Function at 0x418e20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6b4
mov eax, dword [0x44a044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
push 0x63e
mov esi, ecx
lea ecx, [ebp - 0x646]
xor eax, eax
push edi
push ecx
mov dword [ebp - 0x64c], edi
mov word [ebp - 0x648], ax
call fcn.00427f40
add esp, 0xc
push 0x38
lea edx, [ebp - 0x688]
push edi
push edx
call fcn.00427f40
add esp, 0xc
push str.GetNativeSystemInfo
push str.kernel32
mov dword [ebp - 0x68c], 0x3c
mov dword [ebp - 0x688], 0x40
mov dword [ebp - 0x684], edi
mov dword [ebp - 0x680], edi
mov dword [ebp - 0x67c], str.tskill.exe
mov dword [ebp - 0x678], esi
mov dword [ebp - 0x674], 0x48b128
mov dword [ebp - 0x670], edi
mov dword [ebp - 0x66c], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x418eda
lea ecx, [ebp - 0x6b0]
push ecx
call eax
movzx eax, word [ebp - 0x6b0]
cmp eax, edi
je 0x418f64
cmp eax, 9
jne 0x418f64
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.Kernel32.dll
mov dword [ebp - 0x650], edi
call ebx
mov esi, eax
cmp esi, edi
je 0x418f23
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [ebp - 0x650]
push edx
call eax
push esi
test eax, eax
jne 0x418f2c
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x68c]
push ecx
jmp 0x418f6b
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x68c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push str.Kernel32.dll
call ebx
mov esi, eax
cmp esi, edi
je 0x418f71
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x418f71
lea edx, [ebp - 0x68c]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [ebp - 0x654]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
cmp esi, edi
je 0x419015
cmp esi, 0x102
je 0x418fd9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.tskill.exe
lea ecx, [ebp - 0x648]
push str._t_t_tRunCommand__s__Exception_Result:_lu__ErrorCode:_lu___Command_Fail___
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x648]
add esp, 0x14
push edx
call fcn.00406870
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421294
mov esp, ebp
pop ebp
ret
push str.tskill.exe
lea eax, [ebp - 0x648]
push str._t_t_tRunCommand__s__TimeOut__Command_Fail___
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x648]
add esp, 0xc
push ecx
call fcn.00406870
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421294
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x654]
lea edx, [ebp - 0x64c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea ecx, [ebp - 0x648]
test eax, eax
jne 0x41906d
push str.tskill.exe
push str._t_t_tRunCommand__s__Success____but_Handle_GetExitCodeProcess_failure.
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x648]
add esp, 0xc
push edx
call fcn.00406870
mov eax, dword [ebp - 0x64c]
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421294
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x64c]
push eax
push str.tskill.exe
push str._t_t_tRunCommand__s__Success__d____
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x648]
push edx
call fcn.00406870
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x64c]
add esp, 0x14
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00421294
mov esp, ebp
pop ebp
ret