ebp - 0xb4]
push eax
xor ecx, ecx
mov edx, 0x76cd88
mov eax, dword [ebp - 0x28]
call fcn.0042a640
mov edx, dword [ebp - 0xb4]
lea eax, [ebp - 0x28]
call fcn.0040a33c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x76bead
xor ecx, ecx
push ebp
push 0x76ccb8
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov edx, 0x76cd98
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
lea edx, [ebp - 0xb8]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0xb8]
lea edx, [ebp - 0xc]
call fcn.00779024
mov edx, 0x76cdac
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
lea edx, [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x14]
cmp word [eax], 0x22
jne 0x76bf1b
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, 1
call fcn.0040af58
mov edx, dword [ebp - 0x14]
mov eax, edx
test eax, eax
je 0x76bf29
sub eax, 4
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
cmp word [ecx + eax*2 - 2], 0x22
jne 0x76bf4d
mov eax, edx
test eax, eax
je 0x76bf3f
sub eax, 4
mov eax, dword [eax]
lea edx, [ebp - 0x14]
mov ecx, 1
xchg edx, eax
call fcn.0040af58
lea edx, [ebp - 0xbc]
mov eax, dword [ebp - 0x14]
call fcn.00778fd8
mov edx, dword [ebp - 0xbc]
lea eax, [ebp - 0x14]
call fcn.0040a33c
lea eax, [ebp - 0x10]
call fcn.00778f9c
lea eax, [ebp - 0x5c]
push eax
call sub.ole32.dll_CoCreateGuid
push dword [ebp - 0x10]
lea edx, [ebp - 0xc0]
lea eax, [ebp - 0x5c]
call fcn.00779088
push dword [ebp - 0xc0]
push 0x76cdcc
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040ae28
mov eax, dword [ebp - 0x10]
call fcn.00423158
cmp dword [ebp - 0x28], 0
je 0x76bfbe
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x28]
call fcn.0040ad48
jmp 0x76bfe7
push dword [ebp - 0x10]
lea edx, [ebp - 0xc4]
lea eax, [ebp - 0x5c]
call fcn.00779088
push dword [ebp - 0xc4]
push 0x76cddc
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040ae28
lea edx, [ebp - 0xc8]
mov eax, dword [ebp - 0x10]
call fcn.00423520
mov eax, dword [ebp - 0xc8]
mov edx, 0x76cddc
call fcn.0040aed8
je 0x76c014
lea eax, [ebp - 0x10]
mov edx, 0x76cddc
call fcn.0040ad48
lea ecx, [ebp - 0xd0]
mov edx, 5
mov eax, dword [ebp - 0xc]
call fcn.0043d3b4
mov eax, dword [ebp - 0xd0]
lea edx, [ebp - 0xcc]
call fcn.004219b8
mov eax, dword [ebp - 0xcc]
mov edx, 0x76cdf4
call fcn.0040aed8
je 0x76c3e7
xor eax, eax
push ebp
push 0x76c289
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.007726ac
mov eax, dword [ebp - 0x24]
mov edx, 0x76ce0c
call fcn.0040aed8
je 0x76c144
mov dword [ebp - 0x44], 1
lea eax, [ebp - 0xd4]
push eax
push dword [ebp - 0x24]
push 0x76ce28
mov edx, 0x76ce84
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
lea edx, [ebp - 0xe0]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0xe0]
lea edx, [ebp - 0xdc]
call fcn.00779024
push dword [ebp - 0xdc]
push 0x76ce98
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x44]
call fcn.004226e4
push dword [ebp - 0xe4]
push 0x76ceac
lea eax, [ebp - 0xd8]
mov edx, 6
call fcn.0040ae28
mov edx, dword [ebp - 0xd8]
mov eax, dword [0x79e378]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0xc]
call fcn.006e9838
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.007726ac
mov eax, dword [ebp - 0x24]
mov edx, 0x76ce0c
call fcn.0040aed8
je 0x76c144
imul eax, dword [ebp - 0x44], 0x2710
push eax
call sub.kernel32.dll_Sleep_1
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x1f
jne 0x76c084
mov eax, dword [ebp - 0x24]
mov edx, 0x76ce0c
call fcn.0040aed8
je 0x76c27c
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0x24]
push 0x76cec8
mov edx, 0x76ce84
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
lea edx, [ebp - 0xf4]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0xf4]
lea edx, [ebp - 0xf0]
call fcn.00779024
push dword [ebp - 0xf0]
push 0x76ce98
lea eax, [ebp - 0xec]
mov edx, 4
call fcn.0040ae28
mov edx, dword [ebp - 0xec]
mov eax, dword [0x79e378]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0xc]
call fcn.006e9838
lea eax, [ebp - 0xfc]
mov ecx, 0x76cf48
mov edx, dword [ebp - 0x24]
call fcn.0040ada0
mov eax, dword [ebp - 0xfc]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0xf8]
push eax
mov edx, 0x76ce84
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
lea edx, [ebp - 0x100]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov edx, dword [ebp - 0x100]
mov eax, dword [0x79e378]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, 0x76cfa4
call fcn.006e9d08
push ebp
mov edx, 0x76ce84
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
