Function at 0x438e94
Capabilities:
Create process on windows
Resume thread

Disassembly:
push 0x2b8
mov eax, 0x6bfe0c
call fcn.00432a44
mov ebx, ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x2c4], eax
mov dword [ebp - 0x28c], ecx
mov dword [eax], ecx
mov dword [ebp - 4], ecx
xor eax, eax
lea edi, [ebp - 0x2c0]
mov dword [ebp - 0x294], ecx
stosd dword es:[edi], eax
mov esi, ecx
mov dword [ebp - 0x298], ecx
mov dword [ebp - 0x29c], ecx
mov dword [ebp - 0x2b0], ecx
stosd dword es:[edi], eax
mov dword [ebp - 0x290], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x2ac], ecx
mov dword [ebp - 0x2a8], ecx
mov dword [ebp - 0x2a4], ecx
mov dword [ebp - 0x2a0], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x288]
call fcn.004366f5
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x21c]
call fcn.00438a18
mov edi, eax
test edi, edi
js 0x4393c3
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x288]
call fcn.00439500
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0x28c]
push 2
push 1
push esi
push eax
call edi
push eax
push dword [ebx]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call fcn.004050cb
mov edi, eax
test edi, edi
js 0x4393c3
push dword [ebp - 0x28c]
lea ecx, [ebp - 0x2ac]
call fcn.0043968c
cmp dword [ebx + 0x1c], esi
je 0x438fb5
push 1
push 1
push dword [ebx + 0x1c]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push eax
call fcn.004050cb
mov edi, eax
test edi, edi
js 0x439399
mov eax, dword [ebx + 0x1c]
lea ecx, [ebp - 0x2ac]
push eax
mov dword [ebp - 0x294], eax
call fcn.0043968c
push 1
push 1
push dword [ebx + 0x20]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push eax
call fcn.004050cb
mov edi, eax
test edi, edi
js 0x43934f
mov eax, dword [ebx + 0x20]
lea ecx, [ebp - 0x2ac]
push eax
mov dword [ebp - 0x298], eax
call fcn.0043968c
push 1
push 1
push dword [ebx + 0x24]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push eax
call fcn.004050cb
mov edi, eax
test edi, edi
js 0x43934f
mov eax, dword [ebx + 0x24]
lea ecx, [ebp - 0x2ac]
push eax
mov dword [ebp - 0x29c], eax
call fcn.0043968c
push 1
push 1
push dword [ebx + 0x28]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push eax
call fcn.004050cb
mov edi, eax
test edi, edi
js 0x43934f
mov esi, dword [ebx + 0x28]
lea ecx, [ebp - 0x2ac]
push esi
mov dword [ebp - 0x2b0], esi
call fcn.0043968c
push 0x439430
lea ecx, [ebp - 0x288]
call fcn.00439500
push 0x10
push 9
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x28c]
call fcn.00439d4f
add esp, 0x10
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x288]
push eax
call fcn.00439500
push 0x438e68
lea ecx, [ebp - 0x288]
call fcn.00439500
push dword [ebx + 4]
lea ecx, [ebp - 0x288]
call fcn.00439500
push 0x438e70
lea ecx, [ebp - 0x288]
call fcn.00439500
push 0x27
lea eax, [ebp - 0x284]
push eax
lea eax, [ebx + 8]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0x288]
call fcn.00439500
push 0x439450
lea ecx, [ebp - 0x288]
call fcn.00439500
push 0x10
push 9
lea eax, [ebp - 0x230]
push eax
push dword [ebx + 0x18]
call fcn.00439d4f
add esp, 0x10
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x288]
push eax
call fcn.00439500
mov edi, 0x438e78
lea ecx, [ebp - 0x288]
push edi
call fcn.00439500
push 0x10
push 9
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x294]
call fcn.00439d4f
add esp, 0x10
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x288]
push eax
