Function at 0x447240
Capabilities:
Access peb ldr_data
Create process on windows
Create process suspended
Delete file
Get common file path
Get process heap flags
Get process heap force flags
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x290
mov eax, dword [0x707be0]
mov dword [ebp - 0x264], edx
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x268], eax
test eax, eax
jne 0x4479a0
mov eax, dword [sym.imp.advapi32.dll_RegSetValueExA]
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 0x593c3c
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x593c3e
mov dword [esp], ebx
mov dword [ebp - 0x26c], eax
call eax
sub esp, 0x18
mov esi, eax
cmp eax, 5
je 0x447a50
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x285
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.unable_to_set_AeDebug_auto:_ret_ld_n
call fcn.00444b30
lea eax, [ebp - 0x110]
mov byte [ebp - 0x214], 0
mov dword [esp + 4], eax
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
lea eax, [ebp - 0x214]
sub esp, 8
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x110]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x593ac4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
lea edx, [ebp - 0x25c]
lea ecx, [ebp - 0x258]
sub esp, 0x10
lea eax, [ebp - 0x214]
call fcn.00443c00
mov esi, dword [ebp - 0x264]
mov edi, dword [sym.imp.msvcrt.dll_strlen]
mov dword [esp], esi
call edi
mov ecx, dword [ebp - 0x260]
mov dword [ebp - 0x270], eax
mov dword [esp], ecx
call edi
lea edx, [ebp - 0x214]
mov dword [esp], edx
mov esi, eax
call edi
mov ecx, dword [ebp - 0x270]
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
lea ecx, [ecx + esi + 0x30]
add ecx, eax
mov dword [esp + 8], ecx
mov eax, dword [edx + 0x30]
mov ecx, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x270], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov dword [ebp - 0x274], ecx
call ecx
lea edx, [ebp - 0x214]
sub esp, 0xc
mov esi, eax
mov dword [esp + 0x10], edx
mov ecx, dword [ebp - 0x260]
mov dword [esp + 0xc], ecx
mov eax, dword [ebp - 0x264]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_debugger__s___s____ld___ld
call fcn.00443b30
mov dword [esp], esi
call edi
mov dword [esp + 0x10], esi
add eax, 1
mov dword [esp + 0xc], 1
mov dword [esp + 0x14], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x593caf
mov dword [esp], ebx
mov ebx, dword [ebp - 0x26c]
call ebx
sub esp, 0x18
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x28c
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.unable_to_set_AeDebug_debugger:_ret_ld_n
call fcn.00444b30
mov dword [esp + 8], esi
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov edx, dword [ebp - 0x270]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov dword [ebp - 0x26c], ebx
call ebx
mov esi, dword [ebp - 0x264]
sub esp, 0xc
mov dword [esp], esi
call edi
mov dword [esp + 4], 0
add eax, 0x10
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x270]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x264], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov ecx, dword [ebp - 0x274]
call ecx
sub esp, 0xc
mov ebx, eax
mov dword [esp + 8], esi
lea esi, [ebp - 0x10c]
mov dword [esp + 4], str._s_debugger_crash
mov edi, esi
mov dword [esp], eax
call fcn.00443b30
call fcn.0057d110
mov ecx, dword [ebp - 0x260]
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x292
mov dword [esp + 4], ecx
mov dword [esp], str.running__s..._n
call fcn.00444260
mov eax, dword [ebp - 0x268]
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov ecx, 1
lea eax, [ebp - 0x250]
mov dword [ebp - 0x110], 0x44
mov word [ebp - 0xe0], cx
mov dword [ebp - 0xe4], 1
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x110]
mov dword [esp + 4], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateProcessA]
sub esp, 0x28
mov esi, eax
call fcn.0057d110
mov edx, dword [ebp - 0x264]
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x298
mov eax, dword [edx + 0x34]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.CreateProcess:_err_ld_n
call fcn.00444b30
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov edx, dword [ebp - 0x264]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov ebx, dword [ebp - 0x26c]
call ebx
mov eax, dword [ebp - 0x24c]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 0xc
mov dword [esp], eax
call esi
sub esp, 4
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x29d
mov dword [esp], str.waiting_for_child_exit..._n
call fcn.00444260
mov dword [esp + 4], 0x7530
mov eax, dword [ebp - 0x250]
mov ebx, dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov dword [esp], eax
call ebx
sub esp, 8
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x2ac
xor eax, eax
test edi, edi
sete al
