Function at 0x347c0825
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x2c4
mov eax, dword [0x347765c8]
xor eax, esp
mov dword [esp + 0x2c0], eax
mov eax, dword [0x347efae8]
mov ecx, dword [eax + 0xec]
mov dword [esp], 0
call ecx
cmp dword [0x347ed330], 0
je 0x347c0885
mov edx, dword [0x347efae8]
mov eax, dword [edx + 0xf0]
push 0xfffffbfa
call eax
mov eax, 0xfffffbfa
mov ecx, dword [esp + 0x2c0]
xor ecx, esp
call fcn.347ea89f
add esp, 0x2c4
ret 4
mov ecx, dword [0x347efae8]
mov edx, dword [ecx + 0x208]
push esi
push 0x30
call edx
mov esi, eax
test esi, esi
je 0x347c08a9
push 0x30
push 0
push esi
call sub.msvcr80.dll_memset
add esp, 0xc
test esi, esi
mov dword [0x347ed330], esi
jne 0x347c08e2
mov eax, dword [0x347efae8]
mov ecx, dword [eax + 0xf0]
push 0xfffffc0d
call ecx
mov eax, 0xfffffc0d
pop esi
mov ecx, dword [esp + 0x2c0]
xor ecx, esp
call fcn.347ea89f
add esp, 0x2c4
ret 4
push ebx
push ebp
push edi
push 0x44
lea edx, [esp + 0x50]
push 0
push edx
call sub.msvcr80.dll_memset
mov edx, dword [esp + 0x2e4]
xor eax, eax
add esp, 0xc
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x2c]
push eax
push 0x10
lea ecx, [esp + 0x98]
push ecx
push 0
push edx
call sym.acerep.dll_Ordinal_2044
mov esi, eax
test esi, esi
jge 0x347c094a
cmp esi, 0xffffb1c6
je 0x347c0940
cmp esi, 0xffffb1d3
jne 0x347c0eaf
mov esi, 0xffffb17b
jmp 0x347c0eaf
push 0x50
lea eax, [esp + 0x234]
push eax
lea ecx, [esp + 0x98]
push ecx
call fcn.347b6f2b
mov ebx, dword [sym.imp.MSO.dll_Ordinal_6877]
push 0xc8
lea edx, [esp + 0xa4]
push edx
push 0x34773888
call ebx
mov edi, dword [sym.imp.MSO.dll_Ordinal_6873]
push 0xc8
lea eax, [esp + 0xa4]
push eax
lea ecx, [esp + 0x238]
push ecx
call edi
push 0xc8
lea edx, [esp + 0xa4]
push edx
push 0x34773e28
call edi
mov eax, dword [0x347ed330]
add eax, 4
push eax
lea ecx, [esp + 0xa4]
push ecx
call fcn.347ceb28
test eax, eax
mov ebp, dword [sym.imp.kernel32.dll_Sleep]
jge 0x347c0a8f
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x50]
push eax
push 0
push 0
push 0x8000228
push 0
push 0
push 0
push 0
push 0x34773d54
mov esi, 0xffffb191
call dword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
jne 0x347c0a1c
call fcn.347ce91a
mov esi, eax
cmp esi, 0xffffb191
jne 0x347c0eaf
mov esi, 0xffffb14b
jmp 0x347c0eaf
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.347cea6c
mov edx, dword [esp + 0x18]
push edx
call fcn.347cea6c
cmp dword [esp + 0x10], 0x32
jae 0x347c0a80
push 0
push 0
push 0
push 0
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
mov ecx, dword [0x347ed330]
add ecx, 4
push ecx
lea edx, [esp + 0xa4]
push edx
call fcn.347ceb28
mov esi, eax
test esi, esi
jge 0x347c0a6c
mov esi, 0xffffb191
push 0x1f4
call ebp
add dword [esp + 0x10], 1
cmp esi, 0xffffb191
je 0x347c0a30
test esi, esi
jge 0x347c0a8f
cmp esi, 0xffffb191
jmp 0x347c0ea8
xor esi, esi
push 0
push 0
push 0
push 0
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
mov edx, dword [0x347ed330]
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
push 1
add edx, 4
push edx
call fcn.347cf1db
cmp eax, 0xffffb188
jne 0x347c0adb
push 0x1f4
call ebp
add esi, 1
cmp esi, 0x32
jb 0x347c0a91
jmp 0x347c0eaa
cmp eax, 0xffffb18a
je 0x347c0ecb
test eax, eax
jne 0x347c0eaa
push 0xc8
lea eax, [esp + 0xa4]
push eax
push 0x347738f0
call ebx
push 0xc8
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0x238]
push edx
call edi
push 0xc8
lea eax, [esp + 0xa4]
push eax
push 0x34773e28
call edi
mov ecx, dword [0x347ed330]
add ecx, 8
push ecx
lea edx, [esp + 0xa4]
push edx
call fcn.347ceb28
mov esi, eax
test esi, esi
jl 0x347c0eaf
push 0xc8
lea eax, [esp + 0xa4]
push eax
push 0x34773958
call ebx
push 0xc8
