Function at 0x77c3f290
Capabilities:
Create process on windows

Disassembly:
push 0xa4
push 0x77c144d0
call fcn.77c37420
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x34], edi
cmp dword [ebp + 8], edi
je 0x77c3f6c6
mov esi, dword [ebp + 0xc]
cmp esi, edi
je 0x77c3f6c6
mov al, byte [esi]
cmp al, 0x77
je 0x77c3f2cb
cmp al, 0x72
jne 0x77c3f6c6
mov al, byte [esi + 1]
cmp al, 0x74
jne 0x77c3f2d9
mov ecx, 0x4000
jmp 0x77c3f2e2
cmp al, 0x62
jne 0x77c3f2e2
mov ecx, 0x8000
or ecx, 0x80
push ecx
push 0x400
lea eax, [ebp - 0x40]
push eax
call sym.msvcrt.dll__pipe
add esp, 0xc
cmp eax, 0xffffffff
je 0x77c3f6c6
xor ebx, ebx
cmp byte [esi], 0x77
jne 0x77c3f316
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], edi
inc ebx
mov dword [ebp - 0x28], ebx
jmp 0x77c3f323
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edi
inc ebx
push 9
call fcn.77c3a535
pop ecx
test eax, eax
jne 0x77c3f348
push dword [ebp - 0x40]
call sym.msvcrt.dll__close
push dword [ebp - 0x3c]
call sym.msvcrt.dll__close
pop ecx
pop ecx
xor eax, eax
jmp 0x77c3f6c9
push 9
call sym.msvcrt.dll__lock
pop ecx
mov dword [ebp - 4], edi
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x44], eax
mov esi, dword [ebp - 0x24]
lea esi, [ebp + esi*4 - 0x40]
mov eax, dword [esi]
push 2
push ebx
push edi
lea ecx, [ebp - 0x30]
push ecx
push dword [ebp - 0x44]
mov ecx, eax
sar ecx, 5
and eax, 0x1f
lea eax, [eax + eax*8]
mov ecx, dword [ecx*4 + sym.msvcrt.dll___pioinfo]
push dword [ecx + eax*4]
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x77c3f691
push dword [esi]
call sym.msvcrt.dll__close
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x50], edi
push dword [ebp + 0xc]
mov eax, dword [ebp - 0x28]
push dword [ebp + eax*4 - 0x40]
call sym.msvcrt.dll__fdopen
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp eax, edi
je 0x77c3f691
xor edi, edi
call fcn.77c3f238
mov dword [ebp - 0x48], eax
test eax, eax
je 0x77c3f67a
push 0x77c11fac
call sym.msvcrt.dll_getenv
pop ecx
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x77c3f415
call sym.msvcrt.dll__errno
cmp dword [eax], 2
je 0x77c3f3ff
call sym.msvcrt.dll__errno
cmp dword [eax], 0xd
jne 0x77c3f415
test byte [0x77c61a19], 0x80
mov eax, 0x77c11f9c
jne 0x77c3f412
mov eax, 0x77c11f94
mov dword [ebp - 0x1c], eax
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0xb4]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xb4], 0x44
mov dword [ebp - 0x88], 0x100
mov eax, dword [sym.msvcrt.dll___pioinfo]
cmp dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0x30]
je 0x77c3f446
mov ecx, dword [eax]
mov dword [ebp - 0x7c], ecx
cmp dword [ebp - 0x2c], ebx
mov ecx, dword [ebp - 0x30]
je 0x77c3f454
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x78], ecx
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x1c]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x77c3f463
sub eax, ecx
mov ecx, eax
mov eax, dword [ebp + 8]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x77c3f474
sub eax, esi
lea eax, [eax + ecx + 5]
push eax
call sym.msvcrt.dll_malloc
pop ecx
mov ebx, eax
mov dword [ebp - 0x38], ebx
test ebx, ebx
je 0x77c3f67a
mov ecx, dword [ebp - 0x1c]
mov edx, ebx
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x77c3f49a
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x77c3f4a7
mov esi, 0x77c144c4
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 8]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c3f4bb
sub eax, esi
mov edi, ebx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x77c3f4c7
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor edi, edi
push edi
push dword [ebp - 0x1c]
call sym.msvcrt.dll__access
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x77c3f513
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0xb4]
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x34], eax
jmp 0x77c3f646
push 0x77c11f34
call sym.msvcrt.dll_getenv
mov dword [ebp - 0x54], eax
mov dword [esp], 0x104
call sym.msvcrt.dll_malloc
pop ecx
mov ebx, eax
mov dword [ebp - 0x5c], ebx
test ebx, ebx
jne 0x77c3f544
push dword [ebp - 0x38]
call sym.msvcrt.dll_free
pop ecx
jmp 0x77c3f67a
push 0x103
push ebx
push dword [ebp - 0x54]
call fcn.77c376ca
add esp, 0xc
mov dword [ebp - 0x54], eax
test eax, eax
je 0x77c3f63a
cmp byte [ebx], 0
je 0x77c3f63a
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c3f56e
sub eax, esi
lea esi, [eax + ebx - 1]
mov dword [ebp - 0x70], esi
mov al, byte [esi]
cmp al, 0x5c
jne 0x77c3f59f
push 0x5c
push ebx
call sym.msvcrt.dll__mbsrchr
pop ecx
pop ecx
cmp esi, eax
je 0x77c3f5b5
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x77c3f595
jmp 0x77c3f5ae
cmp al, 0x2f
je 0x77c3f5b5
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x77c3f5a6
mov esi, 0x77c11f30
movsw word es:[edi], word [esi]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c3f5ba
sub eax, edx
mov edi, eax
mov eax, dword [ebp - 0x1c]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c3f5cb
sub eax, esi
add eax, edi
cmp eax, 0x104
jae 0x77c3f63a
mov eax, dword [ebp - 0x1c]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x77c3f5e2
sub eax, edx
mov edi, ebx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x77c3f5ee
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
push ebx
call sym.msvcrt.dll__access
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x77c3f544
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0xb4]
push eax
xor eax, eax
push eax
push eax
push eax
push 1
push eax
push eax
push dword [ebp - 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x34], eax
push ebx
call sym.msvcrt.dll_free
pop ecx
mov ebx, dword [ebp - 0x38]
xor edi, edi
push ebx
call sym.msvcrt.dll_free
pop ecx
push dword [ebp - 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x68]
call esi
cmp dword [ebp - 0x34], edi
je 0x77c3f675
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x48]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ecx], eax
jmp 0x77c3f6bd
mov eax, dword [ebp - 0x48]
mov dword [eax], edi
push dword [ebp - 0x20]
call sym.msvcrt.dll_fclose
pop ecx
mov eax, dword [ebp - 0x28]
and dword [ebp + eax*4 - 0x50], 0
and dword [ebp - 0x20], 0
xor edi, edi
mov eax, dword [ebp - 0x24]
shl eax, 2
cmp dword [ebp + eax - 0x50], edi
je 0x77c3f6a7
push dword [ebp + eax - 0x40]
call sym.msvcrt.dll__close
pop ecx
mov eax, dword [ebp - 0x28]
shl eax, 2
cmp dword [ebp + eax - 0x50], edi
je 0x77c3f6bd
push dword [ebp + eax - 0x40]
call sym.msvcrt.dll__close
pop ecx
or dword [ebp - 4], 0xffffffff
call fcn.77c3f6cf
mov eax, dword [ebp - 0x20]
call fcn.77c3745b
ret