Function at 0x838420
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x26
push 0
push 0
dec ecx
jne 0x838429
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a64c
mov eax, dword [ebp - 8]
call fcn.0040a64c
mov eax, dword [ebp - 0xc]
call fcn.0040a64c
lea eax, [ebp - 0x30]
mov edx, dword [0x767af0]
call fcn.0040b988
lea eax, [ebp - 0x4c]
mov edx, dword [0x7677b0]
call fcn.0040b988
xor eax, eax
push ebp
push 0x838e43
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
xor ecx, ecx
xor edx, edx
mov eax, 0x838e60
call fcn.0076a608
jmp 0x83849e
push 0x1f4
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x64]
call fcn.00837314
lea eax, [ebp - 0x64]
mov edx, 0x838e84
call fcn.0040b2d0
mov eax, dword [ebp - 0x64]
call fcn.0042857c
test al, al
jne 0x8384c9
call sub.kernel32.dll_GetLastError
cmp eax, 0x20
je 0x838494
mov dl, 1
mov eax, dword [0x48c37c]
call fcn.004b83f8
mov dword [ebp - 0x50], eax
mov dl, 1
mov eax, dword [0x48c37c]
call fcn.004b83f8
mov dword [ebp - 0x54], eax
mov dl, 1
mov eax, dword [0x48c37c]
call fcn.004b83f8
mov dword [ebp - 0x58], eax
mov dl, 1
mov eax, dword [0x48c37c]
call fcn.004b83f8
mov dword [ebp - 0x5c], eax
mov dl, 1
mov eax, dword [0x48c37c]
call fcn.004b83f8
mov dword [ebp - 0x60], eax
mov dl, 1
mov eax, dword [0x48c37c]
call fcn.004b83f8
mov dword [0x87ef80], eax
mov dl, 1
mov eax, dword [0x48c37c]
call fcn.004b83f8
mov dword [0x87ef84], eax
lea edx, [ebp - 0x68]
mov ax, 0x1c
call fcn.00837034
push dword [ebp - 0x68]
push 0x838eac
lea eax, [ebp - 0x6c]
call fcn.008370b4
push dword [ebp - 0x6c]
push 0x838ef0
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.0040b3b0
lea eax, [ebp - 0x10]
call fcn.00837314
cmp byte [0x87ef88], 0
jne 0x838595
lea eax, [ebp - 0x70]
mov ecx, 0x838f00
mov edx, dword [ebp - 0x10]
call fcn.0040b328
mov edx, dword [ebp - 0x70]
mov eax, dword [0x87ef80]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
xor eax, eax
push ebp
push 0x8385d3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x87ef88], 0
jne 0x8385c9
lea eax, [ebp - 0x74]
mov ecx, 0x838f20
mov edx, dword [ebp - 0x10]
call fcn.0040b328
mov edx, dword [ebp - 0x74]
mov eax, dword [0x87ef84]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x8385dd
lea edx, [ebp - 0x78]
mov eax, dword [0x87ef80]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x78]
mov ecx, 1
mov edx, eax
mov eax, 0x838f3c
call fcn.0040b654
dec eax
jge 0x838610
mov edx, 0x838f84
mov eax, dword [0x87ef80]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
xor edx, edx
push ebp
push 0x83865b
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x7c]
mov eax, dword [0x87ef84]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x7c]
mov ecx, 1
mov edx, eax
mov eax, 0x838f3c
call fcn.0040b654
dec eax
jge 0x838651
mov edx, 0x838f84
mov eax, dword [0x87ef84]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x838665
lea eax, [ebp - 0x80]
mov ecx, 0x838f00
mov edx, dword [ebp - 0x10]
call fcn.0040b328
mov edx, dword [ebp - 0x80]
mov eax, dword [0x87ef80]
mov ecx, dword [eax]
call dword [ecx + 0x80]
xor eax, eax
push ebp
