Function at 0x6291ef28
Capabilities:
Create process on windows
Create process suspended
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ecx, [ebp - 0x110]
sub esp, 0x1ac
lea esi, [ebp - 0x170]
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea edx, [ebp - 0x110]
push eax
mov eax, esi
call method.libopenmpt::plugin.GetTempFilename_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
lea ecx, [ebp - 0x110]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_dispose__
mov eax, dword [ebp - 0x170]
mov dword [esp + 4], 0x10
mov dword [esp], eax
lea ecx, [ebp - 0x110]
call method.std::basic_ofstream_char__std::char_traits_char___.basic_ofstream_char_const__std::_Ios_Openmode_
push eax
push eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0x110]
mov dword [esp], eax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std.allocator_char____std::basic_ostream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char
lea ecx, [ebp - 0x110]
lea edi, [ebp - 0x10c]
call method.std::basic_ofstream_char__std::char_traits_char___.basic_ofstream__
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x180]
mov ecx, 4
rep stosd dword es:[edi], eax
mov dword [esp], str.notepad.exe
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x110], 0x44
call fcn.62a697e0
push eax
lea ecx, [ebp - 0x140]
mov dword [esp], 0x62b170ab
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.append_char_const_
push ebx
lea ecx, [ebp - 0x128]
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
lea ecx, [ebp - 0x128]
push edi
mov dword [esp], esi
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.append_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
push edx
lea ecx, [ebp - 0x158]
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
push ecx
lea ecx, [ebp - 0x128]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_dispose__
lea ecx, [ebp - 0x140]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_dispose__
mov eax, dword [ebp - 0x158]
mov edx, dword [ebp - 0x154]
mov dword [esp], eax
lea ecx, [ebp - 0x128]
lea edx, [eax + edx + 1]
mov dword [esp + 4], edx
call method.std::vector_char__std::allocator_char___.vector_char_const__void__char_const__char_const__std::allocator_char__const___clone_.isra.0_
push edi
lea eax, [ebp - 0x180]
push edi
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x110]
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0x128]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._CreateProcessA_40
sub esp, 0x28
test eax, eax
jne 0x6291f0db
lea ecx, [ebp - 0x128]
call sym.std::_Vector_base_char__std::allocator_char___::_Vector_base____clone_.isra.0_
lea ecx, [ebp - 0x158]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_dispose__
mov ecx, esi
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_dispose__
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x17c]
mov dword [esp], eax
call sym._CloseHandle_4
mov eax, dword [ebp - 0x180]
push ebx
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
push ecx
mov eax, dword [ebp - 0x180]
push ecx
mov dword [esp], eax
call sym._CloseHandle_4
mov eax, dword [ebp - 0x170]
push edx
mov dword [esp], eax
call sym._DeleteFileA_4
push eax
jmp 0x6291f0b6