Function at 0x40c9d0
Capabilities:
Create process on windows
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d5c8
mov eax, dword fs:[0]
push eax
sub esp, 0x90c
mov eax, dword [0x49ffb8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x8b0], edi
mov ebx, ecx
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x8b4], eax
call fcn.0040c0d0
test al, al
je 0x40d605
push 0xffffffffffffffff
push 0
push edi
lea ecx, [ebp - 0x840]
mov dword [ebp - 0x82c], 0xf
mov dword [ebp - 0x830], 0
mov byte [ebp - 0x840], 0
call fcn.00405240
push 1
push 0
lea eax, [ebp - 0x8ac]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x840]
mov byte [ebp - 0x8ac], 0x22
call fcn.00409f10
cmp eax, 0xffffffff
jne 0x40cb43
lea eax, [ebp - 0x840]
push eax
mov edx, 0x48dd40
lea ecx, [ebp - 0x888]
call fcn.0040ab00
add esp, 4
push 0x48dd40
push eax
lea eax, [ebp - 0x870]
push eax
mov byte [ebp - 4], 1
call fcn.0040abf0
mov edi, eax
lea eax, [ebp - 0x840]
add esp, 0xc
cmp eax, edi
je 0x40caf6
cmp dword [ebp - 0x82c], 0x10
jb 0x40cacf
push dword [ebp - 0x840]
call fcn.0043d98b
add esp, 4
push edi
lea ecx, [ebp - 0x840]
mov dword [ebp - 0x82c], 0xf
mov dword [ebp - 0x830], 0
mov byte [ebp - 0x840], 0
call fcn.004051e0
cmp dword [ebp - 0x85c], 0x10
jb 0x40cb0d
push dword [ebp - 0x870]
call fcn.0043d98b
add esp, 4
mov byte [ebp - 4], 0
cmp dword [ebp - 0x874], 0x10
mov dword [ebp - 0x85c], 0xf
mov dword [ebp - 0x860], 0
mov byte [ebp - 0x870], 0
jb 0x40cb43
push dword [ebp - 0x888]
call fcn.0043d98b
add esp, 4
cmp dword [esi + 0x10], 0
je 0x40cb6b
push 1
push 0x48d434
lea ecx, [ebp - 0x840]
call fcn.0040b0e0
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x840]
call fcn.00406250
xor eax, eax
mov dword [ebp - 0x844], 7
mov dword [ebp - 0x848], 0
mov word [ebp - 0x858], ax
lea edx, [ebp - 0x840]
lea ecx, [ebp - 0x888]
mov byte [ebp - 4], 2
call fcn.0041c500
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], 3
cmp ecx, eax
je 0x40cbb5
push 0xffffffffffffffff
push 0
push eax
call fcn.0040de90
mov byte [ebp - 4], 2
cmp dword [ebp - 0x874], 8
jb 0x40cbd0
push dword [ebp - 0x888]
call fcn.0043d98b
add esp, 4
cmp dword [ebp - 0x844], 8
push dword [ebp - 0x848]
lea eax, [ebp - 0x858]
cmovae eax, dword [ebp - 0x858]
push eax
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.0043dbe1
mov esi, dword [ebp + 0xc]
add esp, 0x10
xor eax, eax
push 0x20
push dword [esi + 0x10]
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x814], 7
mov dword [ebp - 0x818], 0
mov word [ebp - 0x828], ax
call fcn.0040ddc0
mov byte [ebp - 4], 4
cmp dword [ebp - 0x814], 8
mov edi, dword [esi + 0x14]
lea edx, [ebp - 0x828]
cmovae edx, dword [ebp - 0x828]
cmp edi, 0x10
jb 0x40cc53
mov ecx, dword [esi]
jmp 0x40cc55
mov ecx, esi
mov eax, dword [esi + 0x10]
add eax, ecx
cmp edi, 0x10
jb 0x40cc61
mov esi, dword [esi]
cmp esi, eax
je 0x40cc74
movsx cx, byte [esi]
inc esi
mov word [edx], cx
lea edx, [edx + 2]
cmp esi, eax
jne 0x40cc65
cmp dword [0x4a1a34], 3
jl 0x40cd40
lea ecx, [ebp - 0x8cc]
call fcn.0041de50
mov byte [ebp - 4], 5
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 3
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x40cca9
add eax, 0x10
jmp 0x40ccab
xor eax, eax
push str.DetourClass::CreateProcessWithInjection_running_commandLine:
push eax
call fcn.00407740
add esp, 8
lea edx, [ebp - 0x810]
mov ecx, eax
call fcn.0041d070
lea ecx, [ebp - 0x8cc]
mov byte [ebp - 4], 4
call fcn.0041dee0
cmp dword [0x4a1a34], 3
jl 0x40cd40
lea ecx, [ebp - 0x8a8]
call fcn.0041de50
mov byte [ebp - 4], 6
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 3
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x40cd06
add eax, 0x10
jmp 0x40cd08
xor eax, eax
