Function at 0x40f425
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x714
mov eax, dword [0x44e824]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x634], eax
mov eax, dword [ebp + 0x10]
push 0x44
mov dword [ebp - 0x644], eax
lea eax, [ebp - 0x6d0]
push ebx
push eax
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x67c], ebx
mov dword [ebp - 0x630], ebx
call fcn.00414350
xor eax, eax
mov dword [ebp - 0x678], ebx
lea edi, [ebp - 0x674]
mov dword [ebp - 0x668], ebx
stosd dword es:[edi], eax
push 0x44
push ebx
mov dword [ebp - 0x664], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x660], ebx
mov dword [ebp - 0x65c], ebx
mov dword [ebp - 0x658], ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x714]
push eax
mov dword [ebp - 0x654], ebx
call fcn.00414350
xor eax, eax
mov dword [ebp - 0x68c], ebx
lea edi, [ebp - 0x688]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x62c], ax
lea edi, [ebp - 0x62a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x20c]
mov edi, 0x208
push edi
push ebx
push eax
call fcn.00414350
push edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00414350
push edi
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.00414350
add esp, 0x3c
mov dword [ebp - 0x650], ebx
mov dword [ebp - 0x63c], ebx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x640], ebx
test esi, esi
jne 0x40f538
push 0xfffffffffffffff8
pop eax
jmp 0x40fd6a
mov eax, dword [ebp + 0x18]
cmp eax, 0xffffffff
je 0x40f549
imul eax, eax, 0x3e8
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x1c]
xor edi, edi
push 0x44
pop edx
inc edi
mov dword [ebp - 0x714], edx
test eax, eax
je 0x40f56b
xor ecx, ecx
mov dword [ebp - 0x6e8], edi
mov word [ebp - 0x6e4], cx
push 0xc
pop ecx
mov dword [ebp - 0x668], ecx
mov dword [ebp - 0x65c], ecx
xor ecx, ecx
cmp dword [esi + 8], 4
push 2
mov dword [ebp - 0x664], ebx
mov dword [ebp - 0x658], ebx
mov dword [ebp - 0x654], ebx
mov dword [ebp - 0x660], edi
pop ebx
jne 0x40f857
cmp dword [esi + 0x14], ebx
jne 0x40f853
cmp dword [esi + 0x98], ecx
jne 0x40f853
lea eax, [esi + 0xcf]
push eax
lea eax, [esi + 0x9c]
push eax
lea eax, [esi + 0x102]
push eax
push esi
call fcn.00409a9b
add esp, 0x10
test eax, eax
je 0x40f82c
mov edx, dword [ebp - 0x644]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x40f5e5
sub edx, ecx
cmp dword [esi + 0x268], 7
jne 0x40f612
lea ecx, [esi + 0x26c]
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f600
sub ecx, edi
lea eax, [ecx + 3]
mov dword [ebp - 0x64c], eax
push 3
pop edi
cmp dword [esi + 0x2c0], edi
jne 0x40f634
lea ecx, [esi + 0x2c4]
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f626
sub ecx, ebx
lea eax, [ecx + 3]
jmp 0x40f63a
mov eax, dword [ebp - 0x638]
mov ecx, dword [ebp - 0x64c]
add eax, edx
add ecx, 0x12
add eax, ecx
push eax
mov dword [ebp - 0x634], eax
call fcn.004188c5
mov ebx, eax
mov dword [ebp - 0x63c], ebx
pop ecx
test ebx, ebx
jne 0x40f67f
push str.Failed_to_allocate_memory_to_schedule_the_process.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 1
push esi
call fcn.004117f5
add esp, 0x14
push 0xfffffffffffffff3
jmp 0x40f846
mov ecx, dword [ebp - 0x644]
mov edx, ebx
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x40f689
cmp dword [esi + 0x268], 7
jne 0x40f6c2
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f6a1
sub ecx, edx
lea eax, [esi + 0x26c]
push eax
push str.__m_s
lea eax, [ecx + ebx]
push eax
call fcn.004011e8
add esp, 0xc
cmp dword [esi + 0x2c0], edi
jne 0x40f6f0
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f6cf
sub ecx, edx
lea eax, [esi + 0x2c4]
push eax
push str.__g_s
lea eax, [ecx + ebx]
push eax
call fcn.004011e8
add esp, 0xc
mov eax, dword [ebp - 0x634]
add eax, eax
push eax
call fcn.004188c5
mov dword [ebp - 0x648], eax
pop ecx
test eax, eax
je 0x40f660
push dword [ebp - 0x634]
push eax
push 0xffffffffffffffff
push ebx
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x680], eax
lea eax, [ebp - 0x62c]
push eax
mov word [ebp - 0x684], bx
mov dword [ebp - 0x688], ebx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x624]
imul ecx, eax, 0x3c
movzx eax, word [ebp - 0x622]
inc eax
push str.netapi32.dll
add eax, ecx
imul ecx, eax, 0xea60
movzx eax, word [ebp - 0x61e]
add ecx, eax
mov dword [ebp - 0x68c], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x630], eax
test eax, eax
jne 0x40f7a4
push str.Failed_to_load_the_NETAPI32.DLL
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 1
push esi
call fcn.004117f5
add esp, 0x14
push 0xfffffffffffffff5
jmp 0x40f846
push str.NetScheduleJobAdd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40f7d0
push str.Failed_to_get_the_NetScheduleJobAdd_function.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 1
push esi
call fcn.004117f5
add esp, 0x14
push 0xfffffffffffffffa
jmp 0x40f846
lea ecx, [ebp - 0x67c]
push ecx
lea ecx, [ebp - 0x68c]
push ecx
push ebx
call eax
mov dword [ebp - 0x640], eax
test eax, eax
je 0x40f815
push str.Failed_to_schedule_the_process.