push 0x8386e7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x84]
mov ecx, 0x838f20
mov edx, dword [ebp - 0x10]
call fcn.0040b328
mov eax, dword [ebp - 0x84]
mov dl, 1
call fcn.00428310
test al, al
je 0x8386dd
lea eax, [ebp - 0x88]
mov ecx, 0x838f20
mov edx, dword [ebp - 0x10]
call fcn.0040b328
mov edx, dword [ebp - 0x88]
mov eax, dword [0x87ef84]
mov ecx, dword [eax]
call dword [ecx + 0x80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x8386f1
lea eax, [ebp - 0x8c]
mov ecx, 0x838f00
mov edx, dword [ebp - 0x10]
call fcn.0040b328
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
xor eax, eax
push ebp
push 0x83874b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x90]
mov ecx, 0x838f20
mov edx, dword [ebp - 0x10]
call fcn.0040b328
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x838755
mov dl, 0
lea eax, [ebp - 0xa8]
movzx ecx, byte [0x838fec]
mov edx, 0x838ffc
call fcn.00768d2c
lea edx, [ebp - 0xa8]
lea eax, [ebp - 0x30]
mov ecx, dword [0x767af0]
call fcn.0040c4fc
mov eax, dword [ebp - 0x5c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x8387d2
inc ebx
xor esi, esi
lea ecx, [ebp - 0xac]
mov edx, esi
mov eax, dword [ebp - 0x5c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xac]
lea ecx, [ebp - 0x4c]
lea eax, [ebp - 0x30]
call fcn.00769510
lea eax, [ebp - 0x4c]
call fcn.00768938
test al, al
je 0x8387ce
xor ecx, ecx
mov edx, esi
mov eax, dword [ebp - 0x5c]
mov edi, dword [eax]
call dword [edi + 0x20]
inc esi
dec ebx
jne 0x838795
mov eax, dword [ebp - 0x60]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x838821
inc ebx
xor esi, esi
lea ecx, [ebp - 0xb0]
mov edx, esi
mov eax, dword [ebp - 0x60]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0x4c]
lea eax, [ebp - 0x30]
call fcn.00769510
lea eax, [ebp - 0x4c]
call fcn.00768938
test al, al
je 0x83881d
xor ecx, ecx
mov edx, esi
mov eax, dword [ebp - 0x60]
mov edi, dword [eax]
call dword [edi + 0x20]
inc esi
dec ebx
jne 0x8387e4
cmp dword [ebp - 4], 0
je 0x8388a1
lea eax, [ebp - 0xc8]
movzx ecx, byte [0x838fec]
mov edx, 0x839064
call fcn.00768d2c
lea edx, [ebp - 0xc8]
lea eax, [ebp - 0x30]
mov ecx, dword [0x767af0]
call fcn.0040c4fc
mov eax, dword [ebp - 0x5c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x8388a1
inc ebx
xor esi, esi
lea ecx, [ebp - 0xcc]
mov edx, esi
mov eax, dword [ebp - 0x5c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xcc]
lea ecx, [ebp - 0x4c]
lea eax, [ebp - 0x30]
call fcn.00769510
lea eax, [ebp - 0x4c]
call fcn.00768938
test al, al
je 0x83889d
xor ecx, ecx
mov edx, esi
mov eax, dword [ebp - 0x5c]
mov edi, dword [eax]
call dword [edi + 0x20]
inc esi
dec ebx
jne 0x838864
lea edx, [ebp - 0xd0]
mov eax, 0x8390d8
call fcn.0076e478
mov eax, dword [ebp - 0xd0]
mov edx, 0x8390f4
call fcn.0040b4c0
je 0x8388e5
lea edx, [ebp - 0xd4]
mov eax, 0x839104
call fcn.007079b4
mov eax, dword [ebp - 0xd4]
mov edx, 0x839138
call fcn.0040b4c0
je 0x8388f4
mov edx, 0x839158
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
jmp 0x838901
mov edx, 0x8391c4
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov edx, 0x839244
