Function at 0x402300
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 4]
enter 0x204, 0
push ebx
push ecx
push edx
mov dword [ebp - 4], esp
lea eax, [ebp - 0x104]
push eax
call fcn.004036b0
mov edi, 0x405424
lea esi, [ebp - 0x104]
call fcn.00401940
mov al, byte [0x405424]
mov byte [0x405a56], al
cmp byte [0x405a56], 0
jbe 0x402357
movzx eax, byte [0x405a56]
cmp byte [eax + 0x405424], 0x5c
je 0x402357
dec byte [0x405a56]
jmp 0x402335
movzx eax, byte [0x405a56]
dec eax
mov byte [0x405424], al
mov edi, 0x405524
mov esi, 0x405424
call fcn.00401940
dec byte [0x405a56]
cmp byte [0x405a56], 0
jbe 0x4023b4
movzx eax, byte [0x405a56]
cmp byte [eax + 0x405424], 0x5c
jne 0x4023ac
push 0x4043cb
push 0xff
push 0x405424
movzx eax, al
push eax
call fcn.00402a80
dec byte [0x405a56]
jmp 0x40237a
call fcn.00403650
test eax, eax
jle 0x4023dd
lea eax, [ebp - 0x104]
push eax
push 1
call fcn.004032e0
mov edi, 0x404526
lea esi, [ebp - 0x104]
call fcn.00401940
jmp 0x402411
lea eax, [ebp - 0x104]
push eax
call fcn.004036b0
mov edi, 0x404526
lea esi, [ebp - 0x104]
call fcn.00401940
push 0xff
push edi
movzx eax, byte [0x404526]
sub eax, 3
push eax
push 4
call fcn.00402b10
call fcn.00403650
cmp eax, 1
jle 0x402439
lea eax, [ebp - 0x104]
push eax
push 2
call fcn.004032e0
mov edi, 0x404729
lea esi, [ebp - 0x104]
call fcn.00401940
mov al, byte [0x404729]
mov byte [0x405a56], al
cmp byte [0x405a56], 0
jbe 0x40247d
movzx eax, byte [0x405a56]
cmp byte [eax + 0x404729], 0x5c
jne 0x402475
push 0x4043cd
push 0xff
push 0x404729
movzx eax, al
push eax
call fcn.00402a80
dec byte [0x405a56]
jmp 0x402443
call fcn.00403650
cmp eax, 2
jle 0x4024a5
lea eax, [ebp - 0x104]
push eax
push 3
call fcn.004032e0
mov edi, 0x404629
lea esi, [ebp - 0x104]
call fcn.00401940
mov al, byte [0x404629]
mov byte [0x405a56], al
cmp byte [0x405a56], 0
jbe 0x4024e9
movzx eax, byte [0x405a56]
cmp byte [eax + 0x404629], 0x5c
jne 0x4024e1
push 0x4043cf
push 0xff
push 0x404629
movzx eax, al
push eax
call fcn.00402a80
dec byte [0x405a56]
jmp 0x4024af
mov esi, 0x404526
lea edi, [ebp - 0x104]
call fcn.00401b30
mov esi, 0x4043d1
call fcn.00401af0
mov edi, 0x40441c
lea esi, [ebp - 0x104]
call fcn.00401940
mov esi, 0x404526
lea edi, [ebp - 0x104]
call fcn.00401b30
mov esi, 0x4043d5
call fcn.00401af0
mov edi, 0x404526
lea esi, [ebp - 0x104]
call fcn.00401940
mov eax, esi
push eax
push edi
call fcn.00403160
mov edi, 0x404526
lea esi, [ebp - 0x104]
call fcn.00401940
mov eax, esi
push eax
push 0x40441c
call fcn.00403160
mov edi, 0x40441c
lea esi, [ebp - 0x104]
call fcn.00401940
mov byte [0x404046], 0
push 0x405778
push 0x404526
call fcn.00401e60
push 0x405778
call fcn.00401ee0
mov byte [0x404046], 2
call fcn.004028f0
test eax, eax
jne 0x402774
push 0x4058e8
push 0x40441c
call fcn.00401e60
push 0x4058e8
call fcn.00401210
call fcn.004028f0
test eax, eax
jne 0x402723
push 0x405778
call fcn.00402c60
test al, al
jne 0x402721
push 0x405778
push 0xff
push 0x405324
call fcn.004030e0
call fcn.00402bc0
push 0x4043da
push 0x405324
call fcn.00402b60
test eax, eax
jle 0x402652
push 0x4043de
push 0x405324
call fcn.00402b60
mov byte [0x405a56], al
push 0xff
push 0x405324
movzx eax, al
push eax
push 3
call fcn.00402b10
push 0x405424
push 0xff
push 0x405324
movzx eax, byte [0x405a56]
push eax
call fcn.00402a80
jmp 0x4025f8
push 0x4043e2
push 0x405324
call fcn.00402b60
test eax, eax
jle 0x4026ac
push 0x4043e6
push 0x405324
call fcn.00402b60
mov byte [0x405a56], al
push 0xff
push 0x405324
movzx eax, al
push eax
push 3
call fcn.00402b10
push 0x404729
push 0xff
push 0x405324
movzx eax, byte [0x405a56]
push eax
call fcn.00402a80
jmp 0x402652
push 0x4043ea
push 0x405324
call fcn.00402b60
test eax, eax
jle 0x402706
push 0x4043ee
push 0x405324
call fcn.00402b60
mov byte [0x405a56], al
push 0xff
push 0x405324
movzx eax, al
push eax
push 3
call fcn.00402b10
push 0x404629
push 0xff
push 0x405324
movzx eax, byte [0x405a56]
push eax
call fcn.00402a80
jmp 0x4026ac
push 0x4058e8
push 0x405324
push 0
call fcn.004029f0
call fcn.00402910
jmp 0x4025cd
jmp 0x40274c
mov esi, 0x4043f2
lea edi, [ebp - 0x104]
call fcn.00401b30
mov esi, 0x40441c
call fcn.00401af0
mov eax, edi
push eax
call fcn.00402890
push 0
call fcn.00402860
push 0x4058e8
call fcn.00401d90
call fcn.004028f0
test eax, eax
je 0x40275f
push 0x405778
call fcn.00401d90
call fcn.004028f0
test eax, eax
je 0x402772
jmp 0x40279d
mov esi, 0x404400
lea edi, [ebp - 0x104]
call fcn.00401b30
mov esi, 0x404526
call fcn.00401af0
mov eax, edi
push eax
call fcn.00402890
push 0
call fcn.00402860
push 0x405724
push 0x44
call fcn.00402840
mov esi, 0x40440b
lea edi, [ebp - 0x204]
call fcn.00401b30
mov esi, 0x40441c
call fcn.00401af0
mov esi, edi
lea edi, [ebp - 0x104]
call fcn.00401b30
mov esi, 0x404418
call fcn.00401af0
mov edi, 0x405624
lea esi, [ebp - 0x104]
call fcn.00401940
mov esi, 0x405524
lea edi, [ebp - 0x104]
call fcn.00401b30
mov esi, 0x40441a
call fcn.00401af0
mov edi, 0x405524
lea esi, [ebp - 0x104]
call fcn.00401940
push 0x405768
push 0x405724
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0x405625
push 0
call sub.kernel32.dll_CreateProcessA
test al, al
jne 0x40283a
pop edx
pop ecx
pop ebx
leave
pop ebp
ret