push eax
push edi
push 1
push esi
call fcn.004117f5
xor ebx, ebx
add esp, 0x14
cmp dword [ebp - 0x640], 0x888
setne bl
dec ebx
and ebx, 0xfffffffb
add ebx, 0xfffffff1
jmp 0x40f847
push str.Process_was_successfully_scheduled.
push ebx
push 1
push edi
push esi
call fcn.004117f5
xor ebx, ebx
add esp, 0x14
inc ebx
jmp 0x40f847
push str.Failed_to_logon_as_Administrator_to_schedule_the_process.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push edi
push esi
call fcn.004117f5
add esp, 0x14
push 0xfffffffffffffff4
pop ebx
push esi
call fcn.00409c18
pop ecx
jmp 0x40fd24
cmp dword [esi + 8], 4
jbe 0x40fc10
cmp dword [esi + 0x14], ebx
jne 0x40fc10
cmp dword [esi + 0x98], ecx
jne 0x40fc10
mov dword [ebp - 0x6d0], edx
test eax, eax
je 0x40f88b
xor eax, eax
mov dword [ebp - 0x6a4], edi
mov word [ebp - 0x6a0], ax
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0xffffffffffffffff
lea eax, [esi + 0x9c]
push eax
push ecx
push ecx
call edi
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0xffffffffffffffff
lea eax, [esi + 0xcf]
push eax
push 0
push 0
call edi
push 0x104
lea eax, [ebp - 0x61c]
push eax
push 0xffffffffffffffff
lea eax, [esi + 0x102]
push eax
push 0
push 0
call edi
lea eax, [ebp - 0x20c]
push 0x40
push eax
call fcn.00416323
pop ecx
pop ecx
test eax, eax
je 0x40f8fd
xor eax, eax
inc eax
mov dword [ebp - 0x640], eax
mov edi, dword [ebp - 0x634]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x40f906
sub edi, ecx
lea eax, [edi*2 + 2]
push eax
call fcn.004188c5
pop ecx
mov ecx, eax
mov dword [ebp - 0x650], ecx
test ecx, ecx
jne 0x40f94a
push str.Could_not_allocate_the_memory_to_convert_the_executable_name.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push 1
push esi
call fcn.004117f5
add esp, 0x14
push 0xfffffffffffffff3
pop ebx
jmp 0x40fd68
lea eax, [edi + 1]
push eax
push ecx
push 0xffffffffffffffff
push dword [ebp - 0x634]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [ebp - 0x644]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x40f96a
sub edx, ecx
cmp dword [esi + 0x268], 7
jne 0x40f997
lea ecx, [esi + 0x26c]
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f985
sub ecx, edi
lea eax, [ecx + 3]
mov dword [ebp - 0x64c], eax
push 3
pop edi
cmp dword [esi + 0x2c0], edi
jne 0x40f9c3
lea ecx, [esi + 0x2c4]
lea eax, [ecx + 1]
mov dword [ebp - 0x638], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f9b1
sub ecx, dword [ebp - 0x638]
lea eax, [ecx + 3]
jmp 0x40f9c9
mov eax, dword [ebp - 0x638]
mov ecx, dword [ebp - 0x64c]
add eax, edx
add ecx, 0x12
add eax, ecx
push eax
mov dword [ebp - 0x638], eax
call fcn.004188c5
pop ecx
mov ecx, eax
mov dword [ebp - 0x63c], ecx
test ecx, ecx
jne 0x40fa0f
push str.Failed_to_allocate_memory_to_schedule_the_process.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 1
push esi
call fcn.004117f5
add esp, 0x14
push 0xfffffffffffffff3
pop ebx
jmp 0x40fd57
mov edx, dword [ebp - 0x644]
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x630], eax
mov ecx, eax
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x40fa21
cmp dword [esi + 0x268], 7
mov ecx, dword [ebp - 0x63c]
jne 0x40fa70
mov edx, ecx
lea eax, [edx + 1]
mov dword [ebp - 0x630], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x40fa45
sub edx, dword [ebp - 0x630]
lea eax, [esi + 0x26c]
push eax
push str.__m_s
lea eax, [edx + ecx]
push eax
call fcn.004011e8
mov ecx, dword [ebp - 0x63c]
add esp, 0xc
cmp dword [esi + 0x2c0], edi
jne 0x40faa8
mov edx, ecx
lea eax, [edx + 1]
mov dword [ebp - 0x630], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x40fa83
sub edx, dword [ebp - 0x630]
lea eax, [esi + 0x2c4]
push eax
push str.__g_s
lea eax, [edx + ecx]
push eax
call fcn.004011e8
add esp, 0xc
mov eax, dword [ebp - 0x638]
add eax, eax
push eax
call fcn.004188c5
mov dword [ebp - 0x648], eax
