Function at 0x45af3c
Capabilities:
Create process on windows
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x194
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x45c380
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
mov ecx, edi
call fcn.004400ba
xor esi, esi
test al, al
jne 0x45bb03
lea ecx, [ebp - 0x18c]
call fcn.0043fd32
lea ecx, [ebp - 0x16c]
call fcn.0043fd32
lea ecx, [ebp - 0x14c]
call fcn.0043fd32
lea ecx, [ebp - 0x12c]
call fcn.0043fd32
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10c]
mov ecx, edi
push 7
push eax
call fcn.0045688e
mov dword [ebp - 0x10], 2
push str.WX_DDE
lea eax, [ebp - 0x10c]
push eax
call fcn.0044e0d8
add esp, 8
mov ebx, eax
lea ecx, [ebp - 0x10c]
call fcn.0043fda0
test bl, bl
je 0x45b098
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x16c]
push 0x100
call fcn.00443726
lea ecx, [ebp - 0x14c]
push 0x100
call fcn.00443726
lea ecx, [ebp - 0x12c]
push 0x100
call fcn.00443726
lea eax, [ebp - 0x74]
mov ecx, dword [ebp + 8]
push eax
call fcn.004415d4
lea ecx, [ebp - 0x74]
push 7
lea esi, [ebp - 0x10c]
push esi
call fcn.0044dfa8
mov dword [ebp - 0x10], 1
mov ecx, esi
call fcn.0044a9e8
mov esi, eax
lea ecx, [ebp - 0x10c]
call fcn.0044169a
lea ecx, [ebp - 0x74]
call fcn.0044169a
movzx eax, word [esi]
test ax, ax
je 0x45b0b2
cmp ax, 0x23
je 0x45b0b2
add esi, 2
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], 0
movzx eax, ax
lea ecx, [ebp - 0x18c]
push eax
call fcn.00443732
mov esi, dword [ebp - 0x20]
jmp 0x45b069
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x18c]
push dword [ebp + 8]
call fcn.00402866
jmp 0x45b196
lea ecx, [esi + 2]
test ax, ax
cmove ecx, esi
movzx eax, word [ecx]
test ax, ax
je 0x45b0ea
cmp ax, 0x23
je 0x45b0ea
add ecx, 2
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], 0
movzx eax, ax
lea ecx, [ebp - 0x16c]
push eax
call fcn.00443732
mov ecx, dword [ebp - 0x20]
jmp 0x45b0bb
lea edx, [ecx + 2]
test ax, ax
cmove edx, ecx
movzx eax, word [edx]
test ax, ax
je 0x45b122
cmp ax, 0x23
je 0x45b122
add edx, 2
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x10], 0
movzx eax, ax
lea ecx, [ebp - 0x14c]
push eax
call fcn.00443732
mov edx, dword [ebp - 0x20]
jmp 0x45b0f3
lea ecx, [edx + 2]
test ax, ax
cmove ecx, edx
movzx eax, word [ecx]
test ax, ax
je 0x45b154
add ecx, 2
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], 0
movzx eax, ax
lea ecx, [ebp - 0x12c]
push eax
call fcn.00443732
mov ecx, dword [ebp - 0x20]
jmp 0x45b12b
mov eax, dword [ebp + 0xc]
test al, 1
jne 0x45b196
lea ecx, [ebp - 0x10c]
call fcn.00401ac4
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x16c]
push eax
call fcn.0045adb5
add esp, 0xc
test al, al
je 0x45b196
xor esi, esi
dec esi
jmp 0x45bad7
mov esi, dword [ebp + 0x10]
lea ecx, [ebp - 0x54]
call fcn.0045bccc
lea ecx, [ebp - 0x44]
call fcn.0045bccc
lea ecx, [ebp - 0x3c]
call fcn.0045bccc
test esi, esi
je 0x45b2d0
mov ecx, esi
call fcn.0045bcd8
test al, al
je 0x45b2d0
mov dword [ebp - 0x10], 3
lea ecx, [ebp - 0x54]
