Function at 0x568b12
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
add dword [ebp - 0x1f], eax
xor edx, eax
or ecx, 0x3c59
sub edx, dword [0x57bc09]
sub eax, 0xea39
test dword [0x57b821], eax
jae 0x568bc6
mov ecx, 0x8a00
sub edx, edx
add edx, eax
mov ecx, eax
or dword [ebp - 0x89], ecx
sub edx, ecx
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xd], ecx
mov ah, dh
mov dword [ebp - 0x22], edx
mov dword [ebp - 6], edx
mov edx, 0x256d
add dword [ebp - 0x9b], eax
sub word [ebp - 0x83], ax
mov eax, 0x1e89
mov eax, ecx
movzx ecx, dh
mov dword [0x57b44c], ecx
mov edx, dword [0x57b5c5]
mov eax, dword [ebp - 0x9f]
and eax, 0x4859
test ecx, 0xe93d3900
je 0x568bac
mov eax, dword [ebp - 0x66]
mov edx, eax
mov dword [ebp - 0x95], ecx
mov eax, 0x70f9
mov ecx, dword [ebp - 0x92]
mov dword [ebp - 0x96], edx
test eax, eax
jns 0x568bbc
add ch, byte [ebp - 0x81]
mov word [ebp - 0x75], dx
cmp eax, eax
jne 0x568c12
mov dword [ebp - 0xa0], eax
mov dword [0x57b7f9], eax
add edx, eax
mov edx, ecx
mov edx, ecx
mov eax, dword [ebp - 0x51]
mov edx, dword [ebp - 0x6e]
lea ecx, [ebp - 0x26]
mov ecx, dword [ebp - 0x39]
mov dword [ebp - 0x22], eax
add dx, 0x87e0
mov byte [ebp - 0x72], ch
mov dword [ebp - 0x7f], ecx
mov edx, dword [ebp - 0x8b]
sub eax, ecx
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x23], eax
mov al, byte [ebp - 0x10]
xor edx, dword [0x57b4e9]
add ecx, dword [ebp - 0x71]
mov ah, byte [ebp - 0xc]
mov dword [ebp - 0xad], eax
mov dword [ebp - 0x5f], eax
mov edx, dword [ebp - 0x31]
or ecx, dword [ebp - 0x72]
mov eax, 0xa74c
mov edx, dword [ebp - 0x1c]
mov edx, ecx
mov ecx, dword [ebp - 0x60]
or ecx, 0x909f
and edx, dword [ebp - 0x75]
mov dword [ebp - 9], eax
lea ecx, [ebp - 0x7e]
mov edx, edx
and edx, dword [ebp - 0xe]
movzx ecx, byte [0x57b784]
cmp edx, ecx
jno 0x568c60
mov edx, 0x4a28
lea ecx, [ebp - 0x45]
mov ecx, eax
movzx edx, cl
add edx, 0xc117
add edx, dword [ebp - 0xa5]
mov dword [ebp - 0x28], ecx
cmp dx, word [0x57b05b]
je 0x568c99
mov dword [ebp - 0x45], ecx
mov edx, 0x1d94
sub eax, 0x86d2
or dword [ebp - 0x7e], ecx
sub eax, ecx
mov edx, 0x2d4d
mov dword [ebp - 0x27], eax
mov ecx, ecx
mov dword [ebp - 0xad], edx
lea edx, [ebp - 0x6e]
or ecx, edx
cmp cx, ax
je 0x568c9e
add ecx, edx
add eax, dword [ebp - 0x14]
and dword [0x57bae3], edx
test ecx, ecx
je 0x568d35
mov eax, dword [ebp - 0x89]
sub byte [ebp - 0x2f], ch
add dword [ebp - 0x95], eax
mov byte [ebp - 0x75], dh
xor eax, dword [ebp - 0x30]
mov ecx, eax
or ax, word [ebp - 4]
movzx ecx, ah
mov edx, dword [ebp - 0x1b]
mov edx, eax
mov edx, eax
mov dword [ebp - 0x40], eax
add ecx, 0xae77
or ecx, dword [ebp - 0x39]
mov edx, dword [ebp - 2]
sub dword [ebp - 0xa4], ecx
or ecx, 0xd2ea
cmp edx, 0xf7df2157
jo 0x568d0a
or ah, byte [ebp - 0x78]
mov dword [ebp - 0x1a], edx
add eax, edx
add edx, 0xc60
mov eax, dword [ebp - 0x6b]
and eax, ecx
movzx ecx, ch
mov eax, edx
xor eax, dword [ebp - 0x63]
mov ecx, dword [ebp - 0x14]
mov ecx, edx
mov eax, eax
mov dword [ebp - 0x57], edx
sub eax, 0xaab7
mov dword [ebp - 0xab], ecx
xor edx, dword [ebp - 0x6f]
mov ecx, dword [ebp - 0x75]
sub eax, dword [ebp - 0x6d]
mov eax, dword [ebp - 0x72]
mov edx, 0x7932
sub ecx, 0xc065
cmp ecx, 0x9a55fa3a
jns 0x568d57
