Function at 0x447760
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f5c2
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x228
mov eax, dword [0x4e20c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x108], ecx
mov eax, dword [ebx + 0x10]
xorps xmm0, xmm0
mov edx, dword [ebx + 8]
mov ecx, 0x4cf638
mov dword [ebp - 0xbc], 0
mov esi, 0x4c9f3c
push edx
cmp byte [eax], 0
movlpd qword [ebp - 0xa4], xmm0
cmove ecx, esi
movlpd qword [ebp - 0x9c], xmm0
mov dword [ebp - 0xcc], ecx
lea ecx, [ebp - 0x180]
movlpd qword [ebp - 0x94], xmm0
movlpd qword [ebp - 0x8c], xmm0
movlpd qword [ebp - 0x84], xmm0
movlpd qword [ebp - 0x7c], xmm0
movlpd qword [ebp - 0x74], xmm0
movlpd qword [ebp - 0x6c], xmm0
mov dword [ebp - 0xa8], 0x44
movups xmmword [ebp - 0xb8], xmm0
call fcn.00414050
mov dword [ebp - 0xc4], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebx + 0xc]
mov ecx, dword [ecx]
mov byte [ebp - 4], 2
lea edi, [ebp - 0x16]
nop dword [eax]
mov eax, 0xcccccccd
sub edi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [edi], cx
mov ecx, edx
test ecx, ecx
jne 0x447840
lea eax, [ebp - 0x16]
mov dword [ebp - 0x104], edi
mov dword [ebp - 0xf0], edx
xorps xmm0, xmm0
mov dword [ebp - 0xec], edx
movups xmmword [ebp - 0x100], xmm0
cmp edi, eax
jne 0x4478a1
xor eax, eax
mov dword [ebp - 0xf0], edx
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
jmp 0x447950
lea esi, [ebp - 0x16]
sub esi, edi
sar esi, 1
cmp esi, 0x7ffffffe
ja 0x447e3b
cmp esi, 7
ja 0x4478e8
mov dword [ebp - 0xf0], esi
lea eax, [ebp - 0x100]
add esi, esi
mov dword [ebp - 0xec], 7
push esi
push edi
push eax
call fcn.004702a0
add esp, 0xc
xor eax, eax
mov word [ebp + esi - 0x100], ax
jmp 0x447950
mov eax, esi
or eax, 7
cmp eax, 0x7ffffffe
jbe 0x4478fb
mov eax, 0x7ffffffe
jmp 0x447905
mov ecx, 0xa
cmp eax, ecx
cmovb eax, ecx
mov dword [ebp - 0xd0], eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.004259a0
mov ecx, dword [ebp - 0xd0]
mov edi, eax
mov dword [ebp - 0xf0], esi
add esi, esi
push esi
push dword [ebp - 0x104]
mov dword [ebp - 0x100], edi
push edi
mov dword [ebp - 0xec], ecx
call fcn.004702a0
add esp, 0x14
xor eax, eax
mov word [esi + edi], ax
mov esi, 2
mov dword [ebp - 0xbc], 2
mov dword [ebp - 0xbc], esi
and esi, 0xfffffffd
mov dword [ebp - 0xbc], esi
mov dword [ebp - 4], 1
or esi, 1
mov ecx, dword [ebp - 0x108]
mov dword [ebp - 0xbc], esi
add ecx, 0x10
mov byte [ebp - 4], 3
mov eax, 0x7ffffffe
mov edx, dword [ecx + 0x10]
sub eax, edx
cmp eax, 4
jb 0x447e40
cmp dword [ecx + 0x14], 7
jbe 0x4479a6
mov ecx, dword [ecx]
push 4
push 0x4cf64c
push edx
push ecx
push ecx
push dword [ebp - 0x44]
lea ecx, [ebp - 0x168]
call fcn.00421500
or esi, 4
mov dword [ebp - 0xbc], esi
mov byte [ebp - 4], 4
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x168]
push eax
push dword [ebp - 0x44]
lea ecx, [ebp - 0x150]
call fcn.00421350
or esi, 8
mov dword [ebp - 0xbc], esi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x150]
push 2
push 0x4cf644
call fcn.00413e60
xor ecx, ecx
mov dword [ebp - 0xd8], 0
or esi, 0x10
mov dword [ebp - 0xd4], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xe8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xd8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov dword [ebp - 0xbc], esi
mov byte [ebp - 4], 6
lea eax, [ebp - 0xe8]
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x138]
push eax
push dword [ebp - 0x44]
call fcn.00421350
or esi, 0x20
mov dword [ebp - 0xbc], esi
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x138]
push 1
push 0x4cf640
call fcn.00413e60
push dword [ebp - 0xcc]
mov dword [ebp - 0x110], 0
lea edx, [ebp - 0x120]
mov dword [ebp - 0x10c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x120], xmm0
xor ecx, ecx
or esi, 0x40
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x120], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x110], xmm0
mov word [eax], cx
