Function at 0x1114d770
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111e76e7
mov eax, dword fs:[0]
push eax
sub esp, 0x958
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
mov edi, ecx
mov esi, dword [edi + 0x24]
push 1
push 5
mov dword [ebp - 0x854], edi
call fcn.111bb9f0
add esp, 0xc
test eax, eax
je 0x1114dc2f
test byte [ebp + 0xc], 8
je 0x1114dc2f
cmp dword [0x1127ad00], ebx
jne 0x1114dc2f
cmp dword [0x1127ad10], ebx
jne 0x1114dc2f
mov eax, dword [edi]
mov edx, dword [eax + 0xd8]
mov ecx, edi
call edx
lea ecx, [ebp - 0x90c]
mov dword [ebp - 0x850], eax
call fcn.11030fd0
lea ecx, [ebp - 0x90c]
mov dword [ebp - 4], ebx
call fcn.110826d0
mov dword [ebp - 0x860], eax
cmp eax, ebx
je 0x1114dc1e
cmp eax, 0xffffffff
je 0x1114dc1e
call fcn.111489a0
test al, al
jne 0x1114dc1e
lea eax, [ebp - 0x858]
push eax
lea ecx, [ebp - 0x834]
push ecx
push 1
push ebx
add esi, 0xbfc
or edi, 0xffffffff
push ebx
mov ecx, esi
mov dword [ebp - 0x820], edi
call fcn.11148890
test eax, eax
je 0x1114d897
mov edx, dword [ebp - 0x858]
mov ecx, dword [ebp - 0x834]
xor eax, eax
cmp edx, ebx
jbe 0x1114d889
nop
cmp dword [ecx + 8], ebx
je 0x1114d87f
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x1114d870
jmp 0x1114d889
mov edx, dword [ecx]
mov dword [ebp - 0x820], edx
mov edi, edx
mov eax, dword [ebp - 0x834]
push eax
mov ecx, esi
call fcn.11063060
mov dword [ebp - 0x81c], edi
cmp dword [0x1127acfc], ebx
je 0x1114d8b6
cmp edi, ebx
jg 0x1114d8c2
call fcn.1114cf20
mov dword [ebp - 0x81c], eax
jmp 0x1114d8bc
mov dword [ebp - 0x81c], ebx
mov edi, dword [ebp - 0x81c]
test byte [ebp + 0xc], 0x10
je 0x1114d9c8
xor ecx, ecx
mov word [ebp - 0x818], cx
mov dword [ebp - 0x828], esi
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x82c], ebx
mov ecx, dword [ebp - 0x860]
lea edx, [ebp - 0x82c]
push edx
lea eax, [ebp - 0x830]
push eax
push 5
push ecx
push ebx
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.110630a0
test eax, eax
je 0x1114d93e
mov edx, dword [ebp - 0x830]
push 0xff
push edx
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.MSVCR100.dll_wcsncat]
add esp, 0xc
cmp word [ebp - 0x818], bx
je 0x1114d93e
lea ecx, [ebp - 0x830]
jmp 0x1114dc16
mov ecx, dword [ebp - 0x854]
mov edx, dword [ecx]
mov eax, dword [edx + 0xd8]
call eax
cmp word [eax], bx
je 0x1114d933
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x840], ebx
mov dword [ebp - 0x83c], ebx
lea ecx, [ebp - 0x83c]
push ecx
lea edx, [ebp - 0x840]
push edx
push 8
push edi
push ebx
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.110630a0
test eax, eax
je 0x1114d9ab
mov eax, dword [ebp - 0x840]
cmp dword [eax], 4
je 0x1114d9ab
lea ecx, [ebp - 0x840]
mov byte [ebp - 4], 1
call fcn.110630f0
lea ecx, [ebp - 0x830]
jmp 0x1114dc16
lea ecx, [ebp - 0x840]
mov byte [ebp - 4], 1
call fcn.110630f0
lea ecx, [ebp - 0x830]
mov byte [ebp - 4], bl
call fcn.110630f0
xor ecx, ecx
xor edx, edx
mov word [ebp - 0x418], cx
mov word [ebp - 0x618], dx
mov dword [ebp - 0x844], esi
mov dword [ebp - 0x84c], ebx
mov dword [ebp - 0x848], ebx
lea eax, [ebp - 0x848]
push eax
lea ecx, [ebp - 0x84c]
push ecx
push 5
push edi
push ebx
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.110630a0
test eax, eax
je 0x1114da4d
mov edx, dword [ebp - 0x84c]
push 0xff
push edx
lea eax, [ebp - 0x618]
push eax
call dword [sym.imp.MSVCR100.dll_wcsncat]
add esp, 0xc
cmp word [ebp - 0x618], bx
je 0x1114da4d
push 0x100
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x618]
push edx
call fcn.1109a430
add esp, 0xc
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x218]
push str.tscon__d__V__DEST:console
push eax
call edi
add esp, 0xc
cmp word [ebp - 0x418], bx
je 0x1114da87
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp + eax*2 - 0x218]
push str.__PASSWORD:_s
push edx
call edi
add esp, 0xc
mov ecx, 0x200
lea eax, [ebp - 0x418]
mov byte [eax], bl
inc eax
dec ecx
jne 0x1114da92
push 0x44
lea eax, [ebp - 0x8b4]
push ebx
push eax
call sub.MSVCR100.dll_memset
mov edi, dword [ebp - 0x820]
xor ecx, ecx
add esp, 0xc
mov dword [ebp - 0x8b4], 0x44
mov dword [ebp - 0x888], 1
mov word [ebp - 0x884], cx
cmp edi, ebx
jl 0x1114dae3
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 1
push edi
push ebx
mov ecx, esi
call fcn.11148840
lea ecx, [ebp - 0x964]
call fcn.11030fd0
lea edx, [ebp - 0x85c]
push edx
lea ecx, [ebp - 0x964]
mov byte [ebp - 4], 4
call fcn.11082650
mov ecx, dword [ebp - 0x81c]
lea eax, [ebp - 0x824]
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x824], ebx
call fcn.111488e0
mov eax, dword [ebp - 0x824]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x1114db64
lea edx, [ebp - 0x8b4]
push edx
push 0x4000000
push ebx
lea ecx, [ebp - 0x870]
push ecx
push ebx
push ebx
lea edx, [ebp - 0x218]
push edx
push eax
call fcn.110f0000
mov esi, eax
mov eax, dword [ebp - 0x824]
add esp, 0x20
push eax
call edi
cmp esi, ebx
jne 0x1114db88
lea ecx, [ebp - 0x870]
push ecx
lea edx, [ebp - 0x8b4]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov ecx, dword [ebp - 0x85c]
push ecx
lea ecx, [ebp - 0x964]
call fcn.11082690
mov ecx, 0x208
lea eax, [ebp - 0x218]
mov byte [eax], bl
inc eax
dec ecx
jne 0x1114dba5
cmp esi, ebx
je 0x1114dbff
mov edx, dword [ebp - 0x870]
push edx
call edi
mov eax, dword [ebp - 0x86c]
push eax
call edi
test byte [ebp + 0xc], 0x80
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x1114dbe4
mov ecx, dword [ebp - 0x81c]
mov dword [0x11276370], ecx
call esi
dec eax
or eax, 1
mov dword [0x1127efb0], eax
call esi
mov edx, dword [ebp - 0x850]
dec eax
or eax, 1
mov dword [0x1127efb4], eax
cmp word [edx], bx
jne 0x1114dbff
mov dword [0x1127efb8], eax
mov eax, dword [ebp - 0x964]
cmp eax, ebx
je 0x1114dc10
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x84c]
mov byte [ebp - 4], bl
call fcn.110630f0
mov eax, dword [ebp - 0x90c]
cmp eax, ebx
je 0x1114dc2f
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret 0xc