Function at 0x13a67611
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x13a6e0f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x220], eax
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
mov dword [ebp - 0x210], esi
call sub.msvcrt.dll_memset
push 0x40
lea eax, [ebp - 0x270]
push esi
push eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x274], esi
call sub.msvcrt.dll_memset
add esp, 0x18
mov dword [ebp - 0x230], esi
xor eax, eax
lea edi, [ebp - 0x22c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x13a6e004]
mov esi, 0x13a6e004
mov ebx, 0x13a03e70
cmp eax, esi
je 0x13a676ba
test byte [eax + 0x1c], 2
je 0x13a676ba
cmp byte [eax + 0x19], 5
jb 0x13a676ba
push ebx
push 0x47
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58cc1
push 0x20019
xor edi, edi
push edi
push 0x13a042b8
push 0x80000000
call fcn.13a64bbf
mov dword [ebp - 0x218], eax
cmp eax, edi
jne 0x13a67721
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x210], eax
mov eax, dword [0x13a6e004]
cmp eax, esi
je 0x13a67903
test byte [eax + 0x1c], 2
je 0x13a67903
cmp byte [eax + 0x19], 2
jb 0x13a67903
push dword [ebp - 0x210]
push ebx
push 0x48
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a5a529
jmp 0x13a67903
push edi
push edi
push eax
call fcn.13a64fe2
cmp eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
jne 0x13a677be
call edi
mov dword [ebp - 0x210], eax
mov eax, dword [0x13a6e004]
cmp eax, esi
je 0x13a6776e
test byte [eax + 0x1c], 2
je 0x13a6776e
cmp byte [eax + 0x19], 2
jb 0x13a6776e
push dword [ebp - 0x210]
push ebx
push 0x49
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a5a529
push 0
push 0
push dword [ebp - 0x218]
call fcn.13a65002
mov dword [ebp - 0x214], eax
test eax, eax
jne 0x13a677be
call edi
mov dword [ebp - 0x210], eax
mov eax, dword [0x13a6e004]
cmp eax, esi
je 0x13a67903
test byte [eax + 0x1c], 2
je 0x13a67903
cmp byte [eax + 0x19], 2
jb 0x13a67903
push dword [ebp - 0x210]
push ebx
push 0x4a
jmp 0x13a67711
push 0x13a042a8
push dword [ebp - 0x214]
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x13a6780a
mov ecx, 0x65b
mov dword [ebp - 0x210], ecx
mov eax, dword [0x13a6e004]
cmp eax, esi
je 0x13a67903
test byte [eax + 0x1c], 2
je 0x13a67903
cmp byte [eax + 0x19], 2
jb 0x13a67903
push ecx
push ebx
push 0x4b
jmp 0x13a67711
push dword [ebp - 0x21c]
xor ecx, ecx
push dword [ebp - 0x220]
mov word [eax], cx
push dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push 0x13a04290
push 0x104
push eax
call fcn.13a58e45
xor ecx, ecx
add esp, 0x18
cmp eax, ecx
jge 0x13a67888
mov ecx, eax
and ecx, 0x1fff0000
cmp ecx, 0x70000
jne 0x13a67853
movzx eax, ax
mov dword [ebp - 0x210], eax
mov eax, dword [0x13a6e004]
cmp eax, esi
je 0x13a67903
test byte [eax + 0x1c], 2
je 0x13a67903
cmp byte [eax + 0x19], 2
jb 0x13a67903
push dword [ebp - 0x210]
push ebx
push 0x4c
jmp 0x13a67711
push 9
pop eax
mov word [ebp - 0x244], ax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x274]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x20c]
push eax
push ecx
mov dword [ebp - 0x274], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x13a678ed
call edi
mov dword [ebp - 0x210], eax
mov eax, dword [0x13a6e004]
cmp eax, esi
je 0x13a67903
test byte [eax + 0x1c], 2
je 0x13a67903
cmp byte [eax + 0x19], 2
jb 0x13a67903
push dword [ebp - 0x210]
push ebx
push 0x4d
jmp 0x13a67711
push dword [ebp - 0x22c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x230]
call esi
push dword [ebp - 0x214]
call fcn.13a639b4
cmp dword [ebp - 0x218], 0
pop edi
pop esi
pop ebx
je 0x13a67926
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
xor ecx, ebp
call fcn.13a619a5
leave
ret 8