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea edx, [ebp - 0xd8]
mov eax, 0x8392ac
call fcn.0076e478
mov eax, dword [ebp - 0xd8]
mov edx, 0x8390f4
call fcn.0040b4c0
jne 0x83893f
mov edx, 0x8392cc
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
jmp 0x83894c
mov edx, 0x839340
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov edx, 0x8393b4
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov edx, 0x8393b4
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov edx, 0x839408
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov edx, 0x839478
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
cmp dword [ebp - 4], 0
je 0x8389b1
push 0x8394dc
push dword [ebp - 4]
push 0x83953c
lea eax, [ebp - 0xdc]
mov edx, 3
call fcn.0040b3b0
mov edx, dword [ebp - 0xdc]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0xe0]
mov ecx, 0x838f00
mov edx, dword [ebp - 0x10]
call fcn.0040b328
mov edx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
call dword [ecx + 0x80]
lea eax, [ebp - 0xe4]
mov ecx, 0x838f20
mov edx, dword [ebp - 0x10]
call fcn.0040b328
mov eax, dword [ebp - 0xe4]
mov dl, 1
call fcn.00428310
test al, al
je 0x838a1d
lea eax, [ebp - 0xe8]
mov ecx, 0x838f20
mov edx, dword [ebp - 0x10]
call fcn.0040b328
mov edx, dword [ebp - 0xe8]
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
call dword [ecx + 0x80]
lea eax, [ebp - 0xec]
mov ecx, 0x839550
mov edx, dword [ebp - 0x14]
call fcn.0040b328
mov edx, dword [ebp - 0xec]
mov eax, dword [ebp - 0x58]
call fcn.00837a54
mov eax, dword [ebp - 0x58]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x838a90
inc ebx
xor esi, esi
lea ecx, [ebp - 0xf0]
mov edx, esi
mov eax, dword [ebp - 0x58]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp dword [ebp - 0xf0], 0
je 0x838a8c
lea ecx, [ebp - 0xf4]
mov edx, esi
mov eax, dword [ebp - 0x58]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xf4]
mov ecx, 0x83956c
mov eax, dword [ebp - 0x54]
call fcn.00662f20
inc esi
dec ebx
jne 0x838a50
lea eax, [ebp - 0xf8]
mov ecx, 0x839580
mov edx, dword [ebp - 0x14]
call fcn.0040b328
mov edx, dword [ebp - 0xf8]
mov eax, dword [ebp - 0x58]
call fcn.00837a54
mov eax, dword [ebp - 0x58]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x838b03
inc ebx
xor esi, esi
lea ecx, [ebp - 0xfc]
mov edx, esi
mov eax, dword [ebp - 0x58]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp dword [ebp - 0xfc], 0
je 0x838aff
lea ecx, [ebp - 0x100]
mov edx, esi
mov eax, dword [ebp - 0x58]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x100]
mov ecx, 0x83956c
mov eax, dword [ebp - 0x54]
call fcn.00662f20
inc esi
dec ebx
jne 0x838ac3
lea eax, [ebp - 0x104]
mov ecx, 0x8395a8
mov edx, dword [ebp - 0x10]
call fcn.0040b328
mov edx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x108]
mov ecx, 0x8395cc
mov edx, dword [ebp - 0x10]
call fcn.0040b328
mov edx, dword [ebp - 0x108]
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x10c]
mov ecx, 0x8395f8
mov edx, dword [ebp - 0x10]
call fcn.0040b328
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x110]
mov ecx, 0x83962c
mov edx, dword [ebp - 0x10]
