Function at 0x450a30
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4880ca
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x4b666c]
xor eax, ebp
mov dword [ebp - 0x94], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x49df50
push 0x49df58
mov eax, dword [ebp + 0x10]
push eax
push 0x49df60
mov ecx, dword [ebp + 0xc]
push ecx
push 0x49df68
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0xb8]
push eax
call fcn.0040a340
add esp, 0xc
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x110]
push edx
lea eax, [ebp - 0xbc]
push eax
call fcn.0041e160
add esp, 0xc
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x114]
mov dword [ebp - 0x118], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x118]
push edx
lea eax, [ebp - 0xc0]
push eax
call fcn.0040a340
add esp, 0xc
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x11c]
mov dword [ebp - 0x120], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x120]
push edx
lea eax, [ebp - 0xc4]
push eax
call fcn.0041e160
add esp, 0xc
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x128], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x128]
push edx
lea eax, [ebp - 0xc8]
push eax
call fcn.0040a340
add esp, 0xc
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x130], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x130]
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.0040a340
add esp, 0xc
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xc8]
call fcn.00411360
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xc4]
call fcn.00411360
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xc0]
call fcn.00411360
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xbc]
call fcn.00411360
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xb8]
call fcn.00411360
push 0x44
push 0
lea ecx, [ebp - 0x84]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x84], 0x44
push 0x10
push 0
lea edx, [ebp - 0x28]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x84]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x18]
call fcn.004113f0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x450cf9
push 0x4b675c
call fcn.00402b50
add esp, 4
mov dword [ebp - 0x88], eax
push 0x4e20
mov ecx, dword [ebp - 0x88]
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
movzx edx, al
test edx, edx
je 0x450cd0
call sub.log4cplusU.dll_class_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______cdecl_log4cplus::detail::get_macro_body_oss_void_
mov dword [ebp - 0x8c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess_failed:
mov eax, dword [ebp - 0x8c]
push eax
call fcn.00401ba0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
push 0x49df88
push 0xa87
push 0x49e0ec
lea ecx, [ebp - 0xe4]
push ecx
mov ecx, dword [ebp - 0x8c]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::str_void_]
mov dword [ebp - 0x134], eax
mov edx, dword [ebp - 0x134]
mov dword [ebp - 0x138], edx
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x138]
push eax
push 0x4e20
mov ecx, dword [ebp - 0x88]
push ecx
call sub.log4cplusU.dll_void___cdecl_log4cplus::detail::macro_forced_log_class_log4cplus::Logger_const___int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int__char_const__
add esp, 0x18
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xe4]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor edx, edx
jne 0x450c11
mov byte [ebp - 0xe5], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00411360
mov al, byte [ebp - 0xe5]
jmp 0x450ed6
push 0
call fcn.004517b0
add esp, 4
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
push 0
call fcn.004517b0
add esp, 4
push edx
push eax
call fcn.00451790
add esp, 0x10
fcomp qword [0x49e450]
fnstsw ax
test ah, 0x41
jne 0x450d34
jmp 0x450d65
push 0x3e8
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x102
jne 0x450d61
call sub.OSUtil.dll_Ordinal_7_1
call sub.OSUtil.dll_Ordinal_8_1
jmp 0x450d63
jmp 0x450d65
jmp 0x450d09
mov byte [ebp - 0x35], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x450ea4
cmp dword [ebp - 0x14], 0xffffff91
jne 0x450d9a
mov byte [ebp - 0x35], 1
jmp 0x450ea4
mov byte [ebp - 0xac], 0
xor edx, edx
mov dword [ebp - 0xab], edx
mov dword [ebp - 0xa7], edx
mov dword [ebp - 0xa3], edx
mov dword [ebp - 0x9f], edx
mov dword [ebp - 0x9b], edx
mov eax, dword [ebp - 0x14]
push eax
push 0x49e100
push 0x15
lea ecx, [ebp - 0xac]
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf_s]
add esp, 0x10
push 0x4b675c
call fcn.00402b50
add esp, 4
mov dword [ebp - 0xb0], eax
push 0x4e20
mov ecx, dword [ebp - 0xb0]
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
movzx edx, al
test edx, edx
je 0x450e9c
call sub.log4cplusU.dll_class_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______cdecl_log4cplus::detail::get_macro_body_oss_void_
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0xac]
push eax
push str.driver_setup_ret___
mov ecx, dword [ebp - 0xb4]
push ecx
call fcn.00401ba0
add esp, 8
push eax
call fcn.00401ba0
add esp, 8
push str.bool___cdecl_CSingleMobile::LoadDriverSetup_const_class_ATL::CStringT_wchar_t_class_ATL::StrTraitATL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_______const_class_ATL::CStringT_wchar_t_class_ATL::StrTraitATL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_______const_class_ATL::CStringT_wchar_t_class_ATL::StrTraitATL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_______
push 0xaae
push 0x49e284
lea edx, [ebp - 0x104]
push edx
mov ecx, dword [ebp - 0xb4]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::str_void_]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x140], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x140]
push ecx
push 0x4e20
mov edx, dword [ebp - 0xb0]
push edx
call sub.log4cplusU.dll_void___cdecl_log4cplus::detail::macro_forced_log_class_log4cplus::Logger_const___int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int__char_const__
add esp, 0x18
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x104]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor eax, eax
jne 0x450ddc
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x35]
mov byte [ebp - 0x105], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00411360
mov al, byte [ebp - 0x105]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x94]
xor ecx, ebp
call fcn.0047f406
mov esp, ebp
pop ebp
ret