lea ecx, [ebp - 0x5c]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov dword [ebp - 0xbc], esi
call fcn.0041bc80
add esp, 4
mov byte [ebp - 4], 8
and esi, 0xffffffbf
mov dword [ebp - 0xbc], esi
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x120]
call fcn.00416650
and esi, 0xffffffdf
mov dword [ebp - 0xbc], esi
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x138]
call fcn.00416650
and esi, 0xffffffef
mov dword [ebp - 0xbc], esi
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xe8]
call fcn.00416650
and esi, 0xfffffff7
mov dword [ebp - 0xbc], esi
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x150]
call fcn.00416650
and esi, 0xfffffffb
mov dword [ebp - 0xbc], esi
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x168]
call fcn.00416650
and esi, 0xfffffffe
mov dword [ebp - 0xbc], esi
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x100]
call fcn.00416650
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x180]
call fcn.00416650
cmp dword [ebp - 0x48], 7
lea ecx, [ebp - 0xb8]
push ecx
lea ecx, [ebp - 0xa8]
push ecx
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x5c]
cmova eax, dword [ebp - 0x5c]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x447cc7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [ebp - 4], 0x10
sub esp, 8
mov dword [ebp - 0xc4], eax
lea ecx, [ebp - 0xc8]
mov eax, esp
mov dword [ebp - 0xc8], 0x20000000
push 0x1a
push str.CreateProcess___failed:_
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xe8]
mov dword [eax], 1
call fcn.0043bd80
or esi, 0x100
mov dword [ebp - 0xbc], esi
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x238]
push 0xb8
push 0
push eax
call fcn.004709e0
add esp, 0x1c
lea ecx, [ebp - 0x238]
push 0x4e2b9c
call fcn.004324d0
or esi, 0x200
lea edx, [ebp - 0xe8]
mov dword [ebp - 0xbc], esi
lea ecx, [ebp - 0x228]
cmp dword [ebp - 0xd4], 7
push dword [ebp - 0xd8]
cmova edx, dword [ebp - 0xe8]
call fcn.0043cec0
add esp, 4
lea eax, [ebp - 0x228]
push eax
call fcn.0043a020
and esi, 0xfffffdff
add esp, 4
mov dword [ebp - 0xbc], esi
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x238]
call fcn.004325d0
and esi, 0xfffffeff
mov dword [ebp - 0xbc], esi
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xe8]
call fcn.00416650
mov byte [ebp - 0xbd], 0
jmp 0x447e06
push 0xffffffffffffffff
push dword [ebp - 0xb8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x44]
mov byte [ebp - 0xbd], 0
push eax
push dword [ebp - 0xb8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x447de5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [ebp - 4], 0x12
sub esp, 8
mov dword [ebp - 0xc4], eax
lea ecx, [ebp - 0xc8]
mov eax, esp
mov dword [ebp - 0xc8], 0x20000000
push 0x1f
push str.GetExitCodeProcess___failed:_
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xe8]
mov dword [eax], 1
call fcn.0043bd80
or esi, 0x400
mov dword [ebp - 0xbc], esi
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x238]
push 0xb8
push 0
push eax
call fcn.004709e0
add esp, 0x1c
lea ecx, [ebp - 0x238]
push 0x4e2b9c
call fcn.004324d0
or esi, 0x800
lea edx, [ebp - 0xe8]
mov dword [ebp - 0xbc], esi
lea ecx, [ebp - 0x228]
cmp dword [ebp - 0xd4], 7
push dword [ebp - 0xd8]
cmova edx, dword [ebp - 0xe8]
call fcn.0043cec0
add esp, 4
lea eax, [ebp - 0x228]
push eax
call fcn.0043a020
and esi, 0xfffff7ff
add esp, 4
mov dword [ebp - 0xbc], esi
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x238]
call fcn.004325d0
and esi, 0xfffffbff
mov dword [ebp - 0xbc], esi
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xe8]
call fcn.00416650
jmp 0x447df0
cmp dword [ebp - 0x44], 0
sete byte [ebp - 0xbd]
push dword [ebp - 0xb8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xb4]
call esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00416650
mov al, byte [ebp - 0xbd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046ea75
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
call fcn.00403770
call fcn.00403770
int3