mov ecx, dword [ebp - 0x9c]
add dword [ebp - 0x6f], eax
mov dword [ebp - 0x90], eax
sub eax, ecx
sub dword [ebp - 0x92], eax
and cx, word [ebp - 0x5e]
mov ecx, eax
mov eax, 0x9c83
mov dword [ebp - 0x69], edx
xor edx, dword [ebp - 0x87]
mov ecx, dword [ebp - 0x2d]
cmp ecx, 0xef70a7a7
je 0x568de5
mov edx, ecx
mov ax, word [ebp - 0x4e]
mov dword [ebp - 0x34], ecx
mov ecx, ecx
mov dword [ebp - 0xae], edx
mov eax, dword [ebp - 0x2f]
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x41], edx
mov eax, ecx
add eax, 0xa9a8
mov dword [ebp - 0x3c], eax
mov eax, dword [0x57bc32]
lea edx, [ebp - 0x93]
test edx, 0x33bda404
je 0x568dd9
sub ecx, dword [ebp - 3]
and ecx, eax
mov dword [ebp - 0x9e], eax
mov dword [ebp - 0x9d], ecx
mov byte [ebp - 0x8f], ah
movzx ecx, byte [ebp - 0x48]
mov dword [ebp - 0x65], ecx
mov dword [ebp - 0x4f], ecx
mov dword [ebp - 0x95], edx
mov dword [ebp - 0x86], ecx
mov dword [ebp - 0x57], edx
mov ecx, dword [ebp - 0x3b]
mov eax, dword [ebp - 0x56]
mov ecx, edx
mov dword [ebp - 0x82], edx
mov edx, dword [ebp - 3]
mov edx, 0x829a
add edx, 0xd49d
add dword [ebp - 0x17], ecx
mov ecx, eax
mov dh, byte [ebp - 0xf]
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x3b], ecx
mov dword [0x57c0a6], eax
mov byte [ebp - 0x5f], dh
mov eax, dword [ebp - 0x82]
push eax
cmp ecx, edx
je 0x568e2c
mov ecx, dword [ebp - 0x1f]
mov ax, word [ebp - 0x14]
movzx ecx, cl
mov eax, dword [0x57b53a]
xor ax, word [ebp - 0x71]
mov dl, byte [ebp - 0x27]
mov dword [ebp - 5], eax
mov eax, eax
mov cx, word [ebp - 0xa5]
add eax, 0xd7e3
mov dh, byte [ebp - 0x82]
mov edx, dword [ebp - 0x4f]
mov edx, eax
sub edx, ecx
add dword [ebp - 0x9d], eax
add edx, edx
test byte [0x57b047], dl
jno 0x568eab
mov dword [ebp - 0x36], edx
mov ecx, dword [ebp - 0x1a]
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x4a]
mov ecx, dword [ebp - 0x71]
mov ecx, 0xe9bf
mov dword [ebp - 4], ecx
mov edx, ecx
mov edx, edx
mov edx, dword [ebp - 0x56]
mov eax, edx
sub ecx, edx
call sub.KERNEL32.dll_CreateProcessInternalA
mov ecx, 0xe7c8
add edx, 0xfb54
add dword [ebp - 0x9d], eax
sub eax, eax
or ecx, ecx
mov edx, dword [ebp - 9]
lea ecx, [ebp - 0x4c]
add ecx, dword [ebp - 8]
mov word [ebp - 0x95], cx
cmp edx, ecx
jne 0x568edf
or edx, 0x5d00
add dword [ebp - 0x7f], ecx
lea ecx, [ebp - 0x59]
movzx eax, dx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x4a]
sub dword [ebp - 0x5b], edx
mov ecx, dword [ebp - 0x40]
mov edx, edx
movzx eax, al
mov dword [ebp - 0x46], edx
add dword [ebp - 0x65], ecx
add edx, dword [ebp - 0x26]
mov dh, dh
mov eax, eax
mov edx, dword [ebp - 0x57]
add eax, 0xa97b
mov ecx, dword [ebp - 1]
movzx edx, cx
mov dword [ebp - 0x3b], edx
mov ecx, 0xcd6d
mov ecx, eax
mov edx, dword [ebp - 0x90]
cmp ecx, ecx
jne 0x568f2c
mov eax, eax
sub dword [ebp - 0x3a], edx
mov edx, dword [ebp - 0x75]
call sub.KERNEL32.dll_SetCommTimeouts
mov eax, dword [ebp - 0x9a]
add ecx, dword [ebp - 0x85]
sub dword [ebp - 0xae], edx
mov eax, dword [0x57b771]
mov eax, dword [ebp - 4]
sub ecx, ecx
and edx, ecx
mov dword [ebp - 0x87], edx
mov cx, 0xf86d
cmp edx, dword [0x57c0b2]
jne 0x568f4b
xor edx, dword [ebp - 0x75]
lea edx, [ebp - 0x54]
mov dword [ebp - 0x42], edx
cmp eax, 0x5133169a
jmp 0x568fd9
pop ecx
leave
ret