Function at 0x412890
Capabilities:
Create process on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xd0
mov eax, dword [0x43000c]
lea esi, [esp + 0x90]
mov edi, edx
mov edx, ecx
mov ecx, esi
xor eax, ebp
mov dword [esp + 0xc8], eax
call fcn.00413af0
mov ecx, esi
call fcn.0041b8b0
xor ecx, ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
movsd qword [esp + 0x24], xmm1
movsd qword [esp + 0x1c], xmm0
movsd xmm0, qword [eax + 0x10]
movsd qword [esp + 0x2c], xmm0
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], 7
mov word [eax], 0
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov eax, ecx
sub eax, esi
cmp eax, 2
jb 0x412b01
lea eax, [esp + 0x1c]
lea edx, [esi + 2]
cmp ecx, 7
mov ebx, eax
mov dword [eax + 0x10], edx
jbe 0x412929
mov ebx, dword [esp + 0x1c]
mov dword [ebx + esi*2], 0x200022
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x30]
mov word [ebx + esi*2 + 4], 0
xor esi, esi
mov dword [esp + 0xc0], esi
mov dword [esp + 0xc4], esi
movsd xmm0, qword [eax + 0x10]
movsd qword [esp + 0xc0], xmm0
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
movsd qword [esp + 0xb0], xmm0
movsd qword [esp + 0xb8], xmm1
mov dword [ecx], esi
mov dword [edx], 7
mov word [eax], 0
mov ecx, dword [esp + 0x30]
cmp ecx, 8
jb 0x4129ac
mov eax, dword [esp + 0x1c]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x412f2a
push edx
push eax
call fcn.004286a1
add esp, 8
mov ecx, dword [esp + 0xa4]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 7
mov word [esp + 0x1c], 0
cmp ecx, 8
jb 0x4129f0
mov eax, dword [esp + 0x90]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x412f45
push edx
push eax
call fcn.004286a1
add esp, 8
mov ebx, dword [edi]
mov eax, dword [edi + 4]
cmp ebx, eax
jne 0x412b37
lea edi, [esp + 0xb0]
xor ebx, ebx
cmp dword [esp + 0xc4], 7
xorps xmm0, xmm0
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x1c], 0x44
movaps xmmword [esp + 0x90], xmm0
jbe 0x412a6a
mov edi, dword [esp + 0xb0]
lea eax, [esp + 0x90]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push ebx
push 0x8000020
push ebx
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x412abc
cmp byte [ebp + 8], 0
je 0x412aa2
push 0xffffffffffffffff
push dword [esp + 0x94]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x90]
call esi
push dword [esp + 0x94]
call esi
mov bl, 1
mov ecx, dword [esp + 0xc4]
cmp ecx, 8
jb 0x412ae9
mov eax, dword [esp + 0xb0]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x412f60
push edx
push eax
call fcn.004286a1
add esp, 8
mov ecx, dword [esp + 0xc8]
xor ecx, ebp
call fcn.00429010
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
mov al, byte [esp + 0xc0]
lea ecx, [esp + 0x2c]
mov byte [esp + 4], al
mov eax, 2
mov dword [esp + 8], 0x42cc6a
mov dword [esp + 0xc], eax
mov dword [esp], eax
call fcn.00401360
lea ecx, [eax + 0x10]
lea edx, [eax + 0x14]
jmp 0x41293f
xor esi, esi
lea edi, [esp + 0xb0]
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov ecx, ebx
mov esi, dword [ebx + 0x10]
cmp dword [ebx + 0x14], 0xf
jbe 0x412b59
mov ecx, dword [ebx]
cmp esi, 0xf
ja 0x412e4e
movsd xmm0, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov eax, 0xf
movsd qword [esp + 0x24], xmm1
movsd qword [esp + 0x1c], xmm0
mov dword [esp + 0x2c], esi
lea esi, [esp + 0x60]
lea edx, [esp + 0x1c]
mov dword [esp + 0x30], eax
mov ecx, esi
call fcn.00413af0
mov ecx, esi
call fcn.0041b8b0
xor esi, esi
mov dword [esp + 0x88], esi
mov dword [esp + 0x8c], esi
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
movsd qword [esp + 0x80], xmm1
movsd qword [esp + 0x78], xmm0
movsd xmm0, qword [eax + 0x10]
movsd qword [esp + 0x88], xmm0
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], 7
mov word [eax], 0
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x88]
mov edx, ecx
sub edx, eax
cmp edx, 2
jb 0x412dcd
lea edx, [eax + 2]
cmp ecx, 7
lea ecx, [esp + 0x78]
mov dword [esp + 0x88], edx
jbe 0x412c11
mov ecx, dword [esp + 0x78]
