Function at 0x6461195c
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x646170a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor esi, esi
mov dword [ebp - 0x218], edx
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], ecx
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x270]
xor ebx, ebx
push 0x44
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea edi, [ebp - 0x228]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646119e2
test byte [eax + 0x1c], 2
je 0x646119e2
cmp byte [eax + 0x19], 5
jb 0x646119e2
push dword [eax + 0x14]
mov edx, 0x64602f00
push dword [eax + 0x10]
push 0x47
pop ecx
call fcn.64604453
push 0x20019
push 0
mov edx, 0x64602d78
mov ecx, 0x80000000
call fcn.6460f288
mov edi, eax
test edi, edi
jne 0x64611a45
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x64617004]
cmp ecx, 0x64617004
je 0x64611c22
test byte [ecx + 0x1c], 2
je 0x64611c22
cmp byte [ecx + 0x19], 2
jb 0x64611c22
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x48
mov edx, 0x64602f00
pop ecx
call fcn.64604471
jmp 0x64611c22
push ecx
push 0
xor edx, edx
mov ecx, edi
push 0
inc edx
call fcn.6460f311
mov ebx, eax
test ebx, ebx
jne 0x64611ae1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64611a92
test byte [eax + 0x1c], 2
je 0x64611a92
cmp byte [eax + 0x19], 2
jb 0x64611a92
push esi
push dword [eax + 0x14]
mov edx, 0x64602f00
push dword [eax + 0x10]
push 0x49
pop ecx
call fcn.64604471
push ecx
push 0
push 0
push 2
pop edx
mov ecx, edi
call fcn.6460f311
mov ebx, eax
test ebx, ebx
jne 0x64611ae1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64611c22
test byte [eax + 0x1c], 2
je 0x64611c22
cmp byte [eax + 0x19], 2
jb 0x64611c22
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x4a
jmp 0x64611a35
push 0x64602dc8
push ebx
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x64611b2a
mov esi, 0x65b
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64611c22
test byte [eax + 0x1c], 2
je 0x64611c22
cmp byte [eax + 0x19], 2
jb 0x64611c22
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x4b
jmp 0x64611a35
push dword [ebp - 0x214]
xor ecx, ecx
push dword [ebp - 0x218]
mov word [eax], cx
lea eax, [ebp - 0x210]
push ebx
push 0x64602dd4
push 0x104
push eax
call fcn.64604373
add esp, 0x18
test eax, eax
jns 0x64611ba0
mov ecx, eax
movzx esi, ax
and ecx, 0x1fff0000
cmp ecx, 0x70000
je 0x64611b6e
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64611c22
test byte [eax + 0x1c], 2
je 0x64611c22
cmp byte [eax + 0x19], 2
jb 0x64611c22
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x4c
jmp 0x64611a35
push 9
pop eax
mov word [ebp - 0x240], ax
xor ecx, ecx
lea eax, [ebp - 0x228]
mov dword [ebp - 0x270], 0x44
push eax
lea eax, [ebp - 0x270]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x210]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x64611c0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64611c22
test byte [eax + 0x1c], 2
je 0x64611c22
cmp byte [eax + 0x19], 2
jb 0x64611c22
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x4d
jmp 0x64611a35
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call fcn.6460ce29
test edi, edi
je 0x64611c34
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.64615e30
leave
ret