Function at 0xf6934
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1c
push 0
push 0
dec ecx
jne 0xf693c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 0x20]
xor eax, eax
push ebp
push 0xf6f87
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor edx, edx
push ebp
push 0xf6ec2
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x6c]
call fcn.00025a70
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
mov edx, 0xf6fa0
call fcn.00013ff4
mov eax, dword [ebp - 0x68]
mov edx, dword [ebp - 4]
call fcn.000f5800
lea eax, [ebp - 0x74]
call fcn.00027684
mov eax, dword [ebp - 0x74]
lea edx, [ebp - 0x70]
call fcn.00027578
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 0xc]
mov ecx, 0xf6fb8
call fcn.00013ff4
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x44
call fcn.00012c70
mov eax, edi
xor ecx, ecx
mov edx, 0x10
call fcn.00012c70
mov dword [ebp - 0x64], 0x44
mov word [ebp - 0x34], 0
mov dword [ebp - 0x38], 1
call fcn.000f6828
test al, al
je 0xf6b0c
push dword [ebp - 0xc]
push 0xf6fd0
lea eax, [ebp - 0x78]
call fcn.00025a70
push dword [ebp - 0x78]
push 0xf6ffc
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00014068
call sub.kernel32.dll_GetTickCount
mov ebx, eax
call fcn.0002cc64
push 0
call sub.kernel32.dll_SetLastError
push edi
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0001416c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
mov dword [ebp - 0x10], eax
call sub.kernel32.dll_GetLastError_1
mov esi, eax
call fcn.0002ccb8
cmp dword [ebp - 0x10], 0
jne 0xf6a9e
lea eax, [ebp - 0x80]
call fcn.00025ad4
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
mov edx, 0xf700c
call fcn.00013ff4
mov eax, dword [ebp - 0x7c]
mov edx, dword [ebp - 4]
call fcn.000f58bc
lea edx, [ebp - 0x84]
mov eax, esi
call fcn.00027478
mov eax, dword [ebp - 0x84]
mov edx, dword [ebp - 4]
call fcn.000f58bc
jmp 0xf6af3
push 0xea60
mov eax, dword [edi]
push eax
call sub.user32.dll_WaitForInputIdle
mov dword [ebp - 0x10], eax
push 0x64
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x10]
push eax
mov eax, dword [edi]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 0x10], 0x103
jne 0xf6add
call sub.kernel32.dll_GetTickCount
mov edx, ebx
call fcn.000292ac
cmp eax, 0xea60
jbe 0xf6aae
cmp dword [ebp - 0x10], 0x103
jne 0xf6af3
mov edx, dword [ebp - 4]
mov eax, 0xf7028
call fcn.000f58bc
mov eax, dword [edi + 4]
test eax, eax
je 0xf6b00
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [edi]
test eax, eax
je 0xf6b0c
push eax
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x8c]
call fcn.00027684
mov eax, dword [ebp - 0x8c]
lea edx, [ebp - 0x88]
call fcn.00027578
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 0xc]
mov ecx, 0xf6fb8
call fcn.00013ff4
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x44
call fcn.00012c70
mov eax, edi
xor ecx, ecx
mov edx, 0x10
call fcn.00012c70
mov dword [ebp - 0x64], 0x44
mov word [ebp - 0x34], 0
mov dword [ebp - 0x38], 1
push dword [ebp - 0xc]
push 0xf7050
lea eax, [ebp - 0x90]
call fcn.00025a70
push dword [ebp - 0x90]
push 0xf707c
lea eax, [ebp - 0x98]
call fcn.0002a83c
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0x94]
call fcn.00027578
push dword [ebp - 0x94]
push 0xf708c
lea eax, [ebp - 0x9c]
call fcn.00025ad4
push dword [ebp - 0x9c]
push 0xf70b0
push 0xf70c0
push 0xf70e4
push 0xf70f0
lea eax, [ebp - 0xc]
mov edx, 0xb
call fcn.00014068
call sub.kernel32.dll_GetTickCount
mov ebx, eax
call fcn.0002cc64
push 0
call sub.kernel32.dll_SetLastError
push edi
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0001416c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
mov dword [ebp - 0x10], eax
call sub.kernel32.dll_GetLastError_1
mov esi, eax
call fcn.0002ccb8
cmp dword [ebp - 0x10], 0
jne 0xf6c78
lea eax, [ebp - 0xa4]
call fcn.00025ad4
