Function at 0x485070
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x180
mov esi, esp
mov dword [esi + 0x168], ebp
mov edx, dword [ebp + 8]
mov dword [esi + 0x16c], esp
mov dword [esi + 0x178], 0xffffffff
mov dword [esi + 0x174], 0x4c6d20
mov ecx, dword [ebp + 0x14]
lea edi, [esi + 0x170]
mov eax, dword fs:[0]
add edx, 0xfffffffb
cmp edx, 2
mov dword [esi + 0x170], eax
mov dword fs:[0], edi
jb 0x485136
mov edi, 5
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x485773
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x485281
lea ecx, [esi + 0x88]
push 0
push 0x2bf
push str.win_srcprocess_thread_policy.cc
call fcn.0041f9f0
lea eax, [esi + 0x98]
mov dword [esi + 0x178], 1
push str.CreateProcessWAction:_STATUS_ACCESS_DENIED
push eax
call fcn.005df800
add esp, 8
lea ecx, [esi + 0x88]
call fcn.00424810
jmp 0x48528b
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x44], 0x44
mov eax, ecx
cmp dword [ecx + 0x14], 7
jbe 0x4851bd
mov eax, dword [ecx]
push eax
call fcn.005d8724
add esp, 4
lea ecx, [esi + 0x14c]
mov dword [esi + 4], eax
mov dword [esi + 0x178], 8
call fcn.004a1d40
lea ecx, [esi + 0x14c]
mov dword [esi + 0x178], 9
call fcn.004a1d60
mov edi, 5
test al, al
je 0x485758
lea eax, [esi + 0x14]
mov dword [esi], eax
push eax
call fcn.004a1b10
add esp, 4
cmp dword [esi + 0x24], 0
je 0x48571c
cmp dword [esi + 0x28], 7
jbe 0x485223
mov eax, dword [esi + 0x14]
mov dword [esi], eax
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x1c]
cmp dword [ebx + 0x14], 7
mov eax, ebx
jbe 0x485236
mov eax, dword [ebx]
and ecx, 0xc000420
xor ebx, ebx
test edi, edi
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x24]
setne bl
mov edi, dword [edi]
mov dword [esi + 8], edi
je 0x485444
mov dword [esi + 0x178], 0xa
lea edi, [esi + 0x44]
push edx
push edi
push dword [esi]
push 0
push ecx
push ebx
push 0
push 0
push dword [esi + 4]
push eax
push dword [ebp + 0xc]
call fcn.004c60f0
add esp, 0x2c
jmp 0x485467
push 0
call fcn.00410ec0
add esp, 4
mov dword [esi + 0x178], 0xffffffff
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x4852fa
lea ecx, [esi + 0x88]
push 0
push 0x2c0
push str.win_srcprocess_thread_policy.cc
call fcn.0041f9f0
lea eax, [esi + 0x98]
mov dword [esi + 0x178], 2
push str.app_name:
push eax
call fcn.005df800
add esp, 8
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x14], 7
jbe 0x4852e3
mov ecx, dword [ecx]
push ecx
push eax
call fcn.00424400
add esp, 8
lea ecx, [esi + 0x88]
call fcn.00424810
jmp 0x485304
push 0
call fcn.00410ec0
add esp, 4
mov dword [esi + 0x178], 0xffffffff
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x485373
lea ecx, [esi + 0x88]
push 0
push 0x2c1
push str.win_srcprocess_thread_policy.cc
call fcn.0041f9f0
lea eax, [esi + 0x98]
mov dword [esi + 0x178], 3
push str.command_line:
push eax
call fcn.005df800
add esp, 8
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 0x14], 7
jbe 0x48535c
mov ecx, dword [ecx]
push ecx
push eax
call fcn.00424400
add esp, 8
lea ecx, [esi + 0x88]
call fcn.00424810
jmp 0x48537d
push 0
call fcn.00410ec0
add esp, 4
mov ecx, dword [0x6d1ebc]
lea eax, [esi + 0x44]
mov dword [esi + 0x178], 0xffffffff
push 0xb
push eax
call fcn.004ae014
mov dword [esi + 0x178], 4
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x4853f1
lea ecx, [esi + 0x88]
push 0
push 0x2c3
push str.win_srcprocess_thread_policy.cc
call fcn.0041f9f0
lea ecx, [esi + 0x44]
lea eax, [esi + 0x98]
mov dword [esi + 0x178], 5
push ecx
push eax
call fcn.004a29e0
add esp, 8
lea ecx, [esi + 0x88]
call fcn.00424810
jmp 0x4853fb
push 0
call fcn.00410ec0
add esp, 4
mov ecx, dword [esi + 0x58]
mov edi, 5
cmp ecx, 8
jb 0x485773
mov eax, dword [esi + 0x44]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x485435
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x485789
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
jmp 0x485773
mov dword [esi + 0x178], 0xa
lea edi, [esi + 0x44]
push edx
push edi
push dword [esi]
push 0
push ecx
push ebx
push 0
