Function at 0x420800
Capabilities:
Create process on windows
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ae8f
mov eax, dword fs:[0]
push eax
sub esp, 0x674
mov eax, dword [0x449f6c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
lea eax, [ebp - 0x4ec]
push eax
call fcn.004219f0
add esp, 4
call fcn.00420700
mov edi, eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x4d4], edi
cmp edi, esi
je 0x420fcb
mov ecx, 1
mov edx, 0x44bb58
lock cmpxchg dword [edx], ecx
cmp byte [edi + 0x127c], 0
jne 0x42087c
cmp eax, esi
je 0x420892
jmp 0x420fc9
cmp eax, esi
je 0x420892
push 0xbaad0101
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x410
lea ecx, [ebp - 0x4a2]
xor eax, eax
push esi
push ecx
mov dword [ebp - 0x4c4], esi
mov word [ebp - 0x4a4], ax
call fcn.00428a90
xor edx, edx
mov dword [ebp - 0x4a8], 7
mov dword [ebp - 0x4ac], esi
mov word [ebp - 0x4bc], dx
xor eax, eax
xor ecx, ecx
push 0x40
mov word [ebp - 0x30], cx
lea ecx, [ebp - 0x52c]
push esi
push ecx
mov dword [ebp - 4], esi
mov word [ebp - 0x50], ax
mov dword [ebp - 0x4e], eax
mov dword [ebp - 0x4a], eax
mov dword [ebp - 0x46], eax
mov dword [ebp - 0x42], eax
mov dword [ebp - 0x3e], eax
mov dword [ebp - 0x3a], eax
mov dword [ebp - 0x36], eax
mov word [ebp - 0x32], ax
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], eax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
mov word [ebp - 0x90], dx
mov dword [ebp - 0x8e], eax
mov dword [ebp - 0x8a], eax
mov dword [ebp - 0x86], eax
mov dword [ebp - 0x82], eax
mov dword [ebp - 0x7e], eax
mov dword [ebp - 0x7a], eax
mov dword [ebp - 0x76], eax
mov word [ebp - 0x72], ax
mov word [ebp - 0x70], ax
mov dword [ebp - 0x6e], eax
mov dword [ebp - 0x6a], eax
mov dword [ebp - 0x66], eax
mov dword [ebp - 0x62], eax
mov dword [ebp - 0x5e], eax
mov dword [ebp - 0x5a], eax
mov dword [ebp - 0x56], eax
mov word [ebp - 0x52], ax
mov dword [ebp - 0x530], esi
call fcn.00428a90
mov dword [ebp - 0x4e4], esi
xor eax, eax
lea esi, [edi + 0x228]
push 1
push esi
mov dword [ebp - 0x4e0], eax
mov dword [ebp - 0x4dc], eax
mov dword [ebp - 0x4d8], eax
call fcn.004221b0
push str.CrashReport.exe
push esi
call fcn.00423bd7
add esp, 0x28
test eax, eax
jne 0x4209c9
push str.CrashReport.exe
call fcn.00422420
add esp, 4
cmp eax, 2
jb 0x4209c9
push 0xbaad0103
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, dword [edi + 4]
push 0x1780
push 0
push ebx
call fcn.00428a90
mov dword [ebx], 0xc
mov dword [ebx + 8], 0x1780
mov dword [ebx + 4], 0x90909090
mov edx, dword [edi + 0x1280]
add esp, 0xc
mov dword [ebx + 0x1700], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
mov dword [ebx + 0x18], eax
mov dword [ebp - 0x4c8], ecx
push eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x4c8], eax
pop eax
mov eax, dword [ebp - 0x4c8]
mov dword [ebx + 0x28], eax
mov dword [ebp - 0x4cc], ecx
push eax
mov eax, dword fs:[0x30]
mov dword [ebp - 0x4cc], eax
pop eax
mov eax, dword [ebx + 0x28]
mov edx, dword [ebp - 0x4cc]
mov dword [ebx + 0x30], edx
cmp eax, ecx
je 0x420a5d
mov ecx, dword [eax + 8]
mov dword [ebx + 0x14], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x10], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [ecx], 0x88888888