lea edx, [ebp - 0x108]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x108]
lea edx, [ebp - 0x104]
call fcn.00779024
mov eax, dword [ebp - 0x104]
call fcn.00422954
call fcn.0076bb88
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x76ccd5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x76c3e7
lea ecx, [ebp - 0x138]
mov edx, 5
mov eax, dword [ebp - 0xc]
call fcn.0043d3b4
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004219b8
mov eax, dword [ebp - 0x134]
mov edx, 0x76cdf4
call fcn.0040aed8
jne 0x76c7bf
xor eax, eax
push ebp
push 0x76c65c
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00772d10
mov eax, dword [ebp - 0x20]
mov edx, 0x76ce0c
call fcn.0040aed8
je 0x76c517
mov dword [ebp - 0x44], 1
lea eax, [ebp - 0x13c]
push eax
push dword [ebp - 0x20]
push 0x76ce28
mov edx, 0x76ce84
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
lea edx, [ebp - 0x148]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.00779024
push dword [ebp - 0x144]
push 0x76ce98
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 0x44]
call fcn.004226e4
push dword [ebp - 0x14c]
push 0x76ceac
lea eax, [ebp - 0x140]
mov edx, 6
call fcn.0040ae28
mov edx, dword [ebp - 0x140]
mov eax, dword [0x79e378]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0xc]
call fcn.006e9838
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00772d10
mov eax, dword [ebp - 0x20]
mov edx, 0x76ce0c
call fcn.0040aed8
je 0x76c517
imul eax, dword [ebp - 0x44], 0x2710
push eax
call sub.kernel32.dll_Sleep_1
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x1f
jne 0x76c457
mov eax, dword [ebp - 0x20]
mov edx, 0x76ce0c
call fcn.0040aed8
je 0x76c64f
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x20]
push 0x76cec8
mov edx, 0x76ce84
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
lea edx, [ebp - 0x15c]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 0x158]
call fcn.00779024
push dword [ebp - 0x158]
push 0x76ce98
lea eax, [ebp - 0x154]
mov edx, 4
call fcn.0040ae28
mov edx, dword [ebp - 0x154]
mov eax, dword [0x79e378]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0xc]
call fcn.006e9838
lea eax, [ebp - 0x164]
mov ecx, 0x76cf48
mov edx, dword [ebp - 0x20]
call fcn.0040ada0
mov eax, dword [ebp - 0x164]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x160]
push eax
mov edx, 0x76ce84
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
lea edx, [ebp - 0x168]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov edx, dword [ebp - 0x168]
mov eax, dword [0x79e378]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, 0x76cfa4
call fcn.006e9d08
push ebp
mov edx, 0x76ce84
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
lea edx, [ebp - 0x170]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x170]
lea edx, [ebp - 0x16c]
call fcn.00779024
mov eax, dword [ebp - 0x16c]
call fcn.00422954
call fcn.0076bb88
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x76ccd5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x76c7bf
push 0
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x10]
call fcn.00770e40
mov eax, dword [ebp - 0x1a0]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00770de4
push edx
push eax
lea eax, [ebp - 0x1a4]
call fcn.0042270c
mov eax, dword [ebp - 0x1a4]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x19c]
push eax
mov edx, 0x76ce84
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
lea edx, [ebp - 0x1a8]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x1a8]
push eax
push 0x76d1c4
lea edx, [ebp - 0x1b0]
mov eax, dword [ebp - 0x44]
call fcn.004226e4
push dword [ebp - 0x1b0]
push 0x76d1d8
lea eax, [ebp - 0x1ac]
mov edx, 3
call fcn.0040ae28
mov ecx, dword [ebp - 0x1ac]
mov eax, dword [0x79e378]
mov eax, dword [eax]
mov eax, dword [eax + 4]
pop edx
call fcn.006e9d08
push 0
call sub.ole32.dll_CoInitialize
push 5
lea edx, [ebp - 0x1b4]
mov eax, dword [ebp - 0x10]
call fcn.00423480
mov eax, dword [ebp - 0x1b4]
call fcn.0040ab34
push eax
mov eax, dword [ebp - 0x14]
call fcn.0040ab34
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040ab34
push eax
push 0x76d1dc
push 0
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
call sub.ole32.dll_CoUninitialize
cmp ebx, 0x20
jge 0x76c9f3
push ebp
mov edx, 0x76ce84
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
lea edx, [ebp - 0x1bc]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x1bc]
lea edx, [ebp - 0x1b8]
call fcn.00779024
mov eax, dword [ebp - 0x1b8]
call fcn.00422954
call fcn.0076bb88
pop ecx
lea edx, [ebp - 0x1c8]
mov eax, ebx
