Function at 0x5986eb
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
sub esp, 0x5c
mov eax, 0x6e2a6f
call fcn.006899cc
sub esp, 0x254
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
push 1
lea ecx, [ebp - 0x260]
mov dword [ebp + 0x28], esi
mov byte [ebp + 0x5f], bl
mov byte [esi + 0x1d8], bl
call fcn.0045c4aa
push str._messages_from_queue
push dword [esi + 0x1b8]
lea eax, [ebp - 0x260]
mov dword [ebp - 4], ebx
push str.Clearing
push eax
call fcn.004634b5
mov ecx, eax
call fcn.0041baa0
push eax
call fcn.004634b5
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0x25c]
call fcn.004145c0
lea eax, [ebp + 0x3c]
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00594406
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], bl
call fcn.0040fad0
lea ecx, [esi + 0x1a8]
call fcn.0059b06b
push 1
lea ecx, [ebp - 0x1c8]
call fcn.004ad7e4
cmp dword [esi + 0x58], 1
mov eax, dword [0x73dc88]
mov byte [ebp - 4], 2
je 0x5987a0
mov eax, dword [0x73dc84]
push eax
mov ecx, 0x6f5d68
lea eax, [esi + 0xcc]
push ecx
push eax
push ecx
push 0x7c8d10
push ecx
push 0x7c8d28
push ecx
push dword [ebp + 0x6c]
lea eax, [ebp - 0x1b8]
push 0x6f6e3c
push dword [ebp + 0x68]
push 0x6f6e38
push eax
call fcn.004485bb
push eax
call fcn.004765f3
push eax
call fcn.004485bb
push eax
call fcn.004765f3
push eax
call fcn.004485bb
push eax
call fcn.004765f3
push eax
call fcn.004485bb
push eax
call fcn.004765f3
push eax
call fcn.004485bb
push eax
call fcn.004765f3
push eax
call fcn.004485bb
push eax
call fcn.004485bb
mov eax, dword [0x7f4fbc]
test eax, eax
je 0x598851
push eax
push 0x73ca8c
push 0x7c9150
push 0x73ca90
lea eax, [ebp - 0x1b8]
push eax
call fcn.004485bb
push eax
call fcn.004765f3
push eax
call fcn.004485bb
mov ecx, eax
call fcn.005917d8
mov dword [ebp + 0x2c], 0x6f6164
mov dword [ebp + 0x30], ebx
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x38], ebx
lea eax, [ebp]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x1b0]
call fcn.0046a305
push 0x44
pop edi
push edi
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 4
push ebx
push eax
call fcn.0068ccc0
mov dword [ebp - 0x80], edi
xor eax, eax
lea edi, [ebp + 0x18]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp]
push eax
push str.creating_remote_process_using
lea eax, [ebp - 0x3c]
push eax
call fcn.004487f4
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 5
push eax
mov ecx, esi
call fcn.005944d5
call fcn.0059d0b9
test eax, eax
je 0x598a1b
cmp dword [esi + 0xec], ebx
jne 0x598a1b
xor eax, eax
mov dword [ebp + 0x3c], ebx
push str.S_1_16_4096
lea ecx, [ebp + 0x3c]
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x50], 7
mov word [ebp + 0x3c], ax
call fcn.004482e2
lea eax, [ebp + 0x3c]
mov byte [ebp - 4], 6
push eax
call fcn.005929f2
cmp byte [0x7e617d], 0
mov ebx, eax
mov dword [ebp + 0x6c], eax
jne 0x598916
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor ebx, ebx
mov dword [ebp + 0x6c], ebx
and dword [ebp - 0x24], 0
lea ecx, [ebp - 0x24]
and dword [ebp - 0x14], 0
push str.lowIntegrity_created
mov byte [ebp + 0x58], 0
push dword [ebp + 0x58]
mov dword [ebp - 0x10], 0xf
push 0x14
mov byte [ebp - 0x24], 0
call fcn.00416cb0
xor eax, eax
mov byte [ebp - 4], 7
test ebx, ebx
lea ecx, [ebp + 0x2c]
setne al
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0047ca3f
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
jb 0x59898c
mov ecx, dword [ebp - 0x24]
inc eax
mov dword [ebp + 0x54], eax
mov dword [ebp + 0x58], ecx
cmp eax, 0x1000
jb 0x598983
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x58]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x54]
mov ecx, dword [ebp + 0x58]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
push 8
pop ebx
lea ecx, [ebp]
cmp dword [ebp + 0x14], ebx
jb 0x59899a
mov ecx, dword [ebp]
mov edi, dword [ebp + 0x68]
mov eax, edi
cmp dword [edi + 0x14], ebx
jb 0x5989a6
mov eax, dword [edi]
lea edx, [ebp + 0x18]
push edx
lea edx, [ebp - 0x80]
push edx
xor edx, edx
push edx
push edx
push edx
push edx
push edx
push edx
push ecx
push eax
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp + 0x54], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x6c]
test eax, eax
je 0x5989db
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp + 0x50]
mov byte [ebp - 4], 5
cmp eax, ebx
jb 0x598a59
mov ecx, dword [ebp + 0x3c]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x6c], eax