jne 0x420a73
mov byte [ebx + 0x16f9], 0
jmp 0x420a7f
mov dl, byte [edi + 0x127b]
mov byte [ebx + 0x16f9], dl
movzx ecx, byte [edi + 0x1278]
mov byte [ebx + 0x16fb], cl
mov dl, byte [edi + 0x1279]
push 0x104
mov byte [ebx + 0x16fa], dl
movzx ecx, byte [edi + 0x127c]
push esi
lea edx, [ebx + 0x7e6]
push 0x105
push edx
mov byte [ebx + 0x16f8], cl
mov dword [ebx + 0x354], eax
call fcn.00424f73
push 0x104
lea eax, [edi + 0x63c]
push eax
lea ecx, [ebx + 0xe04]
push 0x105
push ecx
call fcn.00424f73
push 0x104
lea edx, [edi + 0x846]
push edx
lea eax, [ebx + 0x9f0]
push 0x105
push eax
call fcn.00424f73
push 0x104
lea ecx, [edi + 0xa50]
push ecx
lea edx, [ebx + 0xbfa]
push 0x105
push edx
call fcn.00424f73
add esp, 0x40
push 0x104
lea eax, [edi + 0x432]
push eax
lea ecx, [ebx + 0x100e]
push 0x105
push ecx
call fcn.00424f73
push 0x104
lea edx, [edi + 0xe64]
push edx
lea eax, [ebx + 0x1256]
push 0x105
push eax
call fcn.00424f73
push 0x104
lea ecx, [edi + 0x106e]
push ecx
lea edx, [ebx + 0x1460]
push 0x105
push edx
call fcn.00424f73
push 0x1e
lea eax, [edi + 0xc5a]
push eax
lea ecx, [ebx + 0x1218]
push 0x1f
push ecx
call fcn.00424f73
add esp, 0x40
push 0x1e
push 0x44ba88
lea edx, [ebx + 0x166a]
push 0x1f
push edx
call fcn.00424f73
push 0x1e
push 0x44ba48
lea eax, [ebx + 0x16a8]
push 0x1f
push eax
call fcn.00424f73
push 0x1e
push 0x44bb08
push 0x1f
lea ecx, [ebx + 0x1704]
push ecx
call fcn.00424f73
push 0x1e
push 0x44bac8
lea edx, [ebx + 0x1742]
push 0x1f
push edx
call fcn.00424f73
mov eax, dword [0x44ba3c]
add esp, 0x40
mov dword [ebx + 0x16f4], eax
mov ecx, dword [0x44bb48]
mov dword [ebx + 0x16f0], ecx
mov edx, dword [0x44bb4c]
push 0x104
add edi, 0x1e
push edi
mov dword [ebx + 0x16e8], edx
mov eax, dword [0x44bb50]
lea ecx, [ebx + 0x5dc]
push 0x105
push ecx
mov dword [ebx + 0x16ec], eax
call fcn.00424f73
mov edx, dword [ebp + 8]
mov esi, dword [edx + 4]
mov eax, edx
lea edi, [ebx + 0x88]
mov ecx, 0xb3
rep movsd dword es:[edi], dword [esi]
mov esi, dword [eax]
lea edi, [ebx + 0x38]
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x4d0]
push ecx
lea edx, [ebp - 0x4a4]
mov edi, 0x208
push edx
mov dword [ebp - 0x4d0], edi
call fcn.00421720
add esp, 0x18
test eax, eax
je 0x420c84
push str.CrashReport.exe
lea eax, [ebp - 0x4a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp word [ebp - 0x4a4], 0
je 0x420f4a
push 0x10
push 0x10
lea ecx, [ebp - 0x50]
push ecx
push ebx
call fcn.00424a12
mov esi, dword [ebp - 0x4d4]
mov eax, dword [esi + 0x1284]
push 0xa
push 0x10
lea edx, [ebp - 0x30]
push edx
push eax
call fcn.00424a12
mov edx, dword [ebx + 0x18]
push 0xa
push 0x10
lea ecx, [ebp - 0x90]
push ecx
push edx
call fcn.00424a12
mov ecx, dword [ebx + 0x1c]
push 0xa
push 0x10
lea eax, [ebp - 0x70]
push eax
push ecx
call fcn.00424a12
add esp, 0x40
push 0x43f49c
lea edx, [ebp - 0x4c0]
push edx
lea eax, [ebp - 0x5f4]
push eax
call fcn.0040b590
lea ecx, [ebp - 0x4a4]
push ecx
push eax
lea edx, [ebp - 0x62c]
push edx
mov byte [ebp - 4], 1
call fcn.0040b590
push 0x43f494
push eax
lea eax, [ebp - 0x5bc]
