Function at 0x4041ab
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45a20b
mov eax, dword fs:[0]
push eax
mov eax, 0x2ffc
call fcn.0043ddc0
mov eax, dword [0x47d9a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
lea eax, [ebp - 0x2fd8]
inc edi
push eax
mov dword [ebp - 4], edi
call fcn.004080a1
mov byte [ebp - 4], 2
call fcn.0041bb36
push eax
lea ecx, [ebp - 0x2fe0]
call fcn.00405f08
mov byte [ebp - 4], 3
call fcn.0041bb36
push eax
lea ecx, [ebp - 0x3004]
call fcn.00405f08
mov byte [ebp - 4], 4
call fcn.0041bb36
push eax
lea ecx, [ebp - 0x3000]
call fcn.00405f08
push ecx
mov byte [ebp - 4], 5
lea eax, [ebp + 8]
mov dword [ebp - 0x2ff8], esp
mov ecx, esp
push eax
call fcn.00403172
call fcn.00419d53
cmp dword [ebp + 0xc], 0
push ecx
setne al
mov ecx, esp
mov dword [ebp - 0x2ff8], esp
mov ebx, str.Settings.conf
push ebx
mov byte [0x482420], al
call fcn.00402eee
call fcn.00419055
lea eax, [ebp - 0x2fdc]
push eax
call fcn.00419e07
push eax
lea ecx, [ebp - 0x2fe0]
mov byte [ebp - 4], 6
call fcn.00403190
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x2fdc]
add ecx, 0xfffffff0
call fcn.004010ea
push str.__k
lea ecx, [ebp - 0x2fe0]
call fcn.00403433
mov eax, dword [ebp + 8]
push dword [eax - 0xc]
lea ecx, [ebp - 0x2fe0]
push eax
call fcn.00403682
cmp dword [ebp + 0xc], edi
lea eax, [ebp - 0x2fe0]
jne 0x4042d2
push str.__Agent
jmp 0x4042d7
push str.__Viewer
push eax
call fcn.00402fc0
push str._showInit_0
lea eax, [ebp - 0x2fe0]
push eax
call fcn.00402fc0
cmp dword [esi + 0x48], edi
jne 0x404304
push str.__loghere
lea eax, [ebp - 0x2fe0]
push eax
call fcn.00402fc0
cmp dword [ebp + 0x14], 0
je 0x404349
push str.__ControlAlwaysKey
lea eax, [ebp - 0x2fe0]
push eax
call fcn.00402fc0
lea eax, [ebp - 0x2fdc]
push eax
call fcn.00403916
push eax
lea ecx, [ebp - 0x2fe0]
mov byte [ebp - 4], 7
call fcn.004031dd
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x2fdc]
add ecx, 0xfffffff0
call fcn.004010ea
push ecx
mov ecx, esp
mov dword [ebp - 0x2ff8], esp
push ebx
call fcn.00402eee
call fcn.00419055
mov edi, dword [ebp - 0x2fe0]
push edi
push str.args_:__s
call fcn.004074db
call fcn.004147dc
push eax
push str.Admin:_d
call fcn.004074db
push dword [esi + 0x28]
push str.Agent_exe_started.:_s
call fcn.004074db
mov eax, dword [esi + 0x28]
add esp, 0x18
push 1
push eax
push edi
push str.agent.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push eax
push str.Application_started_with_status_code_:__d
mov dword [ebp - 0x2ffc], eax
call fcn.004074db
pop ecx
pop ecx
mov ecx, esi
call fcn.00404c03
mov dword [ebp - 0x2fdc], eax
call fcn.0041bb36
push eax
lea ecx, [ebp - 0x2fec]
call fcn.00405f08
push dword [ebp - 0x2ffc]
lea eax, [ebp - 0x2fec]
push str.Status_code:_d_
push eax
mov byte [ebp - 4], 8
call fcn.00403880
add esp, 0xc
push str.ExeName:
lea ecx, [ebp - 0x2fec]
call fcn.00403433
lea eax, [esi + 0x34]
push eax
lea ecx, [ebp - 0x2fec]
call fcn.004031dd
push str._Msg:
lea ecx, [ebp - 0x2fec]
call fcn.00403433
mov ebx, dword [ebp + 0x10]
push dword [ebx - 0xc]
lea ecx, [ebp - 0x2fec]
push ebx
call fcn.00403682
push dword [edi - 0xc]
lea ecx, [ebp - 0x2fec]
push edi
call fcn.00403682
push ecx
lea eax, [esi + 0x38]
mov dword [ebp - 0x2ff8], esp
mov ecx, esp
push eax
call fcn.00403172
push ecx
mov byte [ebp - 4], 9
lea eax, [ebp - 0x2fec]
mov dword [ebp - 0x2fe4], esp
mov ecx, esp
push eax
call fcn.00403172
push ecx
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x2fe8], esp
push 0x481f68
call fcn.00402eee
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x2ff4], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0xb
call fcn.00403172
push dword [ebp - 0x2fdc]
mov byte [ebp - 4], 8
call fcn.00404da6
add esp, 0x14
mov dword [ebp - 0x2ff8], eax
call fcn.0041bb36
push eax
lea ecx, [ebp - 0x2fdc]
call fcn.00405f08
mov byte [ebp - 4], 0xc
cmp dword [0x4827c4], 0
je 0x404542
lea eax, [ebp - 0x2fe8]
push eax