push str.DetourClass::CreateProcessWithInjection_running_workingDirectory:
push eax
call fcn.00407740
add esp, 8
cmp dword [ebp - 0x814], 8
lea edx, [ebp - 0x828]
cmovae edx, dword [ebp - 0x828]
mov ecx, eax
call fcn.0041d070
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 4
call fcn.0041dee0
push 0x44
lea eax, [ebp - 0x918]
push 0
push eax
call fcn.0043f170
mov esi, dword [0x4a3344]
xor eax, eax
add esp, 0xc
cmp byte [ebp + 0x10], al
xorps xmm0, xmm0
sete al
movq qword [ebp - 0x8c4], xmm0
movq qword [ebp - 0x8bc], xmm0
mov dword [ebp - 0x918], 0x44
mov dword [ebp - 0x8ec], 1
mov word [ebp - 0x8e8], ax
test esi, esi
jne 0x40cdb3
push 4
call fcn.0043da33
mov esi, eax
add esp, 4
test esi, esi
je 0x40cdab
mov dword [esi], vtable.HappyCloud::PathsWindows.0
jmp 0x40cdad
xor esi, esi
mov dword [0x4a3344], esi
mov edi, esi
test esi, esi
jne 0x40cdd9
push 4
call fcn.0043da33
mov esi, eax
add esp, 4
test esi, esi
je 0x40cdd1
mov dword [esi], vtable.HappyCloud::PathsWindows.0
jmp 0x40cdd3
xor esi, esi
mov dword [0x4a3344], esi
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x28]
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x34]
mov ecx, dword [ebp - 0x8b4]
mov edx, eax
call fcn.004216d0
add esp, 4
test al, al
jne 0x40ce80
cmp dword [0x4a1a34], 1
jl 0x40d21c
lea ecx, [ebp - 0x8a8]
call fcn.0041de50
mov byte [ebp - 4], 7
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 1
mov eax, dword [eax + 4]
mov esi, dword [eax + 4]
test esi, esi
je 0x40ce35
add esi, 0x10
jmp 0x40ce37
xor esi, esi
lea ecx, [ebp - 0x888]
call fcn.00425510
push eax
push ecx
push str.DetourClass::CreateProcessWithInjection_SetEnvironmentVariableW_failed:
push esi
mov byte [ebp - 4], 8
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 8
lea ecx, [ebp - 0x888]
call fcn.00404080
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 4
call fcn.0041dee0
xor bl, bl
jmp 0x40d584
cmp dword [0x4a1a34], 2
jl 0x40d0c6
lea ecx, [ebp - 0x8a8]
call fcn.0041de50
mov byte [ebp - 4], 9
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 2
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x40ceb5
add eax, 0x10
jmp 0x40ceb7
xor eax, eax
push str.CreateProcessW_with_injection_
push eax
call fcn.00407740
add esp, 8
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 4
call fcn.0041dee0
cmp dword [0x4a1a34], 2
jl 0x40d0c6
lea ecx, [ebp - 0x8a8]
call fcn.0041de50
mov byte [ebp - 4], 0xa
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 2
mov eax, dword [eax + 4]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x40cf09
add ecx, 0x10
jmp 0x40cf0b
xor ecx, ecx
lea edx, [ebp - 0x810]
call fcn.0041d070
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 4
call fcn.0041dee0
cmp dword [0x4a1a34], 2
jl 0x40d0c6
lea ecx, [ebp - 0x8a8]
call fcn.0041de50
mov byte [ebp - 4], 0xb
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 2
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x40cf5a
add eax, 0x10
jmp 0x40cf5c
xor eax, eax
push 0x4008004
push 0x40bf70
push str.dwFlags_
push eax
call fcn.00407740
add esp, 8
mov ecx, eax
call fcn.0040bf90
mov ecx, eax
call fcn.00404210
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 4
call fcn.0041dee0
cmp dword [0x4a1a34], 2
jl 0x40d0c6
lea ecx, [ebp - 0x8a8]
call fcn.0041de50
mov byte [ebp - 4], 0xc
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 2
mov eax, dword [eax + 4]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x40cfc6
add ecx, 0x10
jmp 0x40cfc8
xor ecx, ecx
cmp dword [ebp - 0x814], 8
lea edx, [ebp - 0x828]
cmovae edx, dword [ebp - 0x828]
call fcn.0041d070
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 4
call fcn.0041dee0
cmp dword [0x4a1a34], 2
jl 0x40d0c6
lea ecx, [ebp - 0x8a8]
call fcn.0041de50
