Function at 0x426e40
Capabilities:
Create process on windows
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x6c]
push 0x44
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004af5b0
mov edi, dword [ebp + 0xc]
add esp, 0xc
mov eax, 0x79164c
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x40], 1
cmp byte [edi + 8], bl
cmove eax, dword [ebp - 0x64]
xor ecx, ecx
cmp byte [edi + 1], cl
mov dword [ebp - 0x64], eax
mov eax, 5
cmovne eax, ecx
mov word [ebp - 0x3c], ax
cmp dword [edi + 0x10], ecx
jne 0x426ea4
cmp dword [edi + 0x14], ecx
jne 0x426ea4
cmp dword [edi + 0x18], ecx
je 0x42702a
call fcn.00421550
cmp eax, 1
jne 0x426eea
call fcn.00421030
cmp eax, 3
jg 0x426eea
cmp byte [edi + 2], bl
jne 0x426eea
push 3
push 0x73
push str.processlaunch_win.cc
lea ecx, [ebp - 0x11c]
call fcn.004203c0
add eax, 8
push str.Check_failed:_options.inherit_handles.
push eax
call fcn.004169d0
mov ebx, 1
add esp, 8
mov dword [ebp - 4], ebx
test bl, 1
je 0x426f00
and ebx, 0xfffffffe
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], ebx
call fcn.004205f0
call fcn.00421550
cmp eax, 1
jne 0x426f45
call fcn.00421030
cmp eax, 3
jg 0x426f45
cmp dword [edi + 0x10], 0
jne 0x426f45
push 3
push 0x74
or ebx, 2
lea ecx, [ebp - 0x11c]
push str.processlaunch_win.cc
mov dword [ebp - 4], ebx
call fcn.004203c0
add eax, 8
push str.Check_failed:_options.stdin_handle.
push eax
call fcn.004169d0
add esp, 8
test bl, 2
je 0x426f5b
and ebx, 0xfffffffd
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], ebx
call fcn.004205f0
call fcn.00421550
cmp eax, 1
jne 0x426fa0
call fcn.00421030
cmp eax, 3
jg 0x426fa0
cmp dword [edi + 0x14], 0
jne 0x426fa0
push 3
push 0x75
or ebx, 4
lea ecx, [ebp - 0x11c]
push str.processlaunch_win.cc
mov dword [ebp - 4], ebx
call fcn.004203c0
add eax, 8
push str.Check_failed:_options.stdout_handle.
push eax
call fcn.004169d0
add esp, 8
test bl, 4
je 0x426fb6
and ebx, 0xfffffffb
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], ebx
call fcn.004205f0
call fcn.00421550
cmp eax, 1
jne 0x426ffb
call fcn.00421030
cmp eax, 3
jg 0x426ffb
cmp dword [edi + 0x18], 0
jne 0x426ffb
push 3
push 0x76
or ebx, 8
lea ecx, [ebp - 0x11c]
push str.processlaunch_win.cc
mov dword [ebp - 4], ebx
call fcn.004203c0
add eax, 8
push str.Check_failed:_options.stderr_handle.
push eax
call fcn.004169d0
add esp, 8
test bl, 8
je 0x427011
and ebx, 0xfffffff7
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], ebx
call fcn.004205f0
mov eax, dword [edi + 0x10]
or dword [ebp - 0x40], 0x100
mov dword [ebp - 0x34], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [edi + 0xc]
lea ecx, [ebp - 0x14]
neg eax
sbb eax, eax
and eax, 0x1000004
mov esi, eax
or esi, 0x1000000
cmp byte [edi + 0x1c], 0
cmove esi, eax
call fcn.00435f30
mov eax, dword [edi + 4]
test eax, eax
je 0x427118
push 0
push eax
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
or esi, 0x400
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x42709c
test bl, 0x10
je 0x4271ba
lea ecx, [ebp - 0x124]
call fcn.00420890
lea ecx, [ebp - 0x14]
xor bl, bl
call fcn.00435f50
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x14]
call fcn.00435f80
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 8
jb 0x4270b3
mov ecx, dword [ecx]
push eax
lea eax, [ebp - 0x6c]
push eax
movzx eax, byte [edi + 2]
push 0
push dword [ebp + 0xc]
push esi
push eax
push 0
push 0
push ecx
push 0
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ecx, dword [ebp - 0x18]
mov esi, eax
lea eax, [ebp - 0x28]
push eax
call fcn.00436020
push dword [ebp + 0xc]
call sub.USERENV.dll_DestroyEnvironmentBlock
test esi, esi
jne 0x427187
test bl, 0x20
je 0x4271ba
lea ecx, [ebp - 0x124]
call fcn.00420890
lea ecx, [ebp - 0x14]
xor bl, bl
call fcn.00435f50
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x14]
call fcn.00435f80
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 8
jb 0x42712f
mov ecx, dword [ecx]
push eax
lea eax, [ebp - 0x6c]
push eax
movzx eax, byte [edi + 2]
push 0
push 0
push esi
push eax
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 0x18]
test eax, eax
lea eax, [ebp - 0x28]
push eax
sete bl
call fcn.00436020
test bl, bl
je 0x427184
test byte [ebp - 4], 0x40
je 0x4271ba
lea ecx, [ebp - 0x124]
call fcn.00420890
lea ecx, [ebp - 0x14]
xor bl, bl
call fcn.00435f50
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 4]
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4271d6
push dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x4271cd
test bl, bl
jns 0x4271ab
lea ecx, [ebp - 0x11c]
call fcn.004205f0
push 1
push 1
push dword [ebp - 0x14]
call fcn.00435ef0
add esp, 0xc
lea ecx, [ebp - 0x14]
xor bl, bl
call fcn.00435f50
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp byte [edi], 0
je 0x4271e6
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4271f7
lea ecx, [ebp - 0x14]
call fcn.004360e0
mov dword [esi], eax
lea ecx, [ebp - 0x14]
mov bl, 1
call fcn.00435f50
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret