Function at 0x6ef6f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7733d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3fc
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xe0]
push ecx
call fcn.006f0000
add esp, 8
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
lea ecx, [ebp - 0x110]
call fcn.00448e3c
jmp 0x6ef74b
lea ecx, [ebp - 0x110]
call fcn.0047a43a
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x1ac]
call fcn.00448e3c
lea edx, [ebp - 0x1ac]
push edx
lea ecx, [ebp - 0x110]
call fcn.00459618
movzx eax, al
neg eax
sbb eax, eax
add eax, 1
movzx ecx, al
test ecx, ecx
je 0x6ef84b
mov dword [ebp - 0x3bc], 0x78b5ec
mov edx, dword [ebp - 0x3bc]
add edx, 1
mov dword [ebp - 0x3c0], edx
mov eax, dword [ebp - 0x3bc]
mov cl, byte [eax]
mov byte [ebp - 0x3c1], cl
add dword [ebp - 0x3bc], 1
cmp byte [ebp - 0x3c1], 0
jne 0x6ef7a1
mov edx, dword [ebp - 0x3bc]
sub edx, dword [ebp - 0x3c0]
mov dword [ebp - 0x3c8], edx
mov eax, dword [ebp - 0x3c8]
push eax
push 0x78b5ec
lea ecx, [ebp - 0xe0]
call fcn.0044beb8
lea ecx, [ebp - 0x110]
call fcn.00468765
push eax
lea ecx, [ebp - 0x1c8]
push ecx
call fcn.006f0000
add esp, 8
mov dword [ebp - 0x3cc], eax
mov edx, dword [ebp - 0x3cc]
mov dword [ebp - 0x264], edx
mov byte [ebp - 4], 1
mov eax, dword [0x7d4aa0]
push eax
push 0
mov ecx, dword [ebp - 0x264]
push ecx
lea ecx, [ebp - 0xe0]
call fcn.0044be11
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x1c8]
call fcn.0041c8f0
jmp 0x6ef740
lea edx, [ebp - 0x26d]
mov dword [ebp - 0x26c], edx
push 0
push 0
lea ecx, [ebp - 0x108]
call fcn.00449c25
mov byte [ebp - 4], 2
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0xe0]
push ecx
call fcn.005db2f0
add esp, 8
mov dword [ebp - 0xb0], 0
lea edx, [ebp - 0x279]
mov dword [ebp - 0x278], edx
push 0
push 0
lea ecx, [ebp - 0x64]
call fcn.00449c25
mov byte [ebp - 4], 3
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x280], ecx
cmp dword [ebp - 0x280], 0x104
jbe 0x6ef9de
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x1a4]
call fcn.005d05a0
mov byte [ebp - 4], 4
mov al, byte [ebp - 0x11c]
mov byte [ebp - 0x281], al
movzx ecx, byte [ebp - 0x281]
test ecx, ecx
je 0x6ef9cf
lea edx, [ebp - 0x64]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.005db2f0
add esp, 8
lea ecx, [ebp - 0x1e8]
push ecx
lea ecx, [ebp - 0x1a4]
call fcn.005d2a20
mov dword [ebp - 0x288], eax
mov edx, dword [ebp - 0x288]
xor eax, eax
cmp dword [edx + 0x14], 0
sete al
mov byte [ebp - 0x1c9], al
push 0
push 1
lea ecx, [ebp - 0x1e8]
call fcn.0041c8f0
movzx ecx, byte [ebp - 0x1c9]
test ecx, ecx
je 0x6ef9a9
mov dword [ebp - 0x3d0], str..EXE
mov edx, dword [ebp - 0x3d0]
add edx, 2
mov dword [ebp - 0x3d4], edx
mov eax, dword [ebp - 0x3d0]
mov cx, word [eax]
mov word [ebp - 0x3d6], cx
add dword [ebp - 0x3d0], 2
cmp word [ebp - 0x3d6], 0
jne 0x6ef960
mov edx, dword [ebp - 0x3d0]
sub edx, dword [ebp - 0x3d4]
sar edx, 1
mov dword [ebp - 0x3dc], edx
mov eax, dword [ebp - 0x3dc]
push eax
push str..EXE
lea ecx, [ebp - 0x64]
call fcn.004608b4
cmp dword [ebp - 0x4c], 8
jb 0x6ef9ba
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x3e0], ecx
jmp 0x6ef9c3
lea edx, [ebp - 0x60]
mov dword [ebp - 0x3e0], edx
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1a4]
call fcn.005d0f40
lea ecx, [ebp - 0xac]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 0xac], 0x44
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x80], 0x80
xor edx, edx
mov word [ebp - 0x7a], dx
mov dword [ebp - 0x78], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0xe8], eax
mov byte [ebp - 0xc1], 0
cmp dword [ebp + 0x14], 0
je 0x6efa7c
push 2
push 1
push 0
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp - 0xe8]
push ecx
mov edx, dword [ebp + 0x14]
mov ecx, dword [edx]
call fcn.00734ae0
push eax
mov eax, dword [ebp - 0xe8]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov byte [ebp - 0xc1], 1
push 1
mov ecx, dword [ebp + 0x14]
call fcn.00734ce0
jmp 0x6efabf
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x6efab8
push 2
push 1
push 0
lea ecx, [ebp - 0x74]
push ecx
mov edx, dword [ebp - 0xe8]
push edx
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
mov eax, dword [ebp - 0xe8]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov byte [ebp - 0xc1], 1
jmp 0x6efabf
mov dword [ebp - 0x74], 0
cmp dword [ebp + 0x18], 0
je 0x6efaf7
push 2
push 1
push 0
lea ecx, [ebp - 0x70]
push ecx
mov edx, dword [ebp - 0xe8]
push edx
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
call fcn.00734b00
push eax
mov ecx, dword [ebp - 0xe8]
push ecx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov byte [ebp - 0xc1], 1
jmp 0x6efb3a
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x6efb33
push 2
push 1
push 0
lea edx, [ebp - 0x70]
push edx
mov eax, dword [ebp - 0xe8]
push eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
mov ecx, dword [ebp - 0xe8]
push ecx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov byte [ebp - 0xc1], 1
jmp 0x6efb3a
mov dword [ebp - 0x70], 0
cmp dword [ebp + 0x1c], 0
je 0x6efb72
push 2
push 1
push 0
lea edx, [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0xe8]
push eax
mov ecx, dword [ebp + 0x1c]
mov ecx, dword [ecx]
call fcn.00734b00
push eax
mov edx, dword [ebp - 0xe8]
push edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov byte [ebp - 0xc1], 1
jmp 0x6efbb5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x6efbae
push 2
push 1
push 0
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0xe8]
push ecx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
mov edx, dword [ebp - 0xe8]
push edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov byte [ebp - 0xc1], 1
jmp 0x6efbb5
mov dword [ebp - 0x6c], 0
cmp dword [ebp + 0x18], 0
je 0x6efbc5
push 2
mov ecx, dword [ebp + 0x18]
call fcn.00734ce0
cmp dword [ebp + 0x1c], 0
je 0x6efbd5
push 2
mov ecx, dword [ebp + 0x1c]
call fcn.00734ce0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x6efbec
mov ecx, dword [ebp - 0x80]
or ecx, 0x100
mov dword [ebp - 0x80], ecx
lea edx, [ebp - 0x291]
mov dword [ebp - 0x290], edx
push 0
push 0
lea ecx, [ebp - 0x48]
call fcn.00449c25
mov byte [ebp - 4], 5
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.005db2f0
add esp, 8
xor edx, edx
cmp dword [ebp - 0x34], 0
sete dl
movzx eax, dl
test eax, eax
je 0x6efc34
mov dword [ebp - 0x3e4], 0
jmp 0x6efc5a
cmp dword [ebp - 0x30], 8
jb 0x6efc45
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x3e8], ecx
jmp 0x6efc4e
lea edx, [ebp - 0x44]
mov dword [ebp - 0x3e8], edx
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x3e4], eax
mov ecx, dword [ebp - 0x3e4]
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xec], 0
lea ecx, [ebp - 0x2c]
call fcn.004808a4
mov byte [ebp - 4], 6
mov edx, dword [ebp + 0x20]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x2a0], eax
xor ecx, ecx
cmp dword [ebp - 0x2a0], 0
sete cl
movzx edx, cl
test edx, edx
jne 0x6efd1f
mov eax, dword [ebp + 0x20]
push eax
lea ecx, [ebp - 0x200]
push ecx
call fcn.006eee00
add esp, 8
mov dword [ebp - 0x3ec], eax
mov edx, dword [ebp - 0x3ec]
mov dword [ebp - 0x3f0], edx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x3f0]
push eax
lea ecx, [ebp - 0x2c]
call fcn.006f1360
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x200]
call fcn.0044ce11
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x200]