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0x238]
push edx
call edi
push 0xc8
lea eax, [esp + 0xa4]
push eax
push 0x34773e28
call edi
mov ecx, dword [0x347ed330]
add ecx, 0x14
push ecx
lea edx, [esp + 0xa4]
push edx
call fcn.347cec7c
mov esi, eax
test esi, esi
jl 0x347c0eaf
push 0xc8
lea eax, [esp + 0xa4]
push eax
push 0x34773a58
call ebx
push 0xc8
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0x238]
push edx
call edi
push 0xc8
lea eax, [esp + 0xa4]
push eax
push 0x34773e28
call edi
mov ecx, dword [0x347ed330]
add ecx, 0x10
push ecx
lea edx, [esp + 0xa4]
push edx
call fcn.347cec7c
mov esi, eax
test esi, esi
jl 0x347c0eaf
push 0xc8
lea eax, [esp + 0xa4]
push eax
push 0x347739d8
call ebx
push 0xc8
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0x238]
push edx
call edi
push 0xc8
lea eax, [esp + 0xa4]
push eax
push 0x34773e28
call edi
mov ecx, dword [0x347ed330]
add ecx, 0xc
push ecx
lea edx, [esp + 0xa4]
push edx
call fcn.347cec7c
mov esi, eax
test esi, esi
jl 0x347c0eaf
push 0xc8
lea eax, [esp + 0xa4]
push eax
push 0x34773ad0
call ebx
push 0xc8
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0x238]
push edx
call edi
push 0xc8
lea eax, [esp + 0xa4]
push eax
push 0x34773e28
call edi
mov ecx, dword [0x347ed330]
add ecx, 0x1c
push ecx
lea edx, [esp + 0xa4]
push edx
call fcn.347cec7c
mov esi, eax
test esi, esi
jl 0x347c0eaf
push 0xc8
lea eax, [esp + 0xa4]
push eax
push 0x34773b38
call ebx
push 0xc8
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0x238]
push edx
call edi
push 0xc8
lea eax, [esp + 0xa4]
push eax
push 0x34773e28
call edi
mov ecx, dword [0x347ed330]
add ecx, 0x18
push ecx
lea edx, [esp + 0xa4]
push edx
call fcn.347cec7c
mov esi, eax
test esi, esi
jl 0x347c0eaf
push 0xc8
lea eax, [esp + 0xa4]
push eax
push 0x34773c10
call ebx
push 0xc8
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0x238]
push edx
call edi
push 0xc8
lea eax, [esp + 0xa4]
push eax
push 0x34773e28
call edi
mov edx, dword [0x347ed330]
push 0x208
lea ecx, [esp + 0xa4]
push ecx
add edx, 0x24
push edx
call fcn.347cefde
mov esi, eax
test esi, esi
jl 0x347c0eaf
push 0xc8
lea eax, [esp + 0xa4]
push eax
push 0x34773c70
call ebx
push 0xc8
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0x238]
push edx
call edi
push 0xc8
lea eax, [esp + 0xa4]
push eax
push 0x34773e28
call edi
mov edx, dword [0x347ed330]
push 0x228
lea ecx, [esp + 0xa4]
push ecx
add edx, 0x28
push edx
call fcn.347cefde
mov esi, eax
test esi, esi
jl 0x347c0eaf
push 0xc8
lea eax, [esp + 0xa4]
push eax
push 0x34773cd8
call ebx
push 0xc8
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0x238]
push edx
call edi
push 0xc8
lea eax, [esp + 0xa4]
push eax
push 0x34773e28
call edi
mov edx, dword [0x347ed330]
push 4
lea ecx, [esp + 0xa4]
push ecx
add edx, 0x2c
push edx
call fcn.347cefde
mov esi, eax
test esi, esi
jl 0x347c0eaf
mov ecx, dword [0x347ed330]
mov edx, dword [ecx + 0x2c]
push 0
push 4
lea eax, [esp + 0x1c]
push eax
push edx
call fcn.347cf180
mov esi, eax
test esi, esi
jl 0x347c0eaf
mov eax, dword [esp + 0x14]
push eax
push 0
push 0x100400
call dword [sym.imp.kernel32.dll_OpenProcess]
mov ecx, dword [0x347ed330]
mov dword [ecx + 0x20], eax
mov edx, dword [0x347ed330]
cmp dword [edx + 0x20], 0
jne 0x347c0ed2
call fcn.347ce91a
mov esi, eax
cmp esi, 0xffffb17f
jne 0x347c0eaf
mov esi, 0xffffb189
push 0x347ed330
call fcn.347c0790
mov eax, dword [0x347efae8]
mov ecx, dword [eax + 0xf0]
push esi
call ecx
mov eax, esi
jmp 0x347c0ee4
mov esi, 0xffffb18d
jmp 0x347c0eaf
mov edx, dword [0x347efae8]
mov eax, dword [edx + 0xf0]
push 0
call eax
xor eax, eax
mov ecx, dword [esp + 0x2d0]
pop edi
pop ebp
pop ebx
pop esi
xor ecx, esp
call fcn.347ea89f
add esp, 0x2c4
ret 4