Function at 0x72940d
Capabilities:
Create process on windows

Disassembly:
push 0x330
mov eax, 0x7b0f75
call fcn.00772fd1
push 0x46
pop ecx
mov esi, str.S55h8kyuq9tqhqF6ZOWPBQZ9ujzlcmmfsGfvSmJrMdvYOXwD2He8V0AA4Kj2clTrx84lokivJNGPINtNlLjyY0uvabbtzgo99GSwSUJWhMadrUFN4NpbeoyDiYAJCYg8dDBtMCQwYZboIvSWqmQbhSWMokYnIkMOFkQOVQxjGvaJK3083oIr06wu7q6QmTlofIEgPOWGsYt1OFQLO8W0bstyHj4YqB1XeRDGUV2H6qYJnauYdHMTAhml0VACNHrmPAvY6OJmenJGqCwnxFAPpjgooR
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x12c]
mov ebx, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
push 0x58
pop ecx
mov dword [ebp - 0x2dc], eax
xor eax, eax
movsw word es:[edi], word [esi]
mov dword [ebp - 0x2e8], eax
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 0x2e0], eax
movsb byte es:[edi], byte [esi]
mov esi, str.LnMXrUYg5PN3GH6Y7ZCOUv1pH6YKGKgbPkK0bJ374dDDtTRQIG5UEcELbMH2R0SROaosFgg7xvdTDcDDugRpWX2kwLgUqO0Mbgp8fYwIXCSbOYtF65yhnm0qJILivHKKikitOqeKIHmtEBLn2dwWQ3efJyIYbi4T1eikVgNqEauL0AzQVK5riAiSCLtONXW8jhNLN8HEfi5Xk7x9czvMPeGLJyr3dq41ioSilvPStwK2a4KRZImjxcU6d6EvkhMJ86wttxOsEKZjDzTFh2dMIsQaK6kIVdC0nKFiUYDbUtVPnTbTJGpD3cljRdGNADmRvl0lyvGJVSr2YpcCA753avS3Z3sYKZj9BD
lea edi, [ebp - 0x290]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x2d8]
lea eax, [ebp - 0x12c]
push eax
call fcn.00405a50
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x2e8]
call fcn.004082f0
push 0
push 1
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], 0
call fcn.004096c0
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x2d8]
call fcn.00405a50
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x2e8]
call fcn.004082f0
xor edi, edi
lea ecx, [ebp - 0x2d8]
push edi
push 1
call fcn.004096c0
push 0x44
pop esi
push esi
lea eax, [ebp - 0x33c]
push edi
push eax
call fcn.0074fc20
push 0x10
lea eax, [ebp - 0x2f8]
mov dword [ebp - 0x33c], esi
push edi
push eax
call fcn.0074fc20
add esp, 0x18
xor edx, edx
xor eax, eax
mov dword [ebp - 0x298], edx
mov word [ebp - 0x2a8], ax
push 7
pop ecx
mov dword [ebp - 0x294], ecx
mov dword [ebp - 0x2ac], ecx
mov dword [ebp - 0x2b0], edx
mov word [ebp - 0x2c0], ax
mov byte [ebp - 4], 4
or esi, 0xffffffff
mov edi, dword [ebp - 0x2dc]
test edi, edi
je 0x7295d5
cmp word [edi], dx
jne 0x72954c
mov eax, edx
jmp 0x729553
push edi
call fcn.0075fe99
pop ecx
push eax
push edi
lea ecx, [ebp - 0x2c0]
call fcn.00402820
cmp dword [ebp - 0x2b0], 0
je 0x7295d3
mov edi, 0x813adc
push edi
call fcn.0075fe99
pop ecx
push eax
push edi
lea ecx, [ebp - 0x2a8]
call fcn.00402820
xor eax, eax
cmp word [ebx], ax
je 0x729590
push ebx
call fcn.0075fe99
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x2a8]
call fcn.004044c0
call fcn.006f2c80
mov edi, 0x827c30
push edi
call fcn.0075fe99
pop ecx
push eax
push edi
lea ecx, [ebp - 0x2a8]
call fcn.004044c0
push esi
xor ebx, ebx
lea eax, [ebp - 0x2c0]
push ebx
push eax
lea ecx, [ebp - 0x2a8]
call fcn.004045f0
jmp 0x7295f4
xor edx, edx
cmp word [ebx], dx
jne 0x7295de
mov eax, edx
jmp 0x7295e5
push ebx
call fcn.0075fe99
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x2a8]
call fcn.00402820
xor ebx, ebx
cmp dword [ebp - 0x294], 8
lea ecx, [ebp - 0x2f8]
push ecx
lea ecx, [ebp - 0x33c]
push ecx
push ebx
push ebx
lea eax, [ebp - 0x2a8]
cmovae eax, dword [ebp - 0x2a8]
xor edi, edi
push ebx
inc edi
push edi
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x72962f
mov esi, ebx
jmp 0x729667
cmp byte [ebp + 0x10], 0
je 0x72964f
call fcn.00402330
cmp dword [ebp + 0x14], 0
cmovg esi, dword [ebp + 0x14]
push esi
push dword [ebp - 0x2f8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x2f8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2f4]
call esi
mov esi, edi
push ebx
push edi
lea ecx, [ebp - 0x2c0]
call fcn.00402760
push ebx
push edi
lea ecx, [ebp - 0x2a8]
call fcn.00402760
lea ecx, [ebp - 0x2e8]
call fcn.006ec102
mov eax, esi
call fcn.00772f7b
ret