Function at 0x57cd19
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
sub esp, 0x6c
mov eax, 0x6bd82f
call fcn.00651da4
sub esp, 0x218
push ebx
lea eax, [ebp + 0x6f]
mov byte [ebp + 0x6f], 0
push eax
lea eax, [ebp + 0x1c]
mov ebx, ecx
push eax
call fcn.0057ac4a
and dword [ebp - 4], 0
cmp byte [ebp + 0x6f], 0
jne 0x57cd52
xor bl, bl
jmp 0x57d2d1
push esi
push edi
push 0x44
pop esi
push esi
lea eax, [ebp - 0xb0]
push 0
push eax
call fcn.0066c620
xor eax, eax
mov dword [ebp - 0xb0], esi
lea edi, [ebp + 0xc]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov esi, eax
xor edi, edi
lea eax, [ebp - 0xc4]
push edi
mov dword [ebp + 0x50], eax
lea eax, [ebp + 0x50]
push eax
push 1
push str.S:_ML__NW___LW_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
mov eax, dword [ebp + 0x50]
push edi
push edi
push 6
mov dword [ebp + 4], eax
mov dword [ebp], 0xc
mov dword [ebp + 8], 1
call fcn.00579e53
neg eax
lea ecx, [ebp - 0x224]
push 1
sbb edi, edi
lea eax, [ebp]
push 3
and edi, eax
call fcn.00498585
push dword [0x7a6a24]
mov ecx, 0x7a6a20
mov byte [ebp - 4], 1
push dword [0x7a6a20]
push 0x7d1468
call fcn.005784f7
push eax
mov eax, 0x7197e0
push eax
push ebx
push eax
push esi
push eax
mov esi, 0x7a6a28
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.00462f48
push eax
call fcn.00428ac8
mov ecx, eax
call fcn.00579502
push eax
call fcn.00428ac8
mov ecx, eax
call fcn.00579607
push eax
call fcn.00428ac8
mov ecx, eax
call fcn.00463e0c
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x224]
call fcn.004b9706
mov byte [ebp - 4], 2
push 0x78
call fcn.00651ae6
pop ecx
mov dword [ebp + 0x4c], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x57ce6e
push edi
push ebx
push 0x57a60d
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, eax
call fcn.0057d85c
jmp 0x57ce70
xor eax, eax
mov ecx, dword [ebx + 0x80]
mov byte [ebp - 4], 2
mov dword [ebx + 0x80], eax
test ecx, ecx
je 0x57ce8a
mov eax, dword [ecx]
push 1
call dword [eax]
push 1
push 3
lea ecx, [ebp - 0x174]
call fcn.00498585
push esi
mov eax, 0x6d1c94
mov byte [ebp - 4], 4
push eax
push 0x7a6a40
push eax
lea eax, [ebp - 0x6c]
push eax
push 0x6d2e8c
lea eax, [ebp + 0x1c]
push eax
push 0x6d2e88
lea eax, [ebp - 0x164]
push eax
call fcn.00428ac8
push eax
call fcn.00462f48
push eax
call fcn.00428ac8
push eax
call fcn.00462f48
push eax
call fcn.00428ac8
push eax
call fcn.00462f48
push eax
call fcn.00428ac8
push eax
call fcn.00462f48
mov eax, dword [0x7d1414]
test eax, eax
je 0x57cf2a
push eax
push 0x7197e4
push 0x7d144c
push 0x7197e8
lea eax, [ebp - 0x164]
push eax
call fcn.00428ac8
push eax
call fcn.00462f48
push eax
call fcn.00428ac8
mov ecx, eax
call fcn.00579502
and dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], 0
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x174]
call fcn.004b9706
push 0
push 0
push 6
mov byte [ebp - 4], 6
call fcn.00579e53
test eax, eax
je 0x57d00d
call fcn.005797c2
movzx esi, byte [0x7c2395]
lea ecx, [ebp + 0x54]
neg esi
push str.lowIntegrity_created
sbb esi, esi
and esi, eax
call fcn.0040f49f
test esi, esi
mov byte [ebp - 4], 7
push 1
setne al
movzx eax, al
push eax
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.00492ca5
push 0xffffffffffffffff
xor edi, edi
mov byte [ebp - 4], 8
push edi
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040f579
push edi
push 1
lea ecx, [ebp + 0x34]
call fcn.0040facf
push edi
push 1
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 6
call fcn.0040facf
cmp dword [ebp - 0x10], 8
mov ecx, dword [ebp - 0x24]
jae 0x57cfd6
lea ecx, [ebp - 0x24]
cmp dword [ebp + 0x30], 8
mov eax, dword [ebp + 0x1c]
jae 0x57cfe2
lea eax, [ebp + 0x1c]
lea edx, [ebp + 0xc]
push edx
lea edx, [ebp - 0xb0]
push edx
xor edx, edx
push edx
push edx
push edx
push edx
push edx
push edx
push ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
test esi, esi
je 0x57d042
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x57d042
cmp dword [ebp - 0x10], 8
mov ecx, dword [ebp - 0x24]