mov dword [ebp - 0x328], ecx
mov edx, dword [ebp - 0x328]
push edx
call fcn.00481e6e
add esp, 4
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
jne 0x6efd12
call fcn.0048d4e7
xor ecx, ecx
jne 0x6efd12
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0xec], edx
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
neg eax
sbb eax, eax
and eax, 0xf8000000
add eax, 0x8000000
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xf0], 8
jb 0x6efd4d
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x3f4], eax
jmp 0x6efd59
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x3f4], ecx
lea edx, [ebp - 0xc0]
push edx
lea eax, [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0xe4]
push ecx
mov edx, dword [ebp - 0xec]
push edx
mov eax, dword [ebp - 0x10]
push eax
movzx ecx, byte [ebp - 0xc1]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x3f4]
push edx
mov eax, dword [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x74], 0
je 0x6efdac
mov ecx, dword [ebp - 0x74]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x70], 0
je 0x6efdbc
mov edx, dword [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x6c], 0
je 0x6efdcc
mov eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0
je 0x6efec8
mov ecx, dword [ebp - 0xbc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
call fcn.00481e3f
add esp, 4
mov dword [ebp - 0x20c], eax
mov byte [ebp - 4], 9
cmp dword [ebp - 0x20c], 0
je 0x6efe21
mov edx, dword [ebp - 0xb8]
push edx
mov eax, dword [ebp - 0xc0]
push eax
mov ecx, dword [ebp - 0x20c]
call fcn.006ef2d0
mov dword [ebp - 0x3f8], eax
jmp 0x6efe2b
mov dword [ebp - 0x3f8], 0
mov ecx, dword [ebp - 0x3f8]
mov dword [ebp - 0x208], ecx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x208]
mov dword [ebp - 0x204], edx
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2c]
call fcn.0044ce11
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x32c], eax
mov ecx, dword [ebp - 0x32c]
push ecx
call fcn.00481e6e
add esp, 4
mov byte [ebp - 4], 3
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.00449c25
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.00449c25
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x108]
call fcn.00449c25
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0xe0]
call fcn.0041c8f0
mov eax, dword [ebp - 0x204]
jmp 0x6effe4
lea edx, [ebp - 0x335]
mov dword [ebp - 0x334], edx
push 0
push 0
lea ecx, [ebp - 0x258]
call fcn.0041c8f0
mov dword [ebp - 0x3fc], str.Cannot_launch_process
mov eax, dword [ebp - 0x3fc]
add eax, 1
mov dword [ebp - 0x400], eax
mov ecx, dword [ebp - 0x3fc]
mov dl, byte [ecx]
mov byte [ebp - 0x401], dl
add dword [ebp - 0x3fc], 1
cmp byte [ebp - 0x401], 0
jne 0x6efefc
mov eax, dword [ebp - 0x3fc]
sub eax, dword [ebp - 0x400]
mov dword [ebp - 0x408], eax
mov ecx, dword [ebp - 0x408]
push ecx
push str.Cannot_launch_process
lea ecx, [ebp - 0x258]
call fcn.0041c1a0
mov byte [ebp - 4], 0xb
push 0
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x23c]
call fcn.005c9b50
push 0x827c60
lea ecx, [ebp - 0x23c]
push ecx
call fcn.0048d568
mov byte [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x258]
call fcn.0041c8f0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2c]
call fcn.0044ce11
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c]
call fcn.00449c1c
mov byte [ebp - 4], 3
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.00449c25
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.00449c25
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x108]
call fcn.00449c25
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0xe0]
call fcn.0041c8f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret