Function at 0x403e80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42284b
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
mov edx, 0x7c
call fcn.00408130
mov esi, dword [ebp - 0x1c]
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp esi, ecx
je 0x403f25
mov edx, str.__r_t_n
mov ecx, esi
call fcn.00407990
mov edx, str.__r_t_n
mov ecx, esi
call fcn.00407a20
mov ecx, dword [ebp - 0x18]
add esi, 0x18
cmp esi, ecx
jne 0x403f00
mov esi, dword [ebp - 0x1c]
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 2
jne 0x4043b7
mov byte [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xe4]
push dword [ebp - 0x1c]
mov edx, 0x430294
call fcn.004045f0
add esp, 4
push 2
push 0x43028c
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00404820
mov dword [ebp - 0xb4], 0
xor ecx, ecx
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x90], 1
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xc4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xb4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x2c], 8
lea ecx, [eax + 0x18]
jb 0x403fee
mov ecx, dword [eax + 0x18]
push dword [eax + 0x28]
push ecx
lea ecx, [ebp - 0xc4]
call fcn.00404820
mov dword [ebp - 0x9c], 0
xor ecx, ecx
mov dword [ebp - 0x98], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xac], xmm0
movups xmmword [ebp - 0xf4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x9c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
movq qword [ebp - 0xcc], xmm0
mov word [eax], cx
mov dword [ebp - 0x90], 3
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 5
call fcn.00403a50
movups xmm0, xmmword [ebp - 0xf4]
xor eax, eax
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 7
movups xmmword [ebp - 0x38], xmm0
mov word [ebp - 0xac], ax
movq xmm0, qword [ebp - 0xcc]
movq qword [ebp - 0x28], xmm0
mov byte [ebp - 4], 6
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], 7
mov word [ebp - 0xac], ax
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0xb0]
cmp edx, 8
jb 0x4040f4
mov ecx, dword [ebp - 0xc4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4040ea
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4043e3
push edx
push ecx
call fcn.0040fa5a
add esp, 8
xor eax, eax
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 7
mov word [ebp - 0xc4], ax
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0xd0]
cmp edx, 8
jb 0x404155
mov ecx, dword [ebp - 0xe4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40414b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4043e8
push edx
push ecx
call fcn.0040fa5a
add esp, 8
xor eax, eax
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd0], 7
mov word [ebp - 0xe4], ax
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov word [ebp - 0x3a], ax
mov eax, 1
mov word [ebp - 0x4c], ax
mov eax, dword [ebp - 0x1c]
movlpd qword [ebp - 0x78], xmm0
movlpd qword [ebp - 0x70], xmm0
movlpd qword [ebp - 0x68], xmm0
movlpd qword [ebp - 0x60], xmm0
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x4a], xmm0
movlpd qword [ebp - 0x42], xmm0
movups xmmword [ebp - 0x8c], xmm0
mov dword [ebp - 0x7c], 0x44
mov dword [ebp - 0x50], 1
cmp dword [eax + 0x14], 8
jb 0x4041c9
mov eax, dword [eax]
push 0x430298
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
neg eax
mov dword [ebp - 0x20], 0
mov esi, 0
sbb eax, eax
mov dword [ebp - 0x20], esi
and eax, 1
mov byte [ebp - 4], 0x12
je 0x40429e
call fcn.00404b50
push 8
mov byte [ebp - 4], 0x13
call fcn.0040fa2a
mov edi, eax
xorps xmm0, xmm0
mov dword [ebp - 0xc8], edi
mov eax, 0xf
mov dword [ebp - 0x94], edi
add esp, 4
mov dword [ebp - 0x94], esi
mov ecx, edi
mov dword [ebp - 0x90], 0xb
mov esi, edi
mov dword [ebp - 0x20], esi
movq qword [edi], xmm0
mov dword [ebp - 0x90], 0xf
mov dword [ebp - 0x90], eax
and eax, 0xfffffffb
mov dword [ebp - 0x90], eax
mov dword [edi], vtable.RC::RCWebProtectDriverIo.0
mov dword [edi + 4], 0xffffffff
mov byte [ebp - 4], 0x12
mov eax, dword [edi]
mov eax, dword [eax + 4]
call eax
test al, al
jne 0x404285
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 0x17
mov ecx, edi
mov eax, dword [edi]
push 1
call dword [eax]
mov byte [ebp - 4], 0x12
jmp 0x40429e
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0x14], 8
jb 0x404290
mov ecx, dword [ecx]
mov eax, dword [edi]
push 0
push 1
push 1
push ecx
mov ecx, edi
call dword [eax + 0xc]
cmp dword [ebp - 0x24], 8
lea ecx, [ebp - 0x8c]
push ecx
lea ecx, [ebp - 0x7c]
push ecx
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x38]
cmovae eax, dword [ebp - 0x38]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4042ea
push dword [ebp - 0x8c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x88]
call edi
mov ecx, 0x2710
jmp 0x404322
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2e4
jne 0x404320
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x2c], 8
lea ecx, [eax + 0x18]
jb 0x404305
mov ecx, dword [ecx]
cmp dword [eax + 0x14], 8
jb 0x40430d
mov eax, dword [eax]
push 5
push 0
push ecx
push eax
push str.Runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
test esi, esi
je 0x40434e
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, esi
xor esi, esi
mov dword [ebp - 0x20], esi
test ecx, ecx
je 0x40434e
mov byte [ebp - 4], 0x18
mov eax, dword [ecx]
push 1
call dword [eax]
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 2
test esi, esi
je 0x404366
mov byte [ebp - 4], 0x19
mov ecx, esi
mov eax, dword [esi]
push 1
call dword [eax]
mov byte [ebp - 4], 2
mov byte [ebp - 4], 0x1a
mov edx, dword [ebp - 0x24]
cmp edx, 8
jb 0x4043a0
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404396
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4043ed
push edx
push ecx
call fcn.0040fa5a
add esp, 8
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.004044e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040fa19
mov esp, ebp
pop ebp
ret 4
call fcn.00413b29
call fcn.00413b29
call fcn.00413b29
int3