jae 0x57d019
lea ecx, [ebp - 0x24]
cmp dword [ebp + 0x30], 8
mov eax, dword [ebp + 0x1c]
jae 0x57d025
lea eax, [ebp + 0x1c]
lea edx, [ebp + 0xc]
push edx
lea edx, [ebp - 0xb0]
push edx
xor edx, edx
push edx
push edx
push edx
push edx
push edx
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov edi, eax
test edi, edi
jne 0x57d122
cmp dword [ebp + 0x30], 8
mov eax, dword [ebp + 0x1c]
jae 0x57d056
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push str.exe_exist
lea ecx, [ebp + 0x54]
mov esi, eax
call fcn.0040f49f
push 1
push esi
lea eax, [ebp + 0x54]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.00618ddd
push 0xffffffffffffffff
xor ebx, ebx
mov byte [ebp - 4], 0xa
push ebx
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040f579
push ebx
push 1
lea ecx, [ebp + 0x34]
call fcn.0040facf
push ebx
push 1
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 6
call fcn.0040facf
push str.message
lea ecx, [ebp + 0x54]
call fcn.0040f49f
push ebx
push str.Unable_to_create_remote_ie_process
lea eax, [ebp + 0x54]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.00428ecf
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0xc
call fcn.0040f579
push ebx
push 1
lea ecx, [ebp + 0x34]
call fcn.0040facf
push ebx
push 1
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 6
call fcn.0040facf
push str.remote_ieprocess
lea ecx, [ebp + 0x54]
call fcn.0040f49f
push ebx
push ebx
push ebx
lea eax, [ebp + 0x54]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x2c
call fcn.004857ae
jmp 0x57d28b
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0x18]
push ecx
lea ecx, [ebx + 0x28]
mov dword [ebx + 8], eax
call fcn.0057dfc8
mov ecx, dword [ebx + 0x80]
test ecx, ecx
je 0x57d15c
push 0x7530
call fcn.0057daa6
test al, al
je 0x57d15c
mov bl, 1
jmp 0x57d296
and dword [ebp + 0x64], 0
mov dword [ebp + 0x68], 0xf
mov byte [ebp + 0x54], 0
cmp dword [ebx + 0x80], 0
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 0xe
jne 0x57d1a7
push str.pipe_error
call fcn.0040f49f
xor ebx, ebx
mov byte [ebp - 4], 0xf
push ebx
push str.No_pipeServer_available
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00428ecf
mov byte [ebp - 4], 0x10
jmp 0x57d237
push str.timeout_error
call fcn.0040f49f
push 1
push str.timeout_on_waiting_for_remote_ie_process_to_connect
lea eax, [ebp + 0x34]
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00428ecf
push 0xffffffffffffffff
xor ebx, ebx
mov byte [ebp - 4], 0x12
push ebx
push eax
lea ecx, [ebp + 0x54]
call fcn.0040f579
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.0040facf
push ebx
push 1
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 0xe
call fcn.0040facf
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
je 0x57d25d
push str.ie_alive
lea ecx, [ebp + 0x34]
call fcn.0040f49f
cmp dword [ebp + 0x4c], 0x103
push ebx
sete al
mov byte [ebp - 4], 0x13
movzx eax, al
push eax
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00492ca5
mov byte [ebp - 4], 0x14
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x54]
call fcn.0040f579
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.0040facf
push ebx
push 1
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 0xe
call fcn.0040facf
push str.remote_ieprocess
lea ecx, [ebp + 0x34]
call fcn.0040f49f
push ebx
push ebx
push ebx
lea eax, [ebp + 0x34]
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp + 0x54]
push eax
push 0x2c
call fcn.004857ae
push ebx
push 1
lea ecx, [ebp + 0x34]
call fcn.0040facf
push ebx
push 1
lea ecx, [ebp + 0x54]
call fcn.0040facf
xor esi, esi
lea ecx, [ebp - 0x24]
push esi
push 1
call fcn.004284eb
push esi
push 1
lea ecx, [ebp - 0x3c]
call fcn.0040facf
lea ecx, [ebp - 0x174]
call fcn.0049b635
push esi
push 1
lea ecx, [ebp - 0x6c]
call fcn.004284eb
lea ecx, [ebp - 0x224]
call fcn.0049b635
pop edi
pop esi
push 0
push 1
lea ecx, [ebp + 0x1c]
call fcn.004284eb
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
lea esp, [ebp + 0x70]
pop ebp
ret