call fcn.0045bcdc
test al, al
je 0x45b396
lea ecx, [ebp - 0x44]
call fcn.0045bcdc
test al, al
je 0x45b396
lea ecx, [ebp - 0x3c]
call fcn.0045bcdc
test al, al
je 0x45b396
xorps xmm0, xmm0
movups xmmword [ebp - 0xe8], xmm0
movups xmmword [ebp - 0xd8], xmm0
movups xmmword [ebp - 0xf8], xmm0
movups xmmword [ebp - 0x108], xmm0
mov dword [ebp - 0x10c], 0x44
mov dword [ebp - 0xe0], 0x100
xor edi, edi
lea esi, [ebp - 0x54]
mov ecx, esi
push edi
call fcn.0045bdfe
mov dword [ebp - 0xd4], eax
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x44]
push ebx
call fcn.0045bdfe
mov dword [ebp - 0xd0], eax
lea ecx, [ebp - 0x3c]
push ebx
call fcn.0045bdfe
mov dword [ebp - 0xcc], eax
mov ecx, esi
push ebx
call fcn.0045bdfe
push edi
mov dword [ebp - 0x78], ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x45b283
call fcn.00401cb0
lea ecx, [ebp - 0x44]
push edi
call fcn.0045bdfe
push edi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x45b29f
call fcn.00401cb0
xor esi, esi
lea ecx, [ebp - 0x3c]
push esi
call fcn.0045bdfe
mov dword [ebp - 0x30], 0
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
mov ebx, dword [ebp + 0xc]
jne 0x45b308
call fcn.00401cb0
mov dword [ebp - 0x30], 0
jmp 0x45b308
xorps xmm0, xmm0
movups xmmword [ebp - 0xd8], xmm0
movups xmmword [ebp - 0xe8], xmm0
movups xmmword [ebp - 0xf8], xmm0
movups xmmword [ebp - 0x108], xmm0
mov dword [ebp - 0x10c], 0x44
mov al, 1
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x78], 0
mov ebx, dword [ebp + 0xc]
test bl, 0x20
jne 0x45b319
mov eax, ebx
and eax, 2
shr eax, 1
or al, byte [ebp - 0x30]
jne 0x45b330
or byte [ebp - 0xe0], 1
mov word [ebp - 0xdc], 0
mov dword [ebp - 0x10], 3
mov dword [ebp - 0x10], 3
lea ecx, [ebp - 0x34]
push 0
call fcn.004523c8
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
and esi, 4
shl esi, 7
or esi, 0x4000004
test edi, edi
je 0x45b42e
mov dword [ebp - 0x28], esi
mov ecx, edi
call fcn.004400ba
mov dword [ebp - 0x48], eax
lea ecx, [edi + 0x20]
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x20], ecx
call fcn.0045be08
mov edx, dword [ebp - 0x48]
xor dl, 1
test al, al
je 0x45b438
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp + 0x14]
jmp 0x45b5d5
lea ecx, [ebp - 0x10c]
call fcn.0043fd32
lea ecx, [ebp - 0x74]
call fcn.0043fd32
mov dword [ebp - 0x10], 0xc
lea ecx, [ebp - 0xb8]
push str.Failed_to_redirect_the_child_process_IO
call fcn.00401278
mov dword [ebp - 0x10], 0xd
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.00445492
add esp, 0xc
lea ecx, [ebp - 0x98]
push eax
call fcn.00447d20
lea esi, [ebp - 0x98]
push esi
call fcn.00401cb0
add esp, 4
mov ecx, esi
call fcn.00440f8a
lea ecx, [ebp - 0xb8]
call fcn.0043fda0
lea ecx, [ebp - 0x74]
call fcn.0043fda0
lea ecx, [ebp - 0x10c]
call fcn.0043fda0
mov esi, dword [ebp + 0xc]
and esi, 1
neg esi
jmp 0x45babf
xor edx, edx
mov ecx, dword [ebp + 0x10]
jmp 0x45b5d5
mov dword [ebp - 0x48], edx
lea ecx, [ebp - 0x98]
call fcn.0045be14
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 0x20]