call fcn.0040394e
mov byte [ebp - 4], 0xd
push dword [eax]
lea eax, [ebp - 0x2fdc]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.JOIN_INVOKED_THROUGH_LAUNCH_APPLICATION__key:_s___role:_d___old_client_id:_s_
push eax
call fcn.00403880
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x2fe8]
add esp, 0x14
add ecx, 0xfffffff0
call fcn.004010ea
push ecx
lea eax, [ebp - 0x2fdc]
mov dword [ebp - 0x2ff4], esp
mov ecx, esp
push eax
call fcn.00403172
lea ecx, [ebp - 0x2fd8]
call fcn.0040947f
push str.join_exe_got_invoked_through_launch_application
call fcn.004074db
pop ecx
jmp 0x4045ce
call fcn.0041bb36
push eax
lea ecx, [ebp - 0x2fe8]
call fcn.00405f08
lea eax, [ebp - 0x2fe4]
push eax
mov byte [ebp - 4], 0xe
call fcn.0040394e
mov byte [ebp - 4], 0xf
push dword [eax]
lea eax, [ebp - 0x2fe8]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.JOIN_INVOKED_THROUGH_DOWNLOAD__key:_s___role:_d___old_client_id:_s_
push eax
call fcn.00403880
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x2fe4]
add esp, 0x14
add ecx, 0xfffffff0
call fcn.004010ea
push ecx
lea eax, [ebp - 0x2fe8]
mov dword [ebp - 0x2ff4], esp
mov ecx, esp
push eax
call fcn.00403172
lea ecx, [ebp - 0x2fd8]
call fcn.0040947f
push str.join_exe_got_invoked_through_download
call fcn.004074db
pop ecx
mov ecx, dword [ebp - 0x2fe8]
add ecx, 0xfffffff0
call fcn.004010ea
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x2fdc]
add ecx, 0xfffffff0
call fcn.004010ea
lea eax, [ebp - 0x2fe4]
push eax
call fcn.0040394e
mov eax, dword [eax]
cmp dword [eax - 0xc], 5
mov ecx, dword [ebp - 0x2fe4]
setg byte [ebp - 0x2fed]
add ecx, 0xfffffff0
call fcn.004010ea
cmp byte [ebp - 0x2fed], 0
je 0x404699
call fcn.0041bb36
push eax
lea ecx, [ebp - 0x2fdc]
call fcn.00405f08
lea eax, [ebp - 0x2fe4]
push eax
mov byte [ebp - 4], 0x10
call fcn.0040394e
mov byte [ebp - 4], 0x11
push dword [eax]
lea eax, [ebp - 0x2fdc]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.ROLE_CHANGE_JOIN_SUCCEEDED__s__role:_d___old_client_id:_s_
push eax
call fcn.00403880
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x2fe4]
add esp, 0x14
add ecx, 0xfffffff0
call fcn.004010ea
push ecx
lea eax, [ebp - 0x2fdc]
mov dword [ebp - 0x2ff4], esp
mov ecx, esp
push eax
call fcn.00403172
lea ecx, [ebp - 0x2fd8]
call fcn.0040947f
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x2fdc]
add ecx, 0xfffffff0
call fcn.004010ea
cmp dword [ebp - 0x2ffc], 2
jne 0x40471e
cmp dword [0x4823ec], 0
jne 0x40471e
mov ebx, dword [0x482414]
lea eax, [ebp - 0x2fe8]
push 0x2347
push eax
call fcn.004165c1
mov dword [ebp - 0x2fe4], eax
lea eax, [ebp - 0x2fdc]
mov byte [ebp - 4], 0x12
mov ebx, dword [0x482414]
push 0x2349
push eax
call fcn.004165c1
mov ecx, dword [ebp - 0x2fe4]
mov ecx, dword [ecx]
mov eax, dword [eax]
add esp, 0x10
push 0
push ecx
push eax
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x2fdc]
add ecx, 0xfffffff0
call fcn.004010ea
mov ecx, dword [ebp - 0x2fe8]
add ecx, 0xfffffff0
call fcn.004010ea
mov ebx, dword [ebp + 0x10]
jmp 0x40476e
push ecx
mov ecx, esp
mov dword [ebp - 0x2ff4], esp
push str.Unknown_error
call fcn.00402eee
push 2
call fcn.0040afe7
cmp dword [ebp - 0x2ffc], 0x2a
jne 0x40476e
cmp dword [ebp - 0x2ff8], 7
push ecx
mov ecx, esp
mov dword [ebp - 0x2ff4], esp
jne 0x40475a
push str.Connection_Succeeded
jmp 0x40475f
push str.Connection_Succeeded___older_agent__
call fcn.00402eee
push 0xc8
call fcn.0040afe7
mov ecx, dword [ebp - 0x2fec]
add ecx, 0xfffffff0
call fcn.004010ea
mov ecx, dword [ebp - 0x3000]
add ecx, 0xfffffff0
call fcn.004010ea
mov ecx, dword [ebp - 0x3004]
add ecx, 0xfffffff0
call fcn.004010ea
lea ecx, [edi - 0x10]
call fcn.004010ea
lea esi, [ebp - 0x2fd8]
call fcn.004081aa
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004010ea
lea ecx, [ebx - 0x10]
call fcn.004010ea
mov eax, dword [ebp - 0x2ffc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00436e5a
leave
ret 0x10