mov dword [ebp + 0x58], ecx
cmp eax, 0x1000
jb 0x598a10
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x58]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x6c]
mov ecx, dword [ebp + 0x58]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
jmp 0x598a59
push 8
pop ebx
lea eax, [ebp]
cmp dword [ebp + 0x14], ebx
jb 0x598a29
mov eax, dword [ebp]
mov edi, dword [ebp + 0x68]
mov ecx, edi
cmp dword [edi + 0x14], ebx
jb 0x598a35
mov ecx, dword [edi]
lea edx, [ebp + 0x18]
push edx
lea edx, [ebp - 0x80]
push edx
xor edx, edx
push edx
push edx
push edx
push edx
push edx
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov dword [ebp + 0x54], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp + 0x68], eax
cmp dword [ebp + 0x54], 0
jne 0x598bb6
push 1
lea ecx, [ebp - 0x118]
call fcn.0045c4aa
push str._launching_process
push dword [ebp + 0x68]
lea eax, [ebp - 0x118]
mov byte [ebp - 4], bl
push 0x73cb1c
push eax
call fcn.004634b5
mov ecx, eax
call fcn.004636ae
push eax
call fcn.004634b5
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0x114]
call fcn.004145c0
lea eax, [ebp + 0x3c]
mov byte [ebp - 4], 9
push eax
mov ecx, esi
call fcn.00594406
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], bl
call fcn.0040fad0
cmp dword [edi + 0x14], ebx
jb 0x598ac9
mov edi, dword [edi]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0xf
pop edi
mov esi, eax
mov dword [ebp + 0x50], edi
xor eax, eax
lea ecx, [ebp + 0x3c]
push 9
mov dword [ebp + 0x3c], eax
push str.exe_exist
mov dword [ebp + 0x4c], eax
mov byte [ebp + 0x3c], al
call fcn.00414b60
push esi
lea eax, [ebp + 0x3c]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp + 0x2c]
call fcn.0047ca3f
mov eax, dword [ebp + 0x50]
mov byte [ebp - 4], bl
cmp eax, 0x10
jb 0x598b3b
mov ecx, dword [ebp + 0x3c]
inc eax
mov dword [ebp + 0x6c], eax
mov dword [ebp + 0x58], ecx
cmp eax, 0x1000
jb 0x598b32
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x58]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x6c]
mov ecx, dword [ebp + 0x58]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
xor eax, eax
mov dword [ebp + 0x50], edi
push 7
mov dword [ebp + 0x3c], eax
lea ecx, [ebp + 0x3c]
push str.oserror
mov dword [ebp + 0x4c], eax
mov byte [ebp + 0x3c], al
call fcn.00414b60
push dword [ebp + 0x68]
lea eax, [ebp + 0x3c]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp + 0x2c]
call fcn.0047ca3f
mov eax, dword [ebp + 0x50]
mov byte [ebp - 4], bl
cmp eax, 0x10
jb 0x598ba3
mov ecx, dword [ebp + 0x3c]
inc eax
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x6c], ecx
cmp eax, 0x1000
jb 0x598b9a
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x6c]
push eax
call fcn.0044810a
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x6c]
push eax
push ecx
call fcn.0068976d
pop ecx
pop ecx
mov ecx, dword [ebp + 0x28]
lea eax, [ebp + 0x2c]
push eax
push str.create_process.error
call fcn.00597da0
jmp 0x598c35
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x9c], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0xa0], eax
mov eax, dword [ebp + 0x20]
push 2
mov dword [esi + 0xa4], eax
lea eax, [esi + 0x11c]
pop ecx
xchg dword [eax], ecx
push 1
lea ecx, [ebp - 0x118]
call fcn.0045c4aa
push dword [esi + 0xa4]
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 0xc
push str.started_remote_frame_process
push eax
call fcn.004634b5
mov ecx, eax
call fcn.004636ae
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0x114]
call fcn.004145c0
lea eax, [ebp + 0x3c]
mov byte [ebp - 4], 0xd
push eax
mov ecx, esi
call fcn.00594406
lea ecx, [ebp + 0x3c]
call fcn.0040fad0
mov byte [ebp + 0x5f], 1
lea ecx, [ebp - 0x118]
call fcn.0045c68b
lea ecx, [ebp - 0x3c]
call fcn.0044823e
lea ecx, [ebp]
call fcn.0044823e
mov esi, dword [ebp + 0x30]
test esi, esi
je 0x598c88
mov edi, dword [ebp + 0x34]
cmp esi, edi
je 0x598c6e
mov ecx, esi
call fcn.0044a669
add esi, ebx
cmp esi, edi
jne 0x598c5e
mov esi, dword [ebp + 0x30]
mov eax, dword [ebp + 0x38]
sub eax, esi
and eax, 0xfffffff8
push eax
push esi
call fcn.00447e20
xor eax, eax
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x34], eax
mov dword [ebp + 0x38], eax
lea ecx, [ebp - 0x1c8]
mov dword [ebp + 0x2c], 0x6f6114
call fcn.004b0733
lea ecx, [ebp - 0x260]
call fcn.0045c68b
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + 0x5f]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add ebp, 0x60
leave
ret 8