push 0
push dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x485505
push 0
call fcn.00498bd0
add esp, 4
mov dword [esi], eax
push 0
call fcn.00513410
add esp, 4
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp dword [ebp + 8], 6
mov edx, dword [esi]
mov ecx, 0x1fffff
cmove edx, ecx
push 1
push 0
push edx
push dword [ebp + 0x24]
push dword [esi + 8]
push dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
mov eax, dword [ebp + 0x24]
mov eax, dword [eax + 4]
je 0x4854fe
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp + 0x24]
mov edi, dword [esi + 0xc]
mov ecx, 0x1fffff
add edx, 4
cmp dword [ebp + 8], 6
cmove edi, ecx
push 1
push 0
push edi
push edx
push dword [esi + 8]
push dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor edi, edi
test eax, eax
jne 0x485721
jmp 0x485505
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x48571c
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x485567
lea ecx, [esi + 0x88]
push 0
push 0x2e5
push str.win_srcprocess_thread_policy.cc
call fcn.0041f9f0
lea eax, [esi + 0x98]
mov dword [esi + 0x178], 0xd
push str.CreateProcessWAction:_STATUS_ACCESS_DENIED
push eax
call fcn.005df800
add esp, 8
lea ecx, [esi + 0x88]
call fcn.00424810
jmp 0x485571
push 0
call fcn.00410ec0
add esp, 4
mov dword [esi + 0x178], 0xa
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x4855e0
lea ecx, [esi + 0x88]
push 0
push 0x2e6
push str.win_srcprocess_thread_policy.cc
call fcn.0041f9f0
lea eax, [esi + 0x98]
mov dword [esi + 0x178], 0xc
push str.app_name:
push eax
call fcn.005df800
add esp, 8
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x14], 7
jbe 0x4855c9
mov ecx, dword [ecx]
push ecx
push eax
call fcn.00424400
add esp, 8
lea ecx, [esi + 0x88]
call fcn.00424810
jmp 0x4855ea
push 0
call fcn.00410ec0
add esp, 4
mov dword [esi + 0x178], 0xa
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x485659
lea ecx, [esi + 0x88]
push 0
push 0x2e7
push str.win_srcprocess_thread_policy.cc
call fcn.0041f9f0
lea eax, [esi + 0x98]
mov dword [esi + 0x178], 0xb
push str.command_line:
push eax
call fcn.005df800
add esp, 8
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 0x14], 7
jbe 0x485642
mov ecx, dword [ecx]
push ecx
push eax
call fcn.00424400
add esp, 8
lea ecx, [esi + 0x88]
call fcn.00424810
jmp 0x485663
push 0
call fcn.00410ec0
add esp, 4
mov ecx, dword [0x6d1ebc]
mov dword [esi + 0x178], 0xa
lea eax, [esi + 0x2c]
push 0xb
push eax
call fcn.004ae014
mov dword [esi + 0x178], 0xe
push 0
call fcn.00410ec0
add esp, 4
test al, al
je 0x4856d7
lea ecx, [esi + 0x88]
push 0
push 0x2e9
push str.win_srcprocess_thread_policy.cc
call fcn.0041f9f0
lea ecx, [esi + 0x2c]
lea eax, [esi + 0x98]
mov dword [esi + 0x178], 0xf
push ecx
push eax
call fcn.004a29e0
add esp, 8
lea ecx, [esi + 0x88]
call fcn.00424810
jmp 0x4856e1
push 0
call fcn.00410ec0
add esp, 4
mov ecx, dword [esi + 0x40]
cmp ecx, 8
jb 0x48571c
mov eax, dword [esi + 0x2c]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x485712
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4857a7
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov edi, 5
mov ecx, dword [esi + 0x28]
cmp ecx, 8
jb 0x485758
mov eax, dword [esi + 0x14]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x48574e
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x485798
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
lea ecx, [esi + 0x14c]
call fcn.004a1e70
mov eax, dword [esi + 4]
test eax, eax
je 0x485773
push eax
call fcn.005d31b1
add esp, 4
mov eax, dword [esi + 0x170]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0x178], 0
call fcn.006207e0
mov dword [esi + 0x178], 7
call fcn.006207e0
mov dword [esi + 0x178], 6
call fcn.006207e0
nop word cs:[eax + eax]
push ebp
sub esp, 0x2c
lea esi, [ebp - 0x17c]
mov ebp, dword [esi + 0x168]
call fcn.0061de80
nop word cs:[eax + eax]
nop
push ebp
sub esp, 0x2c
lea esi, [ebp - 0x17c]
mov ebp, dword [esi + 0x168]
lea ecx, [esi + 0x88]
call fcn.00424810
add esp, 0x2c
pop ebp
ret