Function at 0x4181fe
Capabilities:
Create process on windows

Disassembly:
push 0xb4
mov eax, 0x4b8f5b
call fcn.004b6929
mov ebx, edx
mov edi, ecx
xor esi, esi
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 2
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x418366
mov dword [ebp - 0x78], vtable.McSSConfig.0
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 3
push eax
call fcn.0040d775
push 0x4d36c0
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.0040c647
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
call fcn.0040c867
mov byte [ebp - 4], 5
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp - 0x58]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
call fcn.0040c66e
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
call fcn.0040c867
lea ecx, [ebp - 0x28]
call fcn.0040b224
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040c867
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4182fb
mov ecx, dword [ebp - 0x40]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], ecx
cmp eax, 0x1000
jb 0x4182f2
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.00405547
mov eax, dword [ebp - 0x7c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x78]
push eax
push ecx
call fcn.0047ea2e
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x30], esi
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], 7
cmp eax, 8
jb 0x418348
mov ecx, dword [ebp - 0x58]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x7c], ecx
cmp eax, 0x1000
jb 0x41833f
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00405547
mov eax, dword [ebp - 0x78]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x7c]
push eax
push ecx
call fcn.0047ea2e
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x48], esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
call fcn.0040b224
mov byte [ebp - 4], 2
jmp 0x418372
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040c6c9
push str.E:BT_bcd09f30_9318_47da_a932_cca71cfec57eFreetools_srcSSSchedulerSSScheduler.cpp
push str.s_LaunchTaskAndWait
xor esi, esi
lea ecx, [ebp - 0x78]
push 0x61
inc esi
push esi
call fcn.0040d1be
mov byte [ebp - 4], 6
mov edx, str.s_LaunchTaskAndWait___Scan_path:
mov ecx, dword [eax]
call fcn.004124b8
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
mov ecx, eax
cmovae edx, dword [ebp - 0x28]
call fcn.004124b8
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 2
call fcn.0040d1fc
movaps xmm0, xmmword [0x4e5270]
lea eax, [ebp - 0x28]
xor ecx, ecx
mov dword [ebp - 0xc0], 0x3c
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0xbc], 0x440
cmovae eax, dword [ebp - 0x28]
cmp dword [ebp + 0x34], 8
mov dword [ebp - 0xb0], eax
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x88], ecx
movups xmmword [ebp - 0xa8], xmm0
test ebx, ebx
je 0x418496
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0040a603
test al, al
jne 0x418496
push str.E:BT_bcd09f30_9318_47da_a932_cca71cfec57eFreetools_srcSSSchedulerSSScheduler.cpp
push str.s_LaunchTaskAndWait
push 0x77
push 4
lea ecx, [ebp - 0x78]
call fcn.0040d1be
mov byte [ebp - 4], 7
mov edx, str.s_LaunchTaskAndWait:
mov ecx, dword [eax]
call fcn.0041228b
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.00412c7a
pop ecx
mov edx, str._isnt_a_McAfee_signed_exe
mov ecx, eax
call fcn.0041228b
lea ecx, [ebp - 0x78]
call fcn.0040d1fc
jmp 0x41857c
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4184fa
mov eax, dword [0x502b50]
test eax, eax
je 0x4184f0
mov eax, dword [eax]
mov esi, dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 0x34], 8
lea edx, [ebp + 0x20]
push eax
cmovae edx, dword [ebp + 0x20]
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 8
push edx
cmovae ecx, dword [ebp + 8]
push ecx
push str.Couldnt_launch_command__s_with_parameters__s___d_
push 0x7f
push str.s_LaunchTaskAndWait
push str.E:BT_bcd09f30_9318_47da_a932_cca71cfec57eFreetools_srcSSSchedulerSSScheduler.cpp
push dword [0x502b50]
call esi
add esp, 0x20
mov esi, 0x80004005
jmp 0x41857c
mov eax, dword [ebp - 0x88]
mov ebx, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
push 6
push 0x4bf
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x84]
push 0xffffffffffffffff
push eax
push 2
mov dword [ebp - 0x80], edi
call ebx
test eax, eax
je 0x41857a
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, esi
je 0x41857a
cmp eax, 2
jne 0x41857a
jmp 0x418552
cmp dword [ebp - 0x70], 0x12
je 0x418562
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x74]
push eax
call edi
test eax, eax
jne 0x418538
push 6
push 0x4bf
push 0xffffffffffffffff
lea eax, [ebp - 0x84]
push eax
push 2
call ebx
test eax, eax
jne 0x41852d
xor esi, esi
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4185b9
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x7c], ecx
cmp eax, 0x1000
jb 0x4185b0
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00405547
mov eax, dword [ebp - 0x78]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x7c]
push eax
push ecx
call fcn.0047ea2e
pop ecx
pop ecx
and dword [ebp - 0x18], 0
lea ecx, [ebp + 8]
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.0040b224
lea ecx, [ebp + 0x20]
call fcn.0040b224
mov eax, esi
call fcn.004b68d8
ret