mov byte [ebp - 4], 0xd
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 2
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x40d025
add eax, 0x10
jmp 0x40d027
xor eax, eax
push dword [ebp - 0x8ec]
push 0x40bf70
push str.si.dwFlags_
push eax
call fcn.00407740
add esp, 8
mov ecx, eax
call fcn.0040bf90
mov ecx, eax
call fcn.00404210
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 4
call fcn.0041dee0
cmp dword [0x4a1a34], 2
jl 0x40d0c6
lea ecx, [ebp - 0x8a8]
call fcn.0041de50
mov byte [ebp - 4], 0xe
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 2
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x40d08e
add eax, 0x10
jmp 0x40d090
xor eax, eax
push dword [ebp - 0x8e8]
push 0x40bf70
push str.si.wShowWindow_
push eax
call fcn.00407740
add esp, 8
mov ecx, eax
call fcn.0040bf90
mov ecx, eax
call fcn.0040d900
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 4
call fcn.0041dee0
cmp dword [ebp - 0x814], 8
lea ecx, [ebp - 0x8c4]
push ecx
lea ecx, [ebp - 0x918]
push ecx
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
push 0
push 0x4008004
push 0
push 0
push 0
lea eax, [ebp - 0x810]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test al, al
jne 0x40d223
mov dword [ebp - 0x85c], 0xf
mov dword [ebp - 0x860], 0
mov byte [ebp - 0x870], al
lea edx, [ebp - 0x870]
lea ecx, [ebp - 0x8b4]
mov byte [ebp - 4], 0xf
call fcn.00425780
cmp dword [0x4a1a34], 0
jl 0x40d205
lea ecx, [ebp - 0x8a8]
call fcn.0041de50
mov byte [ebp - 4], 0x10
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 0
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x40d171
add eax, 0x10
jmp 0x40d173
xor eax, eax
push str._working_Directory:
push ecx
lea ecx, [ebp - 0x870]
push ecx
push ecx
push str._errorString:
push ecx
push dword [ebp - 0x8b4]
push ecx
push str.DetourClass::CreateProcessWithInjection_CreateProcess_failed_with_error_Code:
push eax
call fcn.00407740
add esp, 0xc
mov ecx, eax
call fcn.00404210
add esp, 4
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 0xc
push eax
call fcn.00407740
cmp dword [ebp - 0x814], 8
mov esi, eax
lea edx, [ebp - 0x828]
cmovae edx, dword [ebp - 0x828]
mov ecx, esi
call fcn.0041d070
push str._Command_Line:
push esi
call fcn.00407740
add esp, 0x10
lea edx, [ebp - 0x810]
mov ecx, eax
call fcn.0041d070
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0xf
call fcn.0041dee0
cmp dword [ebp - 0x85c], 0x10
jb 0x40d21c
push dword [ebp - 0x870]
call fcn.0043d98b
add esp, 4
xor bl, bl
jmp 0x40d584
cmp dword [0x4a1a34], 2
jl 0x40d2f7
lea ecx, [ebp - 0x8a8]
call fcn.0041de50
mov byte [ebp - 4], 0x11
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 2
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x40d258
add eax, 0x10
jmp 0x40d25a
xor eax, eax
push 0x48ddec
push 0x40c0b0
push dword [ebp - 0x8c4]
push 0x40bf70
push str.___Handle_
push ecx
push dword [ebp - 0x8b8]
push ecx
push str.___MAIN_thread_ID_
push ecx
push dword [ebp - 0x8bc]
push ecx
push str.DetourClass::CreateProcessWithInjection_Created_Process_PID__
push eax
call fcn.00407740
add esp, 0xc
mov ecx, eax
call fcn.00404210
add esp, 4
push eax
call fcn.00407740
add esp, 0xc
mov ecx, eax
call fcn.00404210
add esp, 4
push eax
call fcn.00407740
add esp, 8
mov ecx, eax
call fcn.0040bf90
mov ecx, eax
call fcn.0040dc30
mov ecx, eax
call fcn.0040bf90
push eax
call fcn.00407740
add esp, 8
lea edx, [ebp - 0x810]
mov ecx, eax
call fcn.0041d070
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 4
call fcn.0041dee0
mov dword [ebp - 0x88c], 0xf
mov dword [ebp - 0x890], 0
mov byte [ebp - 0x8a0], 0
mov ecx, dword [ebp - 0x8b0]
mov byte [ebp - 4], 0x12
call fcn.00421490
mov ecx, dword [0x4a3344]
mov byte [ebp - 0x8b0], al
test ecx, ecx