mov ecx, dword [ebp - 0xa4]
lea eax, [ebp - 0xa0]
mov edx, 0xf700c
call fcn.00013ff4
mov eax, dword [ebp - 0xa0]
mov edx, dword [ebp - 4]
call fcn.000f58bc
lea edx, [ebp - 0xa8]
mov eax, esi
call fcn.00027478
mov eax, dword [ebp - 0xa8]
mov edx, dword [ebp - 4]
call fcn.000f58bc
jmp 0xf6cd5
push 0xea60
mov eax, dword [edi]
push eax
call sub.user32.dll_WaitForInputIdle
mov dword [ebp - 0x10], eax
push 0x64
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x10]
push eax
mov eax, dword [edi]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 0x10], 0x103
jne 0xf6cb7
call sub.kernel32.dll_GetTickCount
mov edx, ebx
call fcn.000292ac
cmp eax, 0xea60
jbe 0xf6c88
cmp dword [ebp - 0x10], 0x103
jne 0xf6ccd
mov edx, dword [ebp - 4]
mov eax, 0xf7100
call fcn.000f58bc
call fcn.000f6828
mov byte [ebp - 5], al
mov eax, dword [edi + 4]
test eax, eax
je 0xf6ce2
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [edi]
test eax, eax
je 0xf6cee
push eax
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0xb0]
call fcn.00025a70
mov ecx, dword [ebp - 0xb0]
lea eax, [ebp - 0xac]
mov edx, 0xf7128
call fcn.00013ff4
mov eax, dword [ebp - 0xac]
mov edx, dword [ebp - 4]
call fcn.000f5800
lea eax, [ebp - 0xb8]
call fcn.00027684
mov eax, dword [ebp - 0xb8]
lea edx, [ebp - 0xb4]
call fcn.00027578
mov edx, dword [ebp - 0xb4]
lea eax, [ebp - 0xc]
mov ecx, 0xf6fb8
call fcn.00013ff4
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x44
call fcn.00012c70
mov eax, edi
xor ecx, ecx
mov edx, 0x10
call fcn.00012c70
mov dword [ebp - 0x64], 0x44
mov word [ebp - 0x34], 0
mov dword [ebp - 0x38], 1
push dword [ebp - 0xc]
push 0xf7140
lea eax, [ebp - 0xbc]
call fcn.00025a70
push dword [ebp - 0xbc]
push 0xf6ffc
push 0xf7168
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.00014068
call sub.kernel32.dll_GetTickCount
mov ebx, eax
call fcn.0002cc64
push 0
call sub.kernel32.dll_SetLastError
push edi
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0001416c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
mov dword [ebp - 0x10], eax
call sub.kernel32.dll_GetLastError_1
mov esi, eax
call fcn.0002ccb8
cmp dword [ebp - 0x10], 0
jne 0xf6e42
lea eax, [ebp - 0xc4]
call fcn.00025ad4
mov ecx, dword [ebp - 0xc4]
lea eax, [ebp - 0xc0]
mov edx, 0xf71a4
call fcn.00013ff4
mov eax, dword [ebp - 0xc0]
mov edx, dword [ebp - 4]
call fcn.000f58bc
lea edx, [ebp - 0xc8]
mov eax, esi
call fcn.00027478
mov eax, dword [ebp - 0xc8]
mov edx, dword [ebp - 4]
call fcn.000f58bc
jmp 0xf6e9f
push 0xea60
mov eax, dword [edi]
push eax
call sub.user32.dll_WaitForInputIdle
mov dword [ebp - 0x10], eax
push 0x64
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x10]
push eax
mov eax, dword [edi]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 0x10], 0x103
jne 0xf6e81
call sub.kernel32.dll_GetTickCount
mov edx, ebx
call fcn.000292ac
cmp eax, 0xea60
jbe 0xf6e52
cmp dword [ebp - 0x10], 0x103
jne 0xf6e97
mov edx, dword [ebp - 4]
mov eax, 0xf71c0
call fcn.000f58bc
call fcn.000f6828
mov byte [ebp - 5], al
mov eax, dword [edi + 4]
test eax, eax
je 0xf6eac
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [edi]
test eax, eax
je 0xf6eb8
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xf6efb
cmp byte [ebp - 5], 0
je 0xf6f32
lea eax, [ebp - 0xd8]
call fcn.00025a70
mov ecx, dword [ebp - 0xd8]
lea eax, [ebp - 0xd4]
mov edx, 0xf7204
call fcn.00013ff4
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 4]
call fcn.000f5800
jmp 0xf6f61
lea eax, [ebp - 0xe0]
call fcn.00025a70
mov ecx, dword [ebp - 0xe0]
lea eax, [ebp - 0xdc]
mov edx, 0xf7218
call fcn.00013ff4
mov eax, dword [ebp - 0xdc]
mov edx, dword [ebp - 4]
call fcn.000f58bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf6f8e
lea eax, [ebp - 0xe0]
mov edx, 0x1f
call fcn.00013d3c
lea eax, [ebp - 0xc]
call fcn.00013d18
ret