pop ecx
test eax, eax
jne 0x40fae1
push str.Failed_to_allocate_memory_to_schedule_the_process.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 1
push esi
call fcn.004117f5
add esp, 0x14
push 0xfffffffffffffff3
pop ebx
jmp 0x40fd35
push dword [ebp - 0x638]
push eax
mov eax, dword [ebp - 0x63c]
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x630], eax
test eax, eax
jne 0x40fb2c
push str.Failed_to_load_the_ADVAPI32.DLL
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 1
push esi
call fcn.004117f5
add esp, 0x14
push 0xfffffffffffffff5
jmp 0x40fadb
push str.CreateProcessWithLogonW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
test ecx, ecx
jne 0x40fb5e
push 0xfffffffffffffffa
pop ebx
push str.Failed_to_get_the_CreateProcessWithLogonW_function.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 1
push esi
call fcn.004117f5
add esp, 0x14
jmp 0x40fd24
lea eax, [ebp - 0x678]
push eax
lea eax, [ebp - 0x6d0]
push eax
xor eax, eax
lea edx, [ebp - 0x61c]
push eax
push eax
push eax
mov eax, dword [ebp - 0x648]
push eax
mov eax, dword [ebp - 0x650]
push eax
push 1
lea eax, [ebp - 0x414]
push eax
mov eax, dword [ebp - 0x640]
neg eax
sbb eax, eax
not eax
and eax, edx
push eax
lea eax, [ebp - 0x20c]
push eax
call ecx
test eax, eax
je 0x40fbd8
push str.Running_the_installation_process_as_an_administrator.
push 0
push 1
push edi
push esi
call fcn.004117f5
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x14
push dword [ebp - 0x678]
call esi
push dword [ebp - 0x674]
call esi
jmp 0x40fd24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Failed_to_create_the_installation_process_as_an_administrator.
mov ebx, eax
push ebx
push edi
push 1
push esi
call fcn.004117f5
add esp, 0x14
cmp ebx, 0x52e
je 0x40fc09
cmp ebx, 0x3e5
je 0x40fc09
push 0xffffffffffffffef
jmp 0x40fd23
push 0xfffffffffffffff4
jmp 0x40fd23
mov ebx, dword [ebp - 0x644]
lea eax, [ebp - 0x678]
mov edi, dword [ebp - 0x634]
push eax
lea eax, [ebp - 0x714]
push eax
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x668]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40fd08
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40fc51
sub ecx, edx
mov edx, ebx
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x40fc5f
sub edx, edi
lea eax, [ecx + 0x80]
add eax, edx
push eax
call fcn.004188c5
mov dword [ebp - 0x640], eax
pop ecx
push 3
pop edi
test eax, eax
je 0x40fcb1
push ebx
push dword [ebp - 0x634]
push str.Running__s__s_
push eax
call fcn.004011e8
mov ebx, dword [ebp - 0x640]
push ebx
push 0
push 1
push edi
push esi
call fcn.004117f5
push ebx
call fcn.004188c0
add esp, 0x28
push dword [ebp - 0x674]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp dword [ebp + 0x14], 1
jne 0x40fcfa
push dword [ebp + 0x18]
push dword [ebp - 0x678]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40fcfa
cmp eax, 0x80
je 0x40fcfa
push str.Timeout_or_other_error_occurred_while_waiting_for_the_installation_process.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 1
push esi
call fcn.004117f5
add esp, 0x14
push 0xffffffffffffffea
pop ebx
push dword [ebp - 0x678]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40fd68
push str.Failed_to_create_the_installation_process.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push 1
push esi
call fcn.004117f5
add esp, 0x14
push 0xffffffffffffffee
pop ebx
mov eax, dword [ebp - 0x630]
test eax, eax
je 0x40fd35
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x63c]
test eax, eax
je 0x40fd46
push eax
call fcn.004188c0
pop ecx
mov eax, dword [ebp - 0x648]
test eax, eax
je 0x40fd57
push eax
call fcn.004188c0
pop ecx
mov eax, dword [ebp - 0x650]
test eax, eax
je 0x40fd68
push eax
call fcn.004188c0
pop ecx
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412e47
mov esp, ebp
pop ebp
ret