Function at 0x4765d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x384
mov eax, dword [0x553948]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
push ebx
mov esi, ecx
mov dword [ebp - 0x288], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, ebx
je 0x476686
cmp eax, 0x104
je 0x476686
xor ecx, ecx
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], ebx
mov word [ebp - 0x228], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x476633
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x20c]
push edx
lea ecx, [ebp - 0x228]
call fcn.004063e0
push 1
push 0xffffffffffffffff
push 0x514644
lea ecx, [ebp - 0x228]
call fcn.0045e650
cmp eax, 0xffffffff
jne 0x47669b
cmp dword [ebp - 0x214], 8
jb 0x476686
mov eax, dword [ebp - 0x228]
push eax
call fcn.00406fa9
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x218]
inc eax
cmp eax, ecx
ja 0x4766b6
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x228]
call fcn.0041ac30
jmp 0x4766c5
sub eax, ecx
push ebx
push eax
lea ecx, [ebp - 0x228]
call fcn.0040ce90
push ebx
lea ecx, [ebp - 0x328]
push ecx
lea ecx, [ebp - 0x2e0]
mov dword [ebp - 0x340], 0x518ee4
mov dword [ebp - 0x330], 0x5144f4
mov dword [ebp - 0x2e0], 0x518df0
mov dword [ebp - 0x338], ebx
mov dword [ebp - 0x334], ebx
call fcn.004746f0
mov edx, dword [ebp - 0x330]
mov eax, dword [edx + 4]
mov dword [ebp + eax - 0x330], 0x518dec
mov ecx, dword [ebp - 0x340]
mov edx, dword [ecx + 4]
mov dword [ebp + edx - 0x340], 0x518df4
mov eax, dword [ebp - 0x340]
mov ecx, dword [eax + 4]
mov dword [ebp + ecx - 0x340], 0x518ec8
lea ecx, [ebp - 0x328]
call fcn.004739a0
mov eax, dword [ebp - 0x330]
mov edx, dword [esi]
mov dword [ebp - 0x328], 0x518e68
mov dword [ebp - 0x2ec], ebx
mov dword [ebp - 0x2e8], ebx
mov eax, dword [eax + 4]
mov ecx, dword [edx + 8]
mov edx, dword [ebp + eax - 0x31c]
lea eax, [ebp + eax - 0x330]
push edi
push 0x518f10
push ecx
and edx, 0xfffff9ff
or edx, 0x800
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x330]
mov eax, dword [eax + 4]
push 0x518eec
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x330]
lea eax, [ebp + eax - 0x330]
push 0x517248
mov esi, 8
or dword [eax + 0x14], esi
push edx
call fcn.00474790
add esp, 8
push eax
call fcn.004749f0
add esp, 8
push eax
call fcn.00474790
add esp, 8
mov ecx, eax
call fcn.004751c0
push eax
call fcn.00474c10
add esp, 8
mov ecx, eax
call fcn.004751c0
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp - 0x328]
call fcn.004764e0
mov eax, dword [ebp - 0x280]
cmp dword [ebp - 0x26c], esi
jae 0x476818
lea eax, [ebp - 0x280]
push eax
call fcn.0040caf5
add esp, 4
mov edi, eax
mov dword [ebp - 0x284], edi
cmp dword [ebp - 0x26c], esi
jb 0x476840
mov ecx, dword [ebp - 0x280]
push ecx
call fcn.00406fa9
add esp, 4
push 0x40
lea edx, [ebp - 0x380]
push ebx
push edx
call fcn.004e41d0
add esp, 0xc
lea ecx, [ebp - 0x298]
mov dword [ebp - 0x384], 0x44
call fcn.00413760
lea ecx, [ebp - 0x264]
call fcn.0045f0c0
lea ecx, [ebp - 0x264]
call fcn.0045f3d0
test al, al
jne 0x4768bf
lea ecx, [ebp - 0x264]
call fcn.0045f120
lea ecx, [ebp - 0x298]
call fcn.00435480
cmp edi, ebx
je 0x4768a4
push edi
call fcn.00402d0e
add esp, 4
lea ecx, [ebp - 0x340]
call fcn.00474380
lea ecx, [ebp - 0x228]
call fcn.0040a440
jmp 0x476686
lea eax, [ebp - 0x244]
push eax
call fcn.0042bdf0
add esp, 4
cmp dword [ebp - 0x234], ebx
jne 0x476904
lea ecx, [ebp - 0x244]
call fcn.0040a440
lea ecx, [ebp - 0x264]
call fcn.0045f120
lea ecx, [ebp - 0x298]
call fcn.00435480
lea ecx, [ebp - 0x284]
call fcn.004354d0
jmp 0x4768a4
cmp dword [ebp - 0x230], esi
mov esi, dword [ebp - 0x244]
jae 0x476918
lea esi, [ebp - 0x244]
lea ecx, [ebp - 0x298]
call fcn.00431e40
push eax
lea ecx, [ebp - 0x384]
push ecx
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4768d6
mov edx, dword [ebp - 0x298]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x298]
mov esi, eax
lea eax, [ebp - 0x288]
push eax
push ecx
mov dword [ebp - 0x288], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
setne al
cmp esi, 0x102
je 0x4768d6
cmp al, bl
je 0x476987
cmp dword [ebp - 0x288], ebx
jne 0x476987
mov bl, 1
lea ecx, [ebp - 0x244]
call fcn.0040a440
lea ecx, [ebp - 0x264]
call fcn.0045f120
lea ecx, [ebp - 0x298]
call fcn.00435480
lea ecx, [ebp - 0x284]
call fcn.004354d0
lea ecx, [ebp - 0x340]
call fcn.00474380
lea ecx, [ebp - 0x228]
call fcn.0040a440
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00401316
mov esp, ebp
pop ebp
ret 4