mov dword [ecx + eax*2], 0x200022
mov word [ecx + eax*2 + 4], 0
lea eax, [esp + 0x78]
lea ecx, [esp + 0x8c]
lea edx, [esp + 0x88]
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], esi
movsd xmm0, qword [eax + 0x10]
movsd qword [esp + 0xa0], xmm0
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
movsd qword [esp + 0x90], xmm0
movsd qword [esp + 0x98], xmm1
mov dword [edx], esi
mov dword [ecx], 7
mov word [eax], 0
lea ecx, [esp + 0x90]
mov eax, dword [esp + 0xa0]
cmp dword [esp + 0xa4], 7
jbe 0x412c94
mov ecx, dword [esp + 0x90]
mov esi, dword [esp + 0xc4]
mov edx, dword [esp + 0xc0]
mov dword [esp + 8], ecx
mov ecx, esi
sub ecx, edx
cmp ecx, eax
jb 0x412e06
mov dword [esp + 0x10], esi
lea esi, [edx + eax]
cmp dword [esp + 0x10], 7
mov ecx, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0xc0], esi
mov esi, edi
jbe 0x412cd6
mov esi, dword [esp + 0xb0]
add eax, eax
lea ecx, [esi + edx*2]
push eax
push dword [esp + 0xc]
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov eax, dword [esp + 0xc]
mov word [esi + eax*2], 0
mov ecx, dword [esp + 0xa4]
xor esi, esi
cmp ecx, 8
jb 0x412d22
mov eax, dword [esp + 0x90]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x412eb0
push edx
push eax
call fcn.004286a1
add esp, 8
mov ecx, dword [esp + 0x8c]
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 7
mov word [esp + 0x90], 0
cmp ecx, 8
jb 0x412d6c
mov eax, dword [esp + 0x78]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x412ed1
push edx
push eax
call fcn.004286a1
add esp, 8
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 7
mov word [esp + 0x78], 0
cmp ecx, 8
jb 0x412db0
mov eax, dword [esp + 0x60]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x412ef2
push edx
push eax
call fcn.004286a1
add esp, 8
mov eax, dword [esp + 0x30]
cmp eax, 0x10
jae 0x412e2c
mov eax, dword [esp + 0x14]
add ebx, 0x18
cmp eax, ebx
je 0x412a04
jmp 0x412b44
sub esp, 0x10
mov al, byte [esp + 0xa0]
lea ecx, [esp + 0x88]
mov byte [esp + 4], al
mov eax, 2
mov dword [esp + 8], 0x42cc6a
mov dword [esp + 0xc], eax
mov dword [esp], eax
call fcn.00401360
lea edx, [eax + 0x10]
lea ecx, [eax + 0x14]
jmp 0x412c31
sub esp, 0x10
mov cl, byte [esp + 0x28]
mov byte [esp + 4], cl
mov dword [esp + 0xc], eax
mov dword [esp], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 8], ecx
mov ecx, edi
call fcn.00401360
jmp 0x412cf3
mov ecx, dword [esp + 0x1c]
lea edx, [eax + 1]
cmp edx, 0x1000
jae 0x412f0f
push edx
push ecx
call fcn.004286a1
add esp, 8
jmp 0x412db9
mov dword [esp + 8], ecx
mov ecx, esi
mov eax, 0x7fffffff
or ecx, 0xf
cmp ecx, eax
cmovae ecx, eax
cmp ecx, 0xfff
mov dword [esp + 0xc], ecx
jae 0x412e97
lea eax, [ecx + 1]
push eax
call fcn.0042866c
add esp, 4
lea ecx, [esi + 1]
mov dword [esp + 0x1c], eax
push ecx
push dword [esp + 0xc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0xc]
jmp 0x412b7c
lea eax, [ecx + 0x24]
push eax
call fcn.0042866c
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x412e79
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x412f7b
add ecx, ecx
xor esi, esi
add ecx, 0x25
mov edx, ecx
jmp 0x412d18
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x412f7b
add ecx, ecx
xor esi, esi
add ecx, 0x25
mov edx, ecx
jmp 0x412d62
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x412f7b
add ecx, ecx
xor esi, esi
add ecx, 0x25
mov edx, ecx
jmp 0x412da6
mov esi, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, esi
cmp ecx, 0x20
jae 0x412f7b
add eax, 0x24
mov ecx, esi
xor esi, esi
mov edx, eax
jmp 0x412e3f
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x412f7b
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x4129a2
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x412f7b
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x4129e6
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x412f7b
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x412adf
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3