call fcn.00439500
push edi
lea ecx, [ebp - 0x288]
call fcn.00439500
push 0x10
push 9
lea eax, [ebp - 0x230]
push eax
mov eax, dword [ebp - 0x298]
push eax
call fcn.00439d4f
add esp, 0x10
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x288]
push eax
call fcn.00439500
push edi
lea ecx, [ebp - 0x288]
call fcn.00439500
push 0x10
push 9
lea eax, [ebp - 0x230]
push eax
mov eax, dword [ebp - 0x29c]
push eax
call fcn.00439d4f
add esp, 0x10
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x288]
push eax
call fcn.00439500
push edi
lea ecx, [ebp - 0x288]
call fcn.00439500
push 0x10
push 9
lea eax, [ebp - 0x230]
push eax
push esi
call fcn.00439d4f
add esp, 0x10
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x288]
push eax
call fcn.00439500
cmp byte [ebx + 0x2c], 0
mov eax, 0x439458
jne 0x4391ff
mov eax, 0x43946c
push eax
lea ecx, [ebp - 0x288]
call fcn.00439500
cmp byte [ebx + 0x2d], 0
mov eax, 0x439480
jne 0x43921b
mov eax, 0x4394a0
push eax
lea ecx, [ebp - 0x288]
call fcn.00439500
cmp byte [0x6fe824], 0
je 0x439240
push 0x4394c0
lea ecx, [ebp - 0x288]
call fcn.00439500
push ecx
lea ecx, [ebp - 0x290]
call fcn.00438d4c
mov esi, dword [ebp - 0x290]
mov edi, eax
test edi, edi
js 0x43934f
mov eax, dword [ebp - 0x2a8]
push 0
push 0
shl eax, 2
push eax
push dword [ebp - 0x2ac]
push 0x20002
push 0
push esi
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x439298
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00435aec
mov edi, eax
test edi, edi
js 0x43934f
mov edi, dword [ebp - 0x288]
cmp dword [edi - 4], 1
jle 0x4392b8
push dword [edi - 0xc]
lea ecx, [ebp - 0x288]
call fcn.00439c6c
mov edi, dword [ebp - 0x288]
push 0x44
lea eax, [ebp - 0x280]
mov dword [ebp - 0x284], 0x48
push 0
push eax
call fcn.00436326
add esp, 0xc
mov dword [ebp - 0x240], esi
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x284]
push eax
push 0
push 0
push 0x80084
push 1
push 0
push 0
push edi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push eax
call fcn.004050cb
push 0xffffffffffffffff
lea ecx, [ebp - 0x288]
mov edi, eax
call fcn.00439c15
test edi, edi
jne 0x43934f
push dword [ebp - 0x2c0]
mov ecx, 0x70f780
call fcn.00438db9
push dword [ebp - 0x2bc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x2c4]
mov eax, dword [ebp - 0x2c0]
and dword [ebp - 0x2c0], edi
mov dword [ecx], eax
mov eax, dword [ebp - 0x294]
mov ebx, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x439366
push 0
push 1
push eax
call ebx
mov eax, dword [ebp - 0x298]
test eax, eax
je 0x439377
push 0
push 1
push eax
call ebx
mov eax, dword [ebp - 0x29c]
test eax, eax
je 0x439388
push 0
push 1
push eax
call ebx
mov eax, dword [ebp - 0x2b0]
test eax, eax
je 0x439399
push 0
push 1
push eax
call ebx
cmp dword [ebp - 0x2bc], 0
je 0x4393ae
push dword [ebp - 0x2bc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c0], 0
je 0x4393c3
push dword [ebp - 0x2c0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x288]
lea ecx, [ecx - 0x10]
call fcn.0040119b
mov byte [ebp - 4], 1
cmp dword [ebp - 0x2ac], 0
je 0x4393ee
push dword [ebp - 0x2ac]
call fcn.004030a8
pop ecx
mov byte [ebp - 4], 0
test esi, esi
je 0x439404
push esi
call dword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
push esi
call fcn.004030a8
pop ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28c], 0
je 0x439424
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x28c], 0
mov eax, edi
call fcn.00402698
ret 4