push eax
call fcn.0045be1a
lea esi, [ebp - 0x74]
or dword [ebp - 0x28], 0x400
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x70]
lea edx, [ebp - 0x98]
mov dword [edx + 4], ecx
mov dword [edx], eax
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
push esi
call fcn.0045be40
lea eax, [ebp - 0x74]
lea edi, [ebp - 0x98]
mov ecx, edi
push eax
call fcn.0044265e
test al, al
je 0x45b4c9
mov ecx, edi
call fcn.0045be58
mov ecx, eax
call fcn.0044372c
mov esi, eax
mov ecx, edi
call fcn.0045be58
lea ecx, [eax + 0x20]
call fcn.0044372c
mov ecx, dword [ebp - 0x24]
add ecx, esi
add ecx, eax
add ecx, 2
mov dword [ebp - 0x24], ecx
mov ecx, edi
call fcn.0045be5e
lea esi, [ebp - 0x74]
jmp 0x45b473
lea ecx, [ebp - 0x34]
push dword [ebp - 0x24]
call fcn.0045be6a
lea esi, [ebp - 0x74]
lea ecx, [ebp - 0x34]
call fcn.0044210a
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
push esi
call fcn.0045be1a
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x70]
lea esi, [ebp - 0x98]
mov dword [esi + 4], ecx
mov dword [esi], eax
mov ecx, dword [ebp - 0x20]
push edx
call fcn.0045be40
lea eax, [ebp - 0x74]
lea edi, [ebp - 0x98]
mov ecx, edi
push eax
call fcn.0044265e
test al, al
je 0x45b5c1
mov ecx, edi
call fcn.0045be58
mov dword [ebp - 0x2c], eax
mov ecx, edi
call fcn.0045be58
push 0x67dd96
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.00455e00
lea eax, [ebp - 0x74]
add esp, 0xc
mov ecx, dword [ebp - 0x2c]
add ecx, 0x20
mov dword [ebp - 0x10], 5
push ecx
lea ecx, [ebp - 0xb8]
push ecx
push eax
call fcn.00455ad5
add esp, 0xc
lea ecx, [ebp - 0xb8]
call fcn.0043fda0
lea ecx, [ebp - 0x74]
call fcn.0044372c
mov esi, eax
lea edi, [eax + 1]
lea ecx, [ebp - 0x74]
call fcn.00443c3a
push edi
push eax
mov edi, dword [ebp - 0x24]
push edi
call fcn.00441e10
add esp, 0xc
lea edi, [edi + esi*2]
add edi, 2
mov dword [ebp - 0x24], edi
lea ecx, [ebp - 0x74]
call fcn.0043fda0
mov dword [ebp - 0x10], 4
lea ecx, [ebp - 0x98]
call fcn.0045be5e
lea edx, [ebp - 0x74]
jmp 0x45b4ff
mov eax, dword [ebp - 0x24]
mov word [eax], 0
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp + 0x14]
mov edx, dword [ebp - 0x48]
test ecx, ecx
je 0x45b62d
mov ebx, edx
call fcn.0045bee0
cmp eax, 0x14
ja 0x45b5ef
or esi, 0x40
mov dword [ebp - 0x28], esi
mov edx, ebx
jmp 0x45b630
cmp eax, 0x28
mov edx, ebx
ja 0x45b5fe
or esi, 0x4000
jmp 0x45b62d
cmp eax, 0x3c
ja 0x45b608
or esi, 0x20
jmp 0x45b62d
cmp eax, 0x50
ja 0x45b615
or esi, 0x8000
jmp 0x45b62d
cmp eax, 0x63
ja 0x45b622
or esi, 0x80
jmp 0x45b62d
cmp eax, 0x64
jne 0x45b603
or esi, 0x100
mov dword [ebp - 0x28], esi
xor ebx, ebx
mov esi, 0
test dl, dl
je 0x45b644
mov ecx, edi
call fcn.00443c3a
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.0044210a
mov edi, eax
lea ecx, [ebp - 0x18c]
call fcn.00443c3a
lea ecx, [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0x10c]
push ecx
push esi
push edi
push dword [ebp - 0x28]
push dword [ebp - 0x78]
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
