Function at 0x40a2a0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0xffffffffffffffff
push 0x525df1
mov eax, dword fs:[0]
push eax
sub esp, 0x2cc
mov eax, dword [0x581500]
xor eax, esp
mov dword [esp + 0x2c8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x581500]
xor eax, esp
push eax
lea eax, [esp + 0x2e0]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2f0]
xor ebx, ebx
mov esi, ecx
cmp byte [0x58e9a4], bl
jne 0x40a5dd
call fcn.0040db40
cmp byte [eax + 0x96a], bl
je 0x40a5dd
cmp byte [0x58e9a4], bl
jne 0x40a5dd
cmp word [ebp], bx
je 0x40a5dd
call fcn.0040db40
cmp byte [eax + 0x96a], bl
je 0x40a5dd
cmