Function at 0x4304b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c4eec
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x624500]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0
call fcn.00405c3d
mov ecx, eax
test ecx, ecx
je case.0x43069a.1
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
test edi, edi
je 0x4305c9
test edi, 0xffff0000
jne 0x4305be
movzx edi, di
mov ecx, edi
call fcn.004098b0
mov ebx, eax
test ebx, ebx
je 0x4305d5
mov ecx, edi
shr ecx, 4
push 6
inc ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4305d5
push edi
push eax
push ebx
call fcn.00409910
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4305d5
movzx edx, word [ebx]
mov ecx, 1
mov eax, dword [esi - 8]
mov edi, edx
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x430581
push edi
lea ecx, [ebp - 0x14]
call fcn.0040595f
movzx edx, word [ebx]
mov esi, dword [ebp - 0x14]
movzx ecx, dx
lea eax, [ebx + 2]
push ecx
push eax
push edi
push esi
call fcn.00594ceb
add esp, 0x10
cmp eax, 0x50
ja case.0x43069a.1
movzx eax, byte [eax + 0x430d28]
jmp dword [eax*4 + 0x430d18]
cmp edi, dword [esi - 8]
jg case.0x43069a.20
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
jmp 0x4305d5
push edi
call fcn.00594cd0
add esp, 4
jmp 0x4305cb
xor eax, eax
push eax
push edi
lea ecx, [ebp - 0x14]
call fcn.00409b39
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], 0
call fcn.00405c3d
mov ecx, eax
test ecx, ecx
je 0x430c95
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x2c], esi
mov ebx, str.explorer.exe__
mov byte [ebp - 4], 2
test ebx, 0xffff0000
jne 0x4306af
movzx edi, bx
mov ecx, edi
call fcn.004098b0
mov ebx, eax
test ebx, ebx
je 0x4307ce
mov ecx, edi
shr ecx, 4
push 6
inc ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4307ce
push edi
push eax
push ebx
call fcn.00409910
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4307ce
movzx edx, word [ebx]
mov ecx, 1
mov eax, dword [esi - 8]
mov edi, edx
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x430678
push edi
lea ecx, [ebp - 0x2c]
call fcn.0040595f
movzx edx, word [ebx]
mov esi, dword [ebp - 0x2c]
movzx ecx, dx
lea eax, [ebx + 2]
push ecx
push eax
push edi
push esi
call fcn.00594ceb
add esp, 0x10
cmp eax, 0x50
ja case.0x43069a.1
movzx eax, byte [eax + 0x430d8c]
jmp dword [eax*4 + 0x430d7c]
cmp edi, dword [esi - 8]
jg 0x430ca9
jmp 0x4307c5
push str.explorer.exe__
call fcn.00594cd0
mov edi, eax
add esp, 4
test edi, edi
jne 0x43072a
lea edx, [esi - 0x10]
mov byte [ebp - 4], 3
mov edi, dword [edx]
cmp dword [edx + 4], eax
je 0x4307ce
mov eax, dword [edx + 0xc]
lea ecx, [edx + 0xc]
shr eax, 0x1f
test al, al
je 0x4306fc
cmp dword [edx + 8], 0
jl 0x430cb3
xor eax, eax
mov dword [edx + 4], 0
mov word [esi], ax
jmp 0x4307ce
mov byte [ebp - 4], 4
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x430714
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x2c], esi
jmp 0x4307ce
mov eax, dword [esi - 0xc]
sub ebx, esi
sar ebx, 1
mov dword [ebp - 0x20], eax
test edi, edi
js 0x430cbd
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x430759
push edi
lea ecx, [ebp - 0x2c]
call fcn.0040595f
mov esi, dword [ebp - 0x2c]
cmp ebx, dword [ebp - 0x20]
ja 0x4307aa
mov eax, dword [esi - 8]
lea ecx, [edi + edi]
lea edx, [esi + ebx*2]
test ecx, ecx
je 0x4307bc
test esi, esi
jne 0x430781
call fcn.00591458
mov dword [eax], 0x16
call fcn.0059137f
jmp 0x4307bc
test edx, edx
je 0x43076f
add eax, eax
cmp eax, ecx
jae 0x43079d
call fcn.00591458
mov dword [eax], 0x22
call fcn.0059137f
jmp 0x4307bc
push ecx
push edx
push esi
call fcn.0058d260
add esp, 0xc
jmp 0x4307bc
push edi
push str.explorer.exe__
push dword [esi - 8]
push esi
call fcn.00405d4d
add esp, 0x10
cmp edi, dword [esi - 8]
jg case.0x43069a.20
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 8
mov ecx, dword [eax]
mov dword [ebp - 0x48], eax
test ecx, ecx
je 0x4307e7
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
jmp 0x4307e9
xor ecx, ecx
mov byte [ebp - 4], 7
test ecx, ecx
jne 0x4307ff
call fcn.00405c3d
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
mov byte [ebp - 4], 9
test ecx, ecx
je 0x430cc7
mov eax, dword [ecx]
call dword [eax + 0xc]
mov byte [ebp - 4], 6
mov dword [ebp - 0x24], 1
lea edi, [eax + 0x10]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], edi
test eax, eax
je 0x430831
push eax
call fcn.00594cd0
add esp, 4
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], edx
lea ebx, [eax + edx]
test ebx, ebx
js 0x430cd1
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, ebx
or eax, ecx
jge 0x430865
push ebx
lea ecx, [ebp - 0x34]
call fcn.0040595f
mov edi, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
push edx
push esi
push edx
push edi
call fcn.00405d4d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
push eax
push ecx
push eax
mov eax, dword [ebp - 0x30]
lea eax, [edi + eax*2]
push eax
call fcn.00405d4d
lea eax, [edi - 0x10]
add esp, 0x20
mov dword [ebp - 0x44], eax
cmp ebx, dword [eax + 8]
jg case.0x43069a.20
xor ecx, ecx
mov dword [eax + 4], ebx
mov word [edi + ebx*2], cx
mov byte [ebp - 4], 0xc
mov ecx, dword [eax]
test ecx, ecx
je 0x4308b1
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
jmp 0x4308b3
xor ecx, ecx
mov byte [ebp - 4], 0xb
test ecx, ecx
jne 0x4308c9
call fcn.00405c3d
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
mov byte [ebp - 4], 0xd
test ecx, ecx
je 0x430cdb
mov eax, dword [ecx]
call dword [eax + 0xc]
mov byte [ebp - 4], 0xa
push 0x603714
mov dword [ebp - 0x24], 3
lea esi, [eax + 0x10]
mov dword [ebp - 0x30], esi
call fcn.00594cd0
mov edx, dword [edi - 0xc]
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
lea ebx, [eax + edx]
test ebx, ebx
js 0x430ce5
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, ebx
or eax, ecx
jge 0x43092c
push ebx
lea ecx, [ebp - 0x30]
call fcn.0040595f
mov esi, dword [ebp - 0x30]
mov edx, dword [ebp - 0x1c]
push edx
push edi
push edx
push esi
call fcn.00405d4d
mov eax, dword [ebp - 0x1c]
add esp, 0x10
mov ecx, dword [ebp - 0x20]
lea eax, [esi + eax*2]
add ecx, ecx
je 0x43096a
test eax, eax
jne 0x43095b
call fcn.00591458
mov dword [eax], 0x16
call fcn.0059137f
jmp 0x43096a
push ecx
push 0x603714
push eax
call fcn.0058cce0
add esp, 0xc
lea eax, [esi - 0x10]
mov dword [ebp - 0x40], eax
cmp ebx, dword [eax + 8]
jg case.0x43069a.20
xor ecx, ecx
mov dword [eax + 4], ebx
mov word [esi + ebx*2], cx
mov byte [ebp - 4], 0x10
mov ecx, dword [eax]
test ecx, ecx
je 0x430995
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
jmp 0x430997
xor ecx, ecx
mov byte [ebp - 4], 0xf
test ecx, ecx
jne 0x4309ad
call fcn.00405c3d
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
mov byte [ebp - 4], 0x11
test ecx, ecx
je 0x430cef
mov eax, dword [ecx]
call dword [eax + 0xc]
mov byte [ebp - 4], 0xe
push 0x602bc0
mov dword [ebp - 0x24], 7
lea edi, [eax + 0x10]
mov dword [ebp - 0x38], edi
call fcn.00594cd0
mov ebx, dword [esi - 0xc]
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ebx
lea edx, [eax + ebx]
test edx, edx
js 0x430cf9
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, edx
or eax, ecx
jge 0x430a0d
push edx
lea ecx, [ebp - 0x38]
call fcn.0040595f
mov edi, dword [ebp - 0x38]
push ebx
push esi
push ebx
push edi
call fcn.00405d4d
mov esi, dword [ebp - 0x20]
lea eax, [edi + ebx*2]
add esp, 0x10
lea ecx, [esi + esi]
test ecx, ecx
je 0x430a4b
test eax, eax
jne 0x430a3c
call fcn.00591458
mov dword [eax], 0x16
call fcn.0059137f
jmp 0x430a4b
push ecx
push 0x602bc0
push eax
call fcn.0058cce0
add esp, 0xc
mov eax, dword [ebp - 0x1c]
lea ebx, [edi - 0x10]
add eax, esi
cmp eax, dword [ebx + 8]
jg case.0x43069a.20
xor ecx, ecx
mov dword [ebx + 4], eax
mov word [edi + eax*2], cx
mov dword [ebp - 0x28], ecx
mov byte [ebp - 4], 0x14
mov ecx, dword [ebx]
test ecx, ecx
je 0x430a7b
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
jmp 0x430a7d
xor ecx, ecx
mov byte [ebp - 4], 0x13
test ecx, ecx
jne 0x430a93
call fcn.00405c3d
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
mov byte [ebp - 4], 0x15
test ecx, ecx
je 0x430d03
mov eax, dword [ecx]
call dword [eax + 0xc]
mov byte [ebp - 4], 0x12
mov edx, dword [edi - 0xc]
mov dword [ebp - 0x24], 0xf
lea esi, [eax + 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x4c], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
lea ecx, [eax + edx]
test ecx, ecx
js 0x430d0d
mov eax, 1
sub eax, dword [esi - 4]
mov dword [ebp - 0x3c], eax
mov eax, dword [esi - 8]
sub eax, ecx
or eax, dword [ebp - 0x3c]
jge 0x430af9
push ecx
lea ecx, [ebp - 0x28]
call fcn.0040595f
mov esi, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
push edx
push edi
push edx
push esi
call fcn.00405d4d
mov eax, dword [ebp - 0x20]
push eax
push dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
lea eax, [esi + eax*2]
push eax
call fcn.00405d4d
mov eax, dword [ebp - 0x20]
lea edi, [esi - 0x10]
add eax, dword [ebp - 0x1c]
add esp, 0x20
cmp eax, dword [edi + 8]
jg case.0x43069a.20
xor ecx, ecx
mov dword [edi + 4], eax
mov word [esi + eax*2], cx
lea edx, [ebp - 0x28]
push 0x602bc0
lea ecx, [ebp - 0x18]
call fcn.00408a7e
add esp, 4
mov dword [ebp - 0x24], 7
or esi, 0xffffffff
mov byte [ebp - 4], 0x18
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x430b69
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x24], 3
mov byte [ebp - 4], 0x1a
mov eax, esi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x430b88
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x24], 1
mov edx, dword [ebp - 0x40]
mov eax, esi
mov byte [ebp - 4], 0x1c
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430baa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x44]
mov eax, esi
mov byte [ebp - 4], 0x1e
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430bc5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x48]
mov eax, esi
mov byte [ebp - 4], 0x20
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430be0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x1f
lea eax, [ebp - 0xcc]
push 3
push dword [ebp - 0x18]
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xd0], eax
call fcn.00408c34
push 1
push dword [ebp - 0xd0]
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [ebp - 0xd0]
mov edi, eax
lea eax, [ebp - 0xcc]
cmp ecx, eax
je 0x430c29
push ecx
call fcn.00594e3b
add esp, 4
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x21
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430c47
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 4], 0x22
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x430c63
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00539e65
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00405d25
push 0x8007000e
call fcn.00405d25
push 0x80004005
call fcn.00405d25
push 0x80070057
call fcn.00405d25
push 0x80070057
call fcn.00405d25
push 0x80070057
call fcn.00405d25
push 0x80070057
call fcn.00405d25
push 0x80004005
call fcn.00405d25
push 0x80070057
call fcn.00405d25
push 0x80004005
call fcn.00405d25
push 0x80070057
call fcn.00405d25
push 0x80004005
call fcn.00405d25
push 0x80070057
call fcn.00405d25
push 0x80004005
call fcn.00405d25
push 0x80070057
call fcn.00405d25
nop
stosb byte es:[edi], al
add eax, 210436163
inc ebx
add byte [edi - 0x7effbcf4], bl
or al, 0x43
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
nop dword [eax]
mov eax, dword [0x8b004306]
or al, 67
add byte [edi - 0x7effbcf4], bl
or al, 0x43
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3