mov dword [esp + 4], str.Timed_out_waiting_for_the_child_to_crash_n
mov dword [esp], eax
call fcn.00444b30
lea eax, [ebp - 0x254]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x250]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
sub esp, 8
mov edi, eax
call fcn.0057d110
mov edx, dword [ebp - 0x264]
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x2ae
mov eax, dword [edx + 0x34]
mov dword [esp], edi
mov dword [esp + 8], eax
mov dword [esp + 4], str.GetExitCodeProcess_failed:_err_ld_n
call fcn.00444b30
mov dword [esp + 4], str.code2
mov ecx, dword [ebp - 0x260]
mov edi, dword [sym.imp.msvcrt.dll_strstr]
mov dword [esp], ecx
call edi
test eax, eax
je 0x4479d0
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x2b4
mov eax, dword [ebp - 0x254]
cmp eax, 0xc0000354
je 0x447a80
mov edx, dword [0x8f0770]
test edx, edx
je 0x447a28
mov dword [esp + 8], eax
mov dword [esp + 4], str.wrong_exit_code_:__08lx_n
mov eax, dword [ebp - 0x268]
mov dword [esp], eax
call fcn.00444b30
mov eax, dword [ebp - 0x250]
mov dword [esp], eax
call esi
sub esp, 4
mov dword [esp + 4], str.order
mov eax, dword [ebp - 0x260]
mov dword [esp], eax
call edi
test eax, eax
je 0x44775a
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x2c1
mov eax, dword [ebp - 0x25c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetEvent]
sub esp, 4
mov dword [esp + 4], str.SetEvent_start_event__failed_n
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
lea edi, [ebp - 0x214]
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x2c3
mov dword [esp], str.waiting_for_the_debugger..._n
call fcn.00444260
mov dword [esp + 4], 0x1388
mov eax, dword [ebp - 0x258]
mov dword [esp], eax
call ebx
sub esp, 8
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x2cf
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 4], str.Timed_out_waiting_for_the_debugger_n
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
lea ecx, [ebp - 0x240]
lea edx, [ebp - 0x214]
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x2d1
mov eax, 0x2d1
mov dword [esp], 0x2c
call fcn.00445c50
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.failed_to_open:__s_n
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x2d3
mov eax, dword [ebp - 0x240]
mov dword [esp + 4], str.wrong_debugger_argument_count:__d_n
cmp eax, 6
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x2d4
mov edx, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x248]
mov dword [esp + 4], str.the_child_and_debugged_pids_dont_match:__ld____ld_n
mov dword [esp + 0xc], edx
cmp edx, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x2d5
mov eax, dword [ebp - 0x234]
mov dword [esp + 4], str.debugger:_SetEvent_debug_event__failed_err_ld_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x238]
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x2d6
mov eax, dword [ebp - 0x22c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x23c]
mov dword [esp + 4], str.DebugActiveProcess__ld__failed_err_ld_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x230]
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x2d7
mov eax, dword [ebp - 0x224]
mov dword [esp + 4], str.DebugSetProcessKillOnExit_FALSE__failed_err_ld_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x228]
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x2d8
mov eax, dword [ebp - 0x21c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x23c]
mov dword [esp + 4], str.DebugActiveProcessStop__ld__failed_err_ld_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x220]
mov dword [esp], eax
call fcn.00444b30
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x2d9
mov eax, dword [ebp - 0x218]
mov dword [esp + 4], str.debugger_reported__lu_failures_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00444b30
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_DeleteFileA]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x279
mov dword [esp], str.Skipping_crash_and_debug_n
call fcn.00444ad0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0057d110
mov dword [eax], 0x59334b
mov edx, dword [ebp - 0x254]
mov dword [eax + 4], 0x2ba
mov eax, 1
cmp edx, 0xc0000005
je 0x447a0c
mov eax, dword [0x8f0770]
test eax, eax
sete cl
xor eax, eax
cmp edx, 0x80
sete al
and eax, ecx
mov dword [esp + 8], edx
mov dword [esp + 4], str.wrong_exit_code_:__08lx_n
mov dword [esp], eax
call fcn.00444b30
jmp 0x447701
cmp eax, 0x80
sete dl
cmp eax, 0xc0000005
sete cl
or edx, ecx
movzx ecx, dl
mov dword [ebp - 0x268], ecx
jmp 0x4476e7
mov dword [0x707be0], 1
call fcn.0057d110
mov dword [eax], 0x59334b
mov dword [eax + 4], 0x281
mov dword [esp], str.No_write_access_to_change_the_debugger_n
call fcn.00444250
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x268], 1
jmp 0x4476e7