Function at 0x4112f0
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ad5d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2a0
mov eax, dword [0x5e3fe4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], ecx
mov eax, dword [ebx + 0xc]
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x14]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebx + 0x18]
push 0x100
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x224], 0
call fcn.005515b0
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
push 0x100
lea eax, [ebp - 0x218]
push eax
push 2
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
push eax
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
lea eax, [ebp - 0x218]
push str.WinSta0
push eax
call fcn.0055da38
add esp, 8
test eax, eax
jne 0x41168f
mov dword [ebp - 0x224], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x224]
push eax
push ecx
mov ecx, dword [ebp - 0x220]
call fcn.00411220
test esi, esi
je 0x41165f
mov ecx, esi
call fcn.004041a0
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x41167e
mov dword [ebp - 0x220], 0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x220]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x1c]
cmp dword [ebp - 0x220], 0
je 0x411678
mov eax, 3
mov word [ebp - 0x270], ax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x268], eax
mov byte [ebp - 4], 2
mov edi, 0x5c3120
mov ecx, dword [ebp - 0x21c]
mov eax, edi
movups xmm0, xmmword [ebp - 0x270]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test ecx, ecx
cmovne eax, ecx
mov dword [ebp - 0x228], eax
xor eax, eax
mov word [ebp - 0x260], ax
lea eax, [ebp - 0x260]
push eax
movups xmmword [ebp - 0x280], xmm0
call esi
test eax, eax
js 0x4116d2
push dword [ebp - 0x228]
mov eax, 8
mov word [ebp - 0x260], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x258], eax
test eax, eax
jne 0x4114aa
cmp dword [ebp - 0x228], eax
jne 0x4116d8
mov byte [ebp - 4], 3
xor eax, eax
movups xmm0, xmmword [ebp - 0x260]
mov word [ebp - 0x250], ax
lea eax, [ebp - 0x250]
push eax
movups xmmword [ebp - 0x290], xmm0
call esi
test eax, eax
js 0x4116f8
mov eax, 8
push 0x5c3120
mov word [ebp - 0x250], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x248], eax
test eax, eax
je 0x4116fe
mov eax, dword [ebp - 0x22c]
test eax, eax
mov byte [ebp - 4], 4
movups xmm0, xmmword [ebp - 0x250]
cmovne edi, eax
xor eax, eax
mov word [ebp - 0x240], ax
lea eax, [ebp - 0x240]
push eax
movups xmmword [ebp - 0x2a0], xmm0
call esi
test eax, eax
js 0x41171e
mov eax, 8
push edi
mov word [ebp - 0x240], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x238], eax
test eax, eax
jne 0x411557
test edi, edi
jne 0x411724
mov byte [ebp - 4], 5
xor esi, esi
movups xmm0, xmmword [ebp - 0x240]
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x21c], esi
movups xmmword [ebp - 0x2b0], xmm0
test eax, eax
je 0x41159f
mov ecx, dword [eax]
lea edx, [ebp - 0x21c]
push edx
push 0x5c4640
push eax
call dword [ecx]
mov esi, dword [ebp - 0x21c]
xor ecx, ecx
test eax, eax
cmovs esi, ecx
mov dword [ebp - 0x21c], esi
mov byte [ebp - 4], 6
push dword [ebp - 0x230]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x230], edi
test edi, edi
je 0x411744
mov byte [ebp - 4], 7
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x280]
mov ecx, dword [esi]
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x290]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x2a0]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x2b0]
push edi
push esi
movups xmmword [eax], xmm0
call dword [ecx + 0x7c]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x411621
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x240]
push eax
call esi
lea eax, [ebp - 0x250]
push eax
call esi
lea eax, [ebp - 0x260]
push eax
call esi
lea eax, [ebp - 0x270]
push eax
call esi
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x41165f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x4116b2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4116b2
mov eax, dword [ebp - 0x224]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x41168f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, str.To_execute_in_non_interactive_mode
call fcn.004041a0
mov eax, dword [ebp - 0x228]
push eax
push 0
push dword [ebp - 0x22c]
push esi
push edi
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0054e183
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x14
push eax
call fcn.00407340
mov eax, 0xa
mov dword [ebp - 0x258], 0x8007000e
push 0x8007000e
mov word [ebp - 0x260], ax
call fcn.00407340
push eax
call fcn.00407340
mov eax, 0xa
mov dword [ebp - 0x248], 0x8007000e
push 0x8007000e
mov word [ebp - 0x250], ax
call fcn.00407340
push eax
call fcn.00407340
mov eax, 0xa
mov dword [ebp - 0x238], 0x8007000e
push 0x8007000e
mov word [ebp - 0x240], ax
call fcn.00407340
push 0x8007000e
call fcn.00407340
int3