cmp byte [ebp - 0x30], 0
je 0x45b68a
test esi, esi
jne 0x45b6c0
jmp 0x45b9b5
lea ecx, [ebp - 0x54]
push 0
call fcn.0045bee4
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x44]
push ebx
call fcn.0045bee4
push eax
call edi
lea ecx, [ebp - 0x3c]
push ebx
call fcn.0045bee4
push eax
call edi
test esi, esi
je 0x45b987
lea ecx, [ebp - 0xb8]
call fcn.00441bcc
lea ecx, [ebp - 0x98]
call fcn.00441bcc
mov dword [ebp - 0x10], 8
cmp byte [ebp - 0x30], 0
jne 0x45b79f
push 0x20
call fcn.005db3dd
add esp, 4
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x44]
push 0
call fcn.0045bee4
mov dword [ebp - 0x10], 9
mov ecx, dword [ebp - 0x20]
push eax
call fcn.0045abb2
mov dword [ebp - 0x10], 8
push 0x20
call fcn.005db3dd
add esp, 4
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x3c]
push 0
call fcn.0045bee4
mov dword [ebp - 0x10], 0xb
mov ecx, dword [ebp - 0x24]
push eax
call fcn.0045abb2
mov dword [ebp - 0x10], 8
push 0x14
call fcn.005db3dd
add esp, 4
mov esi, eax
lea ecx, [ebp - 0x54]
push 1
call fcn.0045bee4
mov dword [ebp - 0x10], 0xa
mov dword [ebp - 0x2c], esi
mov ecx, esi
push eax
call fcn.0045ace4
mov dword [ebp - 0x10], 8
mov ecx, dword [ebp + 0x10]
push dword [ebp - 0x24]
push dword [ebp - 0x2c]
push dword [ebp - 0x20]
call fcn.004a4ef2
lea ecx, [ebp - 0xb8]
push dword [ebp - 0x20]
call fcn.004477ca
lea ecx, [ebp - 0x98]
push dword [ebp - 0x24]
call fcn.004477ca
push 0x45aaf0
push str._wxExecute_Internal_Class
push 0x7c5184
call fcn.0049c95e
add esp, 0xc
mov dword [ebp - 0x24], eax
push 0x1c
call fcn.005db3dd
add esp, 4
mov dword [ebp - 0x20], eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 0x20]
mov ecx, edi
call fcn.0045bef6
mov ebx, esi
and ebx, 1
mov eax, dword [ebp - 0xc8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0xc0]
mov dword [edi + 0xc], eax
mov ecx, dword [ebp - 0x24]
mov dword [edi], ecx
mov byte [edi + 0x18], bl
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x45b801
mov ecx, esi
push eax
call fcn.0045bf00
xor eax, eax
test ebx, ebx
cmovne esi, eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x10], esi
lea ecx, [ebp - 0x1a0]
push ecx
push eax
push edx
push 0x45bf0a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0xc4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x45b83d
call fcn.00401cb0
push dword [ebp - 0xc4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
mov esi, dword [ebp - 0x24]
jne 0x45b855
call fcn.00401cb0
cmp dword [ebp - 0x4c], 0
je 0x45b95d
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x4c]
mov ecx, 0x7c5160
push eax
call fcn.0044291a
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 8], eax
lea esi, [ebp - 0x16c]
mov ecx, esi
call fcn.004400ba
test al, al
mov edi, dword [ebp - 0x24]
jne 0x45b8bc
push 0x2710
push dword [ebp - 0xc8]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
test eax, eax
je 0x45bb16
cmp eax, 0x102
je 0x45b8b2
call fcn.00401cb0
call fcn.00401cb0
call fcn.00401cb0
test edi, edi
je 0x45b97c
call fcn.00440466