call fcn.004226e4
mov ecx, dword [ebp - 0x1c8]
lea eax, [ebp - 0x1c4]
mov edx, 0x76d1f4
call fcn.0040ada0
mov eax, dword [ebp - 0x1c4]
push eax
lea eax, [ebp - 0x1c0]
push eax
mov edx, 0x76ce84
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
lea edx, [ebp - 0x1d0]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x1d0]
lea edx, [ebp - 0x1cc]
call fcn.00779024
mov edx, dword [ebp - 0x1cc]
mov eax, dword [0x79e378]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, 0x76cfa4
call fcn.006ea06c
lea eax, [ebp - 0x1d4]
push eax
push 0x76d268
mov edx, 0x76ce84
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
lea edx, [ebp - 0x1e0]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x1e0]
lea edx, [ebp - 0x1dc]
call fcn.00779024
push dword [ebp - 0x1dc]
push 0x76d2ac
lea edx, [ebp - 0x1e4]
mov eax, ebx
call fcn.004226e4
push dword [ebp - 0x1e4]
lea eax, [ebp - 0x1d8]
mov edx, 4
call fcn.0040ae28
mov edx, dword [ebp - 0x1d8]
mov eax, dword [0x79e378]
mov eax, dword [eax]
mov eax, dword [eax + 4]
xor ecx, ecx
call fcn.006e9838
jmp 0x76ccae
mov edx, 0x76ce84
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
lea edx, [ebp - 0x1ec]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov edx, dword [ebp - 0x1ec]
lea ecx, [ebp - 0x1e8]
mov eax, dword [0x79e378]
mov eax, dword [eax]
mov eax, dword [eax + 4]
call fcn.006e9310
push 0
lea eax, [ebp - 0x1f0]
push eax
mov edx, 0x76ce84
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
lea edx, [ebp - 0x1f8]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x1f8]
lea edx, [ebp - 0x1f4]
call fcn.00779024
mov edx, dword [ebp - 0x1f4]
mov eax, dword [0x79e378]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, 0x76d2c0
call fcn.006ea06c
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0076db1c
test al, al
je 0x76cb1d
mov edx, 0x76ce84
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
lea edx, [ebp - 0x200]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov edx, dword [ebp - 0x200]
lea ecx, [ebp - 0x1fc]
mov eax, dword [0x79e378]
mov eax, dword [eax]
mov eax, dword [eax + 4]
call fcn.006e95a4
mov eax, dword [0x79f1f0]
cmp dword [eax], 0
je 0x76cadd
mov eax, dword [0x79f1f0]
mov eax, dword [eax]
call fcn.0077211c
push ebp
mov edx, 0x76ce84
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
lea edx, [ebp - 0x208]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x208]
lea edx, [ebp - 0x204]
call fcn.00779024
mov eax, dword [ebp - 0x204]
call fcn.00422954
call fcn.0076bb88
pop ecx
mov eax, dword [0x79f134]
cmp byte [eax], 0
jne 0x76ccae
xor edx, edx
push ebp
push 0x76cbf7
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x18]
call fcn.00409f14
mov edx, 0x76d2d4
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
mov edx, dword [0x5f9544]
call fcn.0040844c
mov edi, eax
mov eax, edi
call fcn.005ffe90
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x76cbdf
inc ebx
xor esi, esi
cmp dword [ebp - 0x18], 0
jne 0x76cb9b
mov edx, esi
mov eax, edi
call fcn.005ffe88
lea edx, [ebp - 0x20c]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x20c]
lea edx, [ebp - 0x18]
call fcn.00779024
jmp 0x76cbdb
push dword [ebp - 0x18]
push 0x76d2f8
mov edx, esi
mov eax, edi
call fcn.005ffe88
lea edx, [ebp - 0x214]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x210]
call fcn.00779024
push dword [ebp - 0x210]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040ae28
inc esi
dec ebx
jne 0x76cb71
cmp dword [ebp - 0x18], 0
je 0x76cbed
mov eax, dword [ebp - 0x18]
call fcn.00775b1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x76cc1f
xor edx, edx
push ebp
push 0x76cc89
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x1c]
call fcn.00409f14
mov edx, 0x76d308
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
test eax, eax
jne 0x76cc71
mov edx, 0x76ce84
mov eax, dword [ebp - 0x38]
call fcn.005fe9c0
call fcn.005fda5c
lea edx, [ebp - 0x218]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0x218]
lea edx, [ebp - 0x1c]
call fcn.00779024
cmp dword [ebp - 0x1c], 0
je 0x76cc7f
mov eax, dword [ebp - 0x1c]
call fcn.00775e70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x76ccae
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x76ccd5
inc dword [ebp - 0x40]
dec dword [ebp - 0x4c]
jne 0x76be0e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x76cd20
lea eax, [ebp - 0x218]
mov edx, 0x5a
call fcn.00409f74
lea eax, [ebp - 0x2c]
mov edx, 0xa
call fcn.00409f74
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00409f74
ret