Function at 0x3a114184
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push esi
push edi
push dword [ebp + 0xc]
call fcn.3a114737
mov edi, eax
mov eax, dword [ebp + 0x18]
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x18], edi
je 0x3a1141b6
cmp word [eax], si
je 0x3a1141b6
push eax
call fcn.3a114737
mov ecx, eax
inc ecx
inc ecx
mov dword [ebp - 8], ecx
jmp 0x3a1141bb
mov dword [ebp - 8], esi
mov ecx, esi
mov eax, dword [ebp + 0x1c]
cmp eax, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], esi
je 0x3a1141d7
cmp word [eax], si
mov dword [ebp - 0x1c], 1
jne 0x3a1141da
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, 0x7d00
cmp edi, eax
mov dword [ebp - 0xc], esi
ja 0x3a1143f9
mov edx, dword [ebp + 0x14]
cmp edx, eax
ja 0x3a1143f9
cmp ecx, eax
ja 0x3a1143f9
add ecx, edi
lea edi, [ecx + edx + 4]
cmp edi, 0x3fffffff
mov dword [ebp - 0x20], edi
jae 0x3a1143f9
push ebx
lea eax, [edi + edi + 2]
push eax
push esi
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov ebx, eax
cmp ebx, esi
je 0x3a1143f8
push 0x44
pop esi
push esi
lea eax, [ebp - 0x78]
push eax
call fcn.3a114737
xor eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov word [ebp - 0x48], ax
lea eax, [edi + 1]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x78], esi
push ebx
call fcn.3a114737
push 0x3a1112b4
push ebx
call fcn.3a114737
mov esi, eax
test esi, esi
jne 0x3a11428e
push 0x3a112cd4
push ebx
call fcn.3a114737
mov esi, eax
test esi, esi
jne 0x3a11428e
mov eax, dword [ebp - 0x18]
lea esi, [ebx + eax*2]
cmp word [esi - 2], 0x20
je 0x3a11429e
mov word [esi], 0x20
inc esi
inc esi
jmp 0x3a11429e
xor eax, eax
cmp word [esi], 0x22
sete al
lea eax, [eax + eax + 2]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], 0
je 0x3a11431a
mov eax, dword [ebp + 0x14]
add eax, 8
push eax
push dword [ebp + 0x18]
call fcn.3a114737
test eax, eax
mov dword [ebp - 4], eax
je 0x3a11431a
mov eax, dword [ebp + 0x18]
cmp word [eax], 0x22
jne 0x3a1142d7
mov ecx, dword [ebp - 8]
cmp word [eax + ecx*2 - 6], 0x22
jne 0x3a1142d7
mov dword [ebp - 0xc], 1
jmp 0x3a1142db
and dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x3a114314
mov ecx, dword [ebp - 8]
lea edi, [ecx + eax + 4]
push edi
push 0x3a114404
push dword [ebp - 4]
call fcn.3a114737
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.3a114737
push edi
push 0x3a112cd0
push dword [ebp - 4]
call fcn.3a114737
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push esi
push edi
push dword [ebp - 0x18]
push ebx
call fcn.3a114737
test eax, eax
je 0x3a1143e4
push ebx
call fcn.3a114737
lea eax, [ebx + eax*2]
jmp 0x3a11434e
add eax, 0xfffffffe
cmp word [eax], 0x20
jne 0x3a114352
and word [eax], 0
cmp eax, ebx
ja 0x3a114341
cmp dword [ebp - 0x1c], 0
je 0x3a11439e
mov edi, dword [ebp + 0x1c]
jmp 0x3a11439a
cmp word [edi], 0
je 0x3a11439e
push 0x20
push edi
call fcn.3a114737
mov esi, eax
sub esi, edi
sar esi, 1
test esi, esi
jle 0x3a11439e
push 0
push 0
push esi
push edi
push ebx
call fcn.3a114737
push eax
push dword [ebp - 0x20]
push ebx
call fcn.3a114737
push eax
push ebx
call fcn.3a114737
test eax, eax
je 0x3a1143e4
lea edi, [edi + esi*2 + 2]
test edi, edi
jne 0x3a11435d
push 0xffffffffffffffff
call dword [sym.imp.user32.dll_AllowSetForegroundWindow]
xor esi, esi
cmp dword [ebp + 8], esi
je 0x3a1143e4
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
push esi
push 0x400
push esi
push esi
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateProcessW]
cmp eax, esi
je 0x3a1143e4
push dword [ebp - 0x34]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
push dword [ebp - 0x30]
call esi
mov dword [ebp - 0x24], 1
push ebx
call fcn.3a114737
cmp dword [ebp - 4], 0
je 0x3a1143f8
push dword [ebp - 4]
call fcn.3a114737
pop ebx
mov eax, dword [ebp - 0x24]
pop edi
pop esi
leave
ret 0x1c