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x45ba9e
mov dword [ebp - 0x2c], 0
test bl, 8
jne 0x45b8f3
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
call dword [eax + 0x4c]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
cmp byte [eax + 0x18], 0
je 0x45ba76
lea ecx, [ebp - 0xb8]
call fcn.0045bfca
mov ebx, dword [ebp + 0xc]
test al, al
jne 0x45b92c
lea ecx, [ebp - 0x98]
call fcn.0045bfca
mov ebx, dword [ebp + 0xc]
test al, al
jne 0x45b92c
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
xor eax, eax
push eax
push eax
mov eax, dword [ebp - 0x20]
push dword [eax]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test bl, 0x10
jne 0x45b8f3
call fcn.004405b2
test eax, eax
je 0x45b8f3
mov ecx, eax
push 0
call fcn.00493f60
mov ebx, dword [ebp + 0xc]
jmp 0x45b8f3
call fcn.00401cb0
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [ebp - 0x20]
mov ecx, esi
call fcn.0045aba0
push esi
call fcn.005db40d
add esp, 4
mov esi, dword [ebp - 0xc0]
jmp 0x45baa1
lea ecx, [ebp - 0x54]
push 1
call fcn.0045bee4
push eax
call edi
xor esi, esi
lea ecx, [ebp - 0x44]
push esi
call fcn.0045bee4
push eax
call edi
lea ecx, [ebp - 0x3c]
push esi
call fcn.0045bee4
push eax
call edi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x20], esp
push eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x24], eax
add eax, 4
mov dword [ebp - 0x10], 4
lea ecx, [ebp - 0x18c]
mov dword [ebp - 0x2c], eax
push eax
call fcn.004415d4
lea ecx, [ebp - 0x74]
call fcn.0043fd32
lea ecx, [ebp - 0xb8]
call fcn.0043fd32
mov dword [ebp - 0x10], 6
lea ecx, [ebp - 0x98]
push str.Execution_of_command__s_failed
call fcn.00401278
mov dword [ebp - 0x10], 7
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.00445492
add esp, 0xc
lea ecx, [ebp - 0x1a0]
push eax
call fcn.00447d20
mov eax, dword [ebp - 0x24]
lea esi, [ebp - 0x1a0]
mov dword [eax], esi
call fcn.00449048
add esp, 0x10
mov esp, dword [ebp - 0x20]
mov ecx, esi
call fcn.00440f8a
lea ecx, [ebp - 0x98]
call fcn.0043fda0
lea ecx, [ebp - 0xb8]
call fcn.0043fda0
lea ecx, [ebp - 0x74]
call fcn.0043fda0
mov esi, dword [ebp + 0xc]
and esi, 1
neg esi
jmp 0x45bab7
test bl, 8
jne 0x45ba86
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
push dword [ebp - 0x2c]
call dword [eax + 0x50]
mov edi, dword [ebp - 0x20]
mov esi, dword [edi + 0x14]
mov ecx, edi
call fcn.0045aba0
push edi
call fcn.005db40d
add esp, 4
jmp 0x45baa1
xor esi, esi
dec esi
lea ecx, [ebp - 0x98]
call fcn.0045c022
lea ecx, [ebp - 0xb8]
call fcn.0045c022
lea ecx, [ebp - 0x34]
call fcn.00442a38
lea ecx, [ebp - 0x3c]
call fcn.0045c098
lea ecx, [ebp - 0x44]
call fcn.0045c098
lea ecx, [ebp - 0x54]
call fcn.0045c098
lea ecx, [ebp - 0x12c]
call fcn.0043fda0
lea ecx, [ebp - 0x14c]
call fcn.0043fda0
lea ecx, [ebp - 0x16c]
call fcn.0043fda0
lea ecx, [ebp - 0x18c]
call fcn.0043fda0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x14c]
push eax
push esi
call fcn.0045adb5
add esp, 0xc
test al, al
mov edi, dword [ebp - 0x24]
je 0x45b8b7
jmp 0x45b8bc