call fcn.0040b328
mov edx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x114]
mov ecx, 0x839658
mov edx, dword [ebp - 0x10]
call fcn.0040b328
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea edx, [ebp - 0x118]
mov ax, 0x1a
call fcn.00837034
lea eax, [ebp - 0x118]
mov edx, 0x839688
call fcn.0040b2d0
mov edx, dword [ebp - 0x118]
mov ecx, 0x83956c
mov eax, dword [ebp - 0x54]
call fcn.00662f20
lea edx, [ebp - 0x11c]
mov ax, 0x1a
call fcn.00837034
lea eax, [ebp - 0x11c]
mov edx, 0x8396d4
call fcn.0040b2d0
mov edx, dword [ebp - 0x11c]
mov ecx, 0x83956c
mov eax, dword [ebp - 0x54]
call fcn.00662f20
lea edx, [ebp - 0x120]
mov ax, 0x1a
call fcn.00837034
lea eax, [ebp - 0x120]
mov edx, 0x839734
call fcn.0040b2d0
mov edx, dword [ebp - 0x120]
mov ecx, 0x83956c
mov eax, dword [ebp - 0x54]
call fcn.00662f20
lea edx, [ebp - 0x124]
mov ax, 0x1c
call fcn.00837034
lea eax, [ebp - 0x124]
mov edx, 0x8397c4
call fcn.0040b2d0
mov edx, dword [ebp - 0x124]
mov ecx, 0x83956c
mov eax, dword [ebp - 0x54]
call fcn.00662f20
lea edx, [ebp - 0x128]
mov ax, 0x28
call fcn.00837034
lea eax, [ebp - 0x128]
mov edx, 0x839808
call fcn.0040b2d0
mov edx, dword [ebp - 0x128]
mov ecx, 0x83956c
mov eax, dword [ebp - 0x54]
call fcn.00662f20
lea edx, [ebp - 0x12c]
mov ax, 0x1a
call fcn.00837034
lea eax, [ebp - 0x12c]
mov edx, 0x83986c
call fcn.0040b2d0
mov edx, dword [ebp - 0x12c]
mov ecx, 0x83956c
mov eax, dword [ebp - 0x54]
call fcn.00662f20
lea edx, [ebp - 0x130]
mov ax, 0x28
call fcn.00837034
lea eax, [ebp - 0x130]
mov edx, 0x8398b0
call fcn.0040b2d0
mov edx, dword [ebp - 0x130]
mov ecx, 0x83956c
mov eax, dword [ebp - 0x54]
call fcn.00662f20
lea edx, [ebp - 0x134]
mov eax, 0x839918
call fcn.0076e478
mov eax, dword [ebp - 0x134]
mov edx, 0x839930
call fcn.0040b4c0
je 0x838d59
mov eax, dword [ebp - 0x54]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x838d59
inc ebx
xor esi, esi
lea ecx, [ebp - 0x138]
mov edx, esi
mov eax, dword [ebp - 0x54]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x138]
call fcn.0042857c
inc esi
dec ebx
jne 0x838d3a
mov eax, dword [ebp - 0x50]
call fcn.004086a4
mov eax, dword [ebp - 0x54]
call fcn.004086a4
mov eax, dword [ebp - 0x58]
call fcn.004086a4
mov eax, dword [ebp - 0x5c]
call fcn.004086a4
push 0x839944
push dword [ebp - 0xc]
push 0x839944
push dword [ebp - 8]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.0040b3b0
push 1
push 0
mov eax, dword [ebp - 0x18]
call fcn.0040b0c4
push eax
push 0x839948
push 0
push 0
call sub.shell32.dll_ShellExecuteW
mov byte [0x87ef88], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x838e4d
lea eax, [ebp - 0x138]
mov edx, 0x1c
call fcn.0040a5b8
lea eax, [ebp - 0xc8]
mov edx, dword [0x767af0]
call fcn.0040bd54
lea eax, [ebp - 0xb0]
mov edx, 2
call fcn.0040a5b8
lea eax, [ebp - 0xa8]
mov edx, dword [0x767af0]
call fcn.0040bd54
lea eax, [ebp - 0x90]
mov edx, 0xc
call fcn.0040a5b8
lea eax, [ebp - 0x4c]
mov edx, dword [0x7677b0]
call fcn.0040bd54
lea eax, [ebp - 0x30]
mov edx, dword [0x767af0]
call fcn.0040bd54
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040a5b8
pop eax
jmp eax