jne 0x40d351
push 4
call fcn.0043da33
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x40d349
mov dword [ecx], vtable.HappyCloud::PathsWindows.0
jmp 0x40d34b
xor ecx, ecx
mov dword [0x4a3344], ecx
mov eax, dword [ecx]
push dword [ebp - 0x8b0]
mov eax, dword [eax + 0x40]
lea edx, [ebp - 0x8a0]
push edx
call eax
test al, al
jne 0x40d3c0
cmp dword [0x4a1a34], 1
jl 0x40d3b9
lea ecx, [ebp - 0x8a8]
call fcn.0041de50
mov byte [ebp - 4], 0x13
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 1
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x40d39a
add eax, 0x10
jmp 0x40d39c
xor eax, eax
push str.DetourClass::CreateProcessWithInjection_GetDetourFileopsDLLPath_failed
push eax
call fcn.00407740
add esp, 8
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x12
call fcn.0041dee0
xor bl, bl
jmp 0x40d552
mov eax, dword [ebp - 0x8c4]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x8bc]
lea edx, [ebp - 0x8a0]
mov ecx, ebx
mov dword [ebx + 8], eax
call fcn.0040c180
push dword [ebp - 0x8c0]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [0x4a1a34], 3
mov esi, eax
jl 0x40d446
lea ecx, [ebp - 0x8a8]
call fcn.0041de50
mov byte [ebp - 4], 0x14
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 3
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x40d41e
add eax, 0x10
jmp 0x40d420
xor eax, eax
push esi
push ecx
push str.DetourClass::CreateProcessWithInjection_ResumeThread_returned
push eax
call fcn.00407740
add esp, 0xc
mov ecx, eax
call fcn.00404210
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x12
call fcn.0041dee0
push dword [ebp - 0x8c0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40d4ce
cmp dword [0x4a1a34], eax
jl 0x40d4ce
lea ecx, [ebp - 0x8a8]
call fcn.0041de50
mov byte [ebp - 4], 0x15
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 0
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x40d486
add eax, 0x10
jmp 0x40d488
xor eax, eax
push 0x40c0b0
push ecx
push dword [ebp - 0x8c0]
push 0x40bf70
push str.DetourClass::CreateProcessWithInjection_failed_to_CloseHandle
push eax
call fcn.00407740
add esp, 8
mov ecx, eax
call fcn.0040bf90
mov ecx, eax
call fcn.0040dc30
add esp, 4
mov ecx, eax
call fcn.0040bf90
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x12
call fcn.0041dee0
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
test eax, eax
jne 0x40d550
cmp dword [0x4a1a34], 1
jl 0x40d550
lea ecx, [ebp - 0x8a8]
call fcn.0041de50
mov byte [ebp - 4], 0x16
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 1
mov eax, dword [eax + 4]
mov esi, dword [eax + 4]
test esi, esi
je 0x40d50c
add esi, 0x10
jmp 0x40d50e
xor esi, esi
lea ecx, [ebp - 0x888]
call fcn.00425470
push eax
push ecx
push str.DetourClass::CreateProcessWithInjection_AllowSetForegroundWindow_failed:
push esi
mov byte [ebp - 4], 0x17
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 8
lea ecx, [ebp - 0x888]
call fcn.00404080
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x12
call fcn.0041dee0
mov bl, 1
cmp dword [ebp - 0x88c], 0x10
jb 0x40d569
push dword [ebp - 0x8a0]
call fcn.0043d98b
add esp, 4
mov dword [ebp - 0x88c], 0xf
mov dword [ebp - 0x890], 0
mov byte [ebp - 0x8a0], 0
cmp dword [ebp - 0x814], 8
jb 0x40d59b
push dword [ebp - 0x828]
call fcn.0043d98b
add esp, 4
xor eax, eax
cmp dword [ebp - 0x844], 8
mov dword [ebp - 0x814], 7
mov dword [ebp - 0x818], 0
mov word [ebp - 0x828], ax
jb 0x40d5cf
push dword [ebp - 0x858]
call fcn.0043d98b
add esp, 4
xor eax, eax
cmp dword [ebp - 0x82c], 0x10
mov dword [ebp - 0x844], 7
mov dword [ebp - 0x848], 0
mov word [ebp - 0x858], ax
jb 0x40d603
push dword [ebp - 0x840]
call fcn.0043d98b
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043cee8
mov esp, ebp
pop ebp
ret