Function at 0x405550
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0xffffffffffffffff
push 0x427a51
mov eax, dword fs:[0]
push eax
sub esp, 0x2cc
mov eax, dword [0x4334ac]
xor eax, esp
mov dword [esp + 0x2c8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4334ac]
xor eax, esp
push eax
lea eax, [esp + 0x2e0]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2f0]
xor ebx, ebx
mov esi, ecx
cmp byte [0x436791], bl
jne 0x4058a5
call fcn.00404870
cmp byte [eax + 0x96a], bl
je 0x4058a5
cmp byte [0x436791], bl
jne 0x4058a5
cmp word [esi], bx
je 0x4058a5
call fcn.00404870
cmp byte [eax + 0x96a], bl
je 0x4058a5
cmp byte [0x436791], bl
jne 0x4058a5
call fcn.00404870
cmp byte [eax + 0x128], bl
je 0x4055f7
add eax, 0x18
jmp 0x4055fa
mov eax, dword [eax + 0x14]
add eax, 4
cmp eax, ebx
je 0x4058a9
cmp word [eax], bx
je 0x4058a9
push ebx
push ebx
push ebx
push ebx
push str.SGTool.exe
push eax
lea ecx, [esp + 0x1cc]
call fcn.00406d20
mov dword [esp + 0x2e8], ebx
mov dword [esp + 0x18], vtable.t_errorList.0
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], vtable.t_errorList::t_mem.0
mov ecx, ebp
lea edi, [esp + 0x18]
mov byte [esp + 0x2e8], 1
call fcn.00409a90
test al, al
jne 0x405684
push 0x42b5a8
mov ecx, ebp
call entry0
lea ecx, [esp + 0x18]
call fcn.00409a50
lea ecx, [esp + 0x1b4]
call fcn.00408470
jmp 0x4058b5
mov eax, dword [esp + 0x2f4]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov edi, esi
mov ecx, ebp
call fcn.00409b70
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
cmp esi, ebx
jne 0x4056b2
push 0x42b5c4
jmp 0x405663
push 6
push esi
call fcn.00406140
push 6
push esi
call fcn.00406190
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 0x10
push ebx
push 1
push 0x10000000
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], ebx
call edi
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x4056fe
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x42b5d8
jmp 0x405663
push 0x40
lea eax, [esp + 0x4c]
push ebx
push eax
mov dword [esp + 0x50], 0x44
call fcn.004191e0
xor eax, eax
add esp, 0xc
lea edi, [esp + 0x8c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call fcn.00408250
push 0x42b5fc
push 0x42b32c
mov edx, edi
mov byte [esp + 0x2f0], 2
call fcn.00408980
add esp, 8
lea ecx, [esp + 0x1b4]
call fcn.00407330
push eax
push 0x42b32c
mov edx, edi
call fcn.00408980
push 0x42b5fc
push 0x42b32c
mov edx, edi
call fcn.00408980
push 0x42b600
push 0x42b32c
mov edx, edi
call fcn.00408980
push str.__list
push 0x42b32c
mov edx, edi
call fcn.00408980
push str.__hevent
push 0x42b32c
mov edx, edi
call fcn.00408980
mov ecx, dword [esp + 0x3c]
push ecx
push 0x42b9fc
mov edx, edi
call fcn.00408980
add esp, 0x30
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x48]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
mov ecx, 0x104
mov eax, edi
call fcn.004087f0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40583e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
call fcn.00408820
lea ecx, [esp + 0x1b4]
call fcn.00407330
push eax
push str._T_vz1Y_
mov ebx, ebp
call fcn.004058e0
mov ecx, eax
call fcn.00405a40
mov ecx, eax
call fcn.00405a40
push 0x42b5a8
mov ecx, ebp
call entry0
mov ecx, edi
call fcn.00408470
jmp 0x40566a
lea edi, [esp + 0x8c]
call fcn.00408820
mov edx, dword [esp + 0x2c]
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x44]
push eax
push 2
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ecx, dword [esp + 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [esp + 0x30]
push edx
call edi
push esi
call edi
mov eax, dword [esp + 0x14]
push eax
call edi
lea ecx, [esp + 0x8c]
call fcn.00408470
lea ecx, [esp + 0x18]
call fcn.00409a50
lea ecx, [esp + 0x1b4]
call fcn.00408470
mov al, 1
jmp 0x4058b7
push 0x42b564
mov ecx, ebp
call entry0
xor al, al
mov ecx, dword [esp + 0x2e0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c8]
xor ecx, esp
call fcn.00415c3e
add esp, 0x2d8
ret