Function at 0x4317d0
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68c
mov eax, dword [0x4e7018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x688], eax
mov eax, dword [ebp + 0x10]
push 0x20a
mov dword [ebp - 0x68c], eax
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0040f160
push 0x20a
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x62c], 0x105
push 0
push eax
call fcn.0040f160
push 0x20a
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.0040f160
push 0x44
lea eax, [ebp - 0x674]
push 0
push eax
call fcn.0040f160
mov eax, dword [ebp - 0x688]
add esp, 0x30
xorps xmm0, xmm0
mov dword [ebp - 0x630], 0xffffffff
xor esi, esi
movups xmmword [ebp - 0x684], xmm0
test eax, eax
je 0x431c87
test ebx, ebx
je 0x431c87
test edi, edi
je 0x431c87
mov ecx, dword [ebp + 8]
mov eax, ecx
mov dword [ebx], esi
mov dword [ebp - 0x674], 0x44
sub eax, 0x5000
je 0x4318b5
sub eax, 6
je 0x4318f2
push ecx
push str.VNLSpawn64BitVnetlibTask:_Case_for_product__u_needs_to_be_implemented
push 1
call fcn.004439a0
add esp, 0xc
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004145c0
test eax, eax
jne 0x431960
push str.VNLSpawn64BitVnetlibTask:_failed_to_get_generic_product_install_path
push 1
call fcn.004439a0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bf1
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004148d0
test eax, eax
jne 0x431960
push str.VNLSpawn64BitVnetlibTask:_using_generic_path_for_installing_USB
push 2
call fcn.004439a0
add esp, 8
mov dword [ebp - 0x62c], 0x105
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004145c0
test eax, eax
jne 0x431960
push str.VNLSpawn64BitVnetlibTask:_failed_to_obtain_generic_product_path
push 1
call fcn.004439a0
add esp, 8
call fcn.004437c0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bf1
mov esp, ebp
pop ebp
ret
push str.vnetlib64.exe
lea eax, [ebp - 0x210]
push eax
push 0x49dc5c
lea eax, [ebp - 0x41c]
push 0x105
push eax
call fcn.004159a0
add esp, 0x14
test eax, eax
jns 0x4319ab
push str.VNLSpawn64BitVnetlibTask:_failed_to_create_executable_path
push 1
call fcn.004439a0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bf1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x68c]
lea eax, [ebp - 0x41c]
push ecx
push dword [ebp - 0x688]
test ecx, ecx
mov edx, str.__s______S
push eax
mov eax, str.__s______S__S
cmove eax, edx
push eax
lea eax, [ebp - 0x628]
push 0x105
push eax
call fcn.004159a0
add esp, 0x18
test eax, eax
jns 0x431a09
push str.VNLSpawn64BitVnetlibTask:_failed_to_create_executable_command_line
push 1
call fcn.004439a0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bf1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x68c]
mov eax, 0x4975e2
test ecx, ecx
cmovne eax, ecx
push eax
push dword [ebp - 0x688]
push str.launching_process_for:__s__s
push 2
call fcn.004439a0
add esp, 0x10
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x674]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x431a8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VNLSpawn64BitVnetlibTask:_failed_to_launch_process:__d
push 1
call fcn.004439a0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bf1
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x678]
push dword [ebp - 0x67c]
push str.VNLSpawn64BitVnetlibTask:_launched_process:_pid__d_tid__d
push 2
call fcn.004439a0
add esp, 0x10
push dword [ebp - 0x680]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push str.VNLSpawn64BitVnetlibTask:_Waiting_for_process___d_loops
push 2
call fcn.004439a0
add esp, 0xc
inc esi
push 0x2710
push dword [ebp - 0x684]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x431aeb
push str.VNLSpawn64BitVnetlibTask:_Waiting_for_process_returned__still_need_to_wait_longer
push 2
call fcn.004439a0
add esp, 8
jmp 0x431ab1
push eax
push str.VNLSpawn64BitVnetlibTask:_Done_waiting_for_process__code__d
push 2
call fcn.004439a0
add esp, 0xc
lea eax, [ebp - 0x630]
push eax
push dword [ebp - 0x684]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x431c65
push dword [ebp - 0x630]
push str.VNLSpawn64BitVnetlibTask:_process_exit_code__d
push 0x20
call fcn.004439a0
mov ecx, dword [ebp - 0x630]
add esp, 0xc
cmp ecx, 0x103
jne 0x431b78
push str.VNLSpawn64BitVnetlibTask:_process_is_still_running__terminating
push 2
call fcn.004439a0
add esp, 8
push 0x20
push dword [ebp - 0x684]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x684]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bf1
mov esp, ebp
pop ebp
ret
lea eax, [ecx - 4]
cmp eax, 0x1c
ja case.0x431b8b.5
movzx eax, byte [eax + 0x431cc4]
jmp dword [eax*4 + 0x431cac]
push str.VNLSpawn64BitVnetlibTask:_process_needs_reboot
push 2
call fcn.004439a0
add esp, 8
mov dword [edi], 1
push str.VNLSpawn64BitVnetlibTask:_process_was_successful
push 2
call fcn.004439a0
add esp, 8
mov dword [ebx], 1
push dword [ebp - 0x684]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bf1
mov esp, ebp
pop ebp
ret
push str.VNLSpawn64BitVnetlibTask:_process_needs_reboot
push 2
call fcn.004439a0
add esp, 8
mov dword [edi], 1
push str.VNLSpawn64BitVnetlibTask:_process_was_not_successful
push 2
call fcn.004439a0
add esp, 8
push dword [ebp - 0x684]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bf1
mov esp, ebp
pop ebp
ret
push str.VNLSpawn64BitVnetlibTask:_process_was_killed
push 2
call fcn.004439a0
add esp, 8
push dword [ebp - 0x684]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bf1
mov esp, ebp
pop ebp
ret
push ecx
push str.VNLSpawn64BitVnetlibTask:_process_has_invalid_error_code:__d
push 2
call fcn.004439a0
add esp, 0xc
push dword [ebp - 0x684]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bf1
mov esp, ebp
pop ebp
ret
push edi
push ebx
push eax
push str.VNLSpawn64BitVnetlibTask:_invalid_parameters:_0x_08x_0x_08x_0x_08x
push 1
call fcn.004439a0
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.00401bf1
mov esp, ebp
pop ebp
ret