push eax
mov byte [ebp - 4], 2
call fcn.0040b590
push 0x43f480
push eax
lea ecx, [ebp - 0x664]
push ecx
mov byte [ebp - 4], 3
call fcn.0040b590
lea edx, [ebp - 0x50]
push edx
push eax
lea eax, [ebp - 0x584]
push eax
mov byte [ebp - 4], 4
call fcn.0040b590
push 0x43f47c
push eax
lea ecx, [ebp - 0x680]
push ecx
mov byte [ebp - 4], 5
call fcn.0040b590
add esp, 0x48
lea edx, [ebp - 0x90]
push edx
push eax
lea eax, [ebp - 0x648]
push eax
mov byte [ebp - 4], 6
call fcn.0040b590
push 0x43f47c
push eax
lea ecx, [ebp - 0x54c]
push ecx
mov byte [ebp - 4], 7
call fcn.0040b590
lea edx, [ebp - 0x70]
push edx
push eax
lea eax, [ebp - 0x5d8]
push eax
mov byte [ebp - 4], 8
call fcn.0040b590
push 0x43f47c
push eax
lea ecx, [ebp - 0x5a0]
push ecx
mov byte [ebp - 4], 9
call fcn.0040b590
lea edx, [ebp - 0x30]
push edx
push eax
lea eax, [ebp - 0x568]
push eax
mov byte [ebp - 4], 0xa
call fcn.0040b590
push 0x43f478
push eax
lea ecx, [ebp - 0x610]
push ecx
mov byte [ebp - 4], 0xb
call fcn.0040b590
add esp, 0x48
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x4c0]
mov byte [ebp - 4], 0xc
call fcn.0040e6d0
lea ecx, [ebp - 0x610]
call fcn.0040e6a0
lea ecx, [ebp - 0x568]
call fcn.0040e6a0
lea ecx, [ebp - 0x5a0]
call fcn.0040e6a0
lea ecx, [ebp - 0x5d8]
call fcn.0040e6a0
lea ecx, [ebp - 0x54c]
call fcn.0040e6a0
lea ecx, [ebp - 0x648]
call fcn.0040e6a0
lea ecx, [ebp - 0x680]
call fcn.0040e6a0
lea ecx, [ebp - 0x584]
call fcn.0040e6a0
lea ecx, [ebp - 0x664]
call fcn.0040e6a0
lea ecx, [ebp - 0x5bc]
call fcn.0040e6a0
lea ecx, [ebp - 0x62c]
call fcn.0040e6a0
lea ecx, [ebp - 0x5f4]
call fcn.0040e6a0
cmp dword [ebp - 0x4ac], edi
jae 0x420f50
cmp dword [ebp - 0x4a8], 8
mov eax, dword [ebp - 0x4bc]
jae 0x420eac
lea eax, [ebp - 0x4bc]
push 0x207
push eax
lea edx, [ebp - 0x4a4]
push edi
push edx
call fcn.00424f73
lea eax, [ebp - 0x4c4]
push eax
mov dword [ebp - 0x4c4], 0
call fcn.00420400
add esp, 0x14
test eax, eax
jne 0x420ee5
movzx eax, byte [esi + 0x1279]
jmp 0x420eeb
mov eax, dword [ebp - 0x4c4]
lea ecx, [ebp - 0x4a4]
test eax, eax
je 0x420f02
push 0
push ecx
call fcn.0041fdd0
add esp, 8
jmp 0x420f2f
lea edx, [ebp - 0x4e4]
push edx
lea eax, [ebp - 0x530]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push ecx
push 0
mov dword [ebp - 0x530], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x4c4], eax
test eax, eax
je 0x420f50
mov edx, dword [esi + 0x1284]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x420f50
mov esi, dword [ebp - 0x4d4]
mov eax, dword [ebp - 0x4e4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x420f63
push eax
call edi
mov eax, dword [ebp - 0x4e0]
test eax, eax
je 0x420f70
push eax
call edi
cmp dword [ebp - 0x4c4], 0
je 0x420fb1
cmp byte [esi + 0x127a], 0
je 0x420fb1
cmp byte [esi + 0x127c], 0
je 0x420fb1
push 0xbaad0102
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
call edi
push 0xbaad0102
push 0xffffffffffffffff
call edi
push 0
mov ecx, esi
call fcn.00420360
cmp dword [ebp - 0x4a8], 8
jb 0x420fc9
mov eax, dword [ebp - 0x4bc]
push eax
call fcn.00423e76
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004239c1
mov esp, ebp
pop ebp
ret 4