Function at 0x427520
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
xor ebx, ebx
push edi
push 0x44
lea eax, [ebp - 0x88]
push ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
call fcn.00408720
xor eax, eax
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x44]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push 0x25
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
call fcn.00430b5c
mov edi, eax
cmp edi, ebx
jge 0x42758a
push 0x449dbc
jmp 0x4276ae
lea eax, [ebp - 8]
push eax
push 0x449daa
push dword [ebp - 0x10]
call fcn.00430b92
mov edi, eax
cmp edi, ebx
jge 0x4275ab
push 0x449d88
jmp 0x4276ae
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
dec eax
je 0x427644
dec eax
je 0x4275ca
mov edi, 0x8000ffff
push 0x449d58
jmp 0x4276ae
lea eax, [ebp - 0x14]
push eax
mov eax, dword [esi + 8]
push dword [eax + 0x24]
push 1
call fcn.004207ce
mov edi, eax
cmp edi, ebx
jge 0x4275f9
mov eax, dword [esi + 8]
push dword [eax]
push 0x447f78
push edi
call fcn.004317fa
add esp, 0xc
jmp 0x4278d1
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x70]
mov eax, dword [eax]
push dword [eax + 0x18]
push dword [ebp - 0x14]
call fcn.00430b92
mov edi, eax
cmp edi, ebx
jge 0x427620
push 0x447f56
jmp 0x4276ae
push dword [ebp - 0xc]
lea eax, [ebp - 4]
push dword [ebp - 8]
push 0x449d1c
push eax
call fcn.004302dc
mov edi, eax
add esp, 0x10
cmp edi, ebx
jge 0x42766e
push 0x449cf6
jmp 0x4276ae
mov eax, dword [esi + 8]
push dword [eax + 0x8c]
lea eax, [ebp - 4]
push dword [ebp - 8]
push 0x449ca0
push eax
call fcn.004302dc
mov edi, eax
add esp, 0x10
cmp edi, ebx
jge 0x42766e
push 0x449c78
jmp 0x4276ae
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x4276bb
cmp word [eax], bx
je 0x4276bb
push ebx
push 0x449c6a
lea eax, [ebp - 4]
push eax
call fcn.0042ff32
mov edi, eax
cmp edi, ebx
jge 0x427696
push 0x449c38
jmp 0x4276ae
push ebx
push dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
call fcn.0042ff32
mov edi, eax
cmp edi, ebx
jge 0x4276bb
push 0x449c08
push edi
call fcn.004317fa
pop ecx
pop ecx
jmp 0x4278d1
mov eax, dword [ebp - 0xc]
cmp eax, ebx
jne 0x4276cb
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x8c]
push dword [ebp - 4]
push eax
push dword [esi + 0x10]
call fcn.0041bce6
push eax
mov eax, dword [esi + 8]
push dword [eax]
push dword [ebp + 0xc]
call fcn.0041c036
push eax
push 0x2000012d
push 1
call fcn.0040c33a
add esp, 0x1c
lea eax, [ebp - 0x1c]
push eax
lea ebx, [ebp - 0x24]
call fcn.00427386
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jge 0x42771b
push 0x449bc8
push edi
call fcn.004317fa
pop ecx
pop ecx
jmp 0x4278cf
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x88]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x88], 0x44
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x42778f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42775e
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x427769
mov edi, 0x80004005
push edi
push 0x145
push 0x449a3c
call fcn.0043180e
push dword [ebp - 8]
push 0x447d36
push edi
call fcn.004317fa
add esp, 0xc
jmp 0x4278cf
push 2
pop edi
push dword [ebp + 0x14]
xor ebx, ebx
lea eax, [ebp - 0x44]
inc ebx
push eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], 0x32
call dword [ebp + 0x10]
cmp eax, ebx
je 0x4277b4
test eax, eax
jne 0x42781d
lea eax, [ebp - 0x18]
push eax
push 0x1f4
push dword [ebp - 0x34]
call fcn.0042ec5e
mov edi, eax
cmp edi, 0x80070102
je 0x42778f
test edi, edi
js 0x427844
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x427851
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4277f8
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
js 0x427803
mov edi, 0x80004005
push edi
push 0x15c
push 0x449a3c
call fcn.0043180e
push 0x449ba6
jmp 0x42770e
xor ecx, ecx
cmp eax, edi
setne cl
lea edi, [ecx - 0x7ff8f9be]
push edi
push 0x14f
push 0x449a3c
call fcn.0043180e
push 0x449b70
jmp 0x42770e
push dword [ebp - 8]
push 0x447cb2
jmp 0x427781
mov eax, dword [ebp - 0x18]
mov ecx, 0xbc2
cmp eax, 0x80070bc2
jne 0x427865
mov eax, ecx
mov dword [ebp - 0x18], eax
xor edi, edi
cmp eax, edi
je 0x427896
cmp eax, ebx
je 0x427899
cmp eax, ecx
je 0x42788f
cmp eax, 0x240005
je 0x42788f
cmp eax, 0x240006
je 0x427896
cmp eax, 0x80240017
je 0x427899
mov edi, 0x8000ffff
jmp 0x4278cf
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
jmp 0x4278a3
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
cmp dword [ebp - 0x20], edi
je 0x4278cf
mov eax, dword [esi + 0x10]
cmp eax, 2
jne 0x4278c3
push dword [esi + 8]
call fcn.004283ce
mov edi, eax
test edi, edi
jns 0x4278cf
push 0x447c7c
jmp 0x42770e
cmp eax, ebx
jne 0x4278cf
push dword [esi + 8]
call fcn.004284b8
xor ebx, ebx
cmp dword [ebp - 0x14], ebx
je 0x4278de
push dword [ebp - 0x14]
call fcn.0042ee18
cmp dword [ebp - 0xc], ebx
je 0x4278eb
push dword [ebp - 0xc]
call fcn.0042ee18
cmp dword [ebp - 0x10], ebx
je 0x4278f8
push dword [ebp - 0x10]
call fcn.0042ee18
cmp dword [ebp - 8], ebx
je 0x427905
push dword [ebp - 8]
call fcn.0042ee18
cmp dword [ebp - 4], ebx
je 0x427912
push dword [ebp - 4]
call fcn.0042ee18
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x34], ebx
je 0x427925
push dword [ebp - 0x34]
call esi
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x30], ebx
je 0x427932
push dword [ebp - 0x30]
call esi
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x1c], ebx
je 0x427941
push 4
push dword [ebp - 0x24]
call fcn.0042731e
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14