Function at 0x79d760
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x79d9f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x1b1], 0
je 0x79d799
mov dword [ebp - 0x14], 0xffffffff
jmp 0x79d9c3
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa4]
cmp byte [eax + 0x10], 0
je 0x79d819
mov byte [ebp - 0x15], 1
mov eax, dword [ebp - 0x10]
cmp word [eax + 0x112], 0
je 0x79d7d3
lea ecx, [ebp - 0x15]
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x114]
call dword [ebx + 0x110]
cmp byte [ebp - 0x15], 0
je 0x79d819
mov eax, dword [ebp - 0x10]
call fcn.00798bd8
mov byte [ebp - 0x15], 1
mov eax, dword [ebp - 0x10]
cmp word [eax + 0x10a], 0
je 0x79d807
lea ecx, [ebp - 0x15]
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x10c]
call dword [ebx + 0x108]
cmp byte [ebp - 0x15], 0
jne 0x79d819
mov dword [ebp - 0x14], 0xffffffff
jmp 0x79d9c3
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x59], 0
je 0x79d839
mov eax, dword [ebp - 0x10]
push dword [eax + 0x194]
push dword [eax + 0x190]
mov eax, dword [ebp - 0x10]
call fcn.0079e6a4
xor eax, eax
push ebp
push 0x79d86b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0043f330
push eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
mov dl, 1
mov eax, dword [0x4dfb94]
call fcn.004e3a58
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x79d889
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x79da18
mov edx, 0x79da38
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 8]
cmp dword [ebp - 4], 0
je 0x79d8c4
push 3
push 0
xor ecx, ecx
mov edx, 0x3ad
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0x48]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0079e390
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x174], 0
je 0x79d8e1
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x76], 0
je 0x79d8e1
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x50]
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x79da54
mov edx, 0x79da38
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 8]
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.00796a54
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x79da74
mov edx, 0x79da38
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 8]
lea edx, [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x64]
cmp dword [ebp - 4], 0
je 0x79d9a9
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040bbb8
cmp dword [ebp - 8], 0
je 0x79d96c
push dword [ebp - 0xc]
push 0x79da9c
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 8]
mov ecx, 0
call fcn.0040bbb8
push dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040b93c
call fcn.00793038
test al, al
je 0x79d999
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.0040becc
push eax
mov eax, dword [ebp - 4]
call fcn.0040becc
push eax
push 0x79daa0
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x79d9a9
push 1
mov eax, dword [ebp - 0xc]
call fcn.0040ba84
push eax
call sub.kernel32.dll_WinExec
mov eax, ebx
call fcn.00409258
push 3
push 0
xor ecx, ecx
mov edx, 0x3b4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x48]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x79d9ff
lea eax, [ebp - 0x20]
call fcn.0040b078
lea eax, [ebp - 0x1c]
call fcn.0040b054
lea eax, [ebp - 0xc]
call fcn.0040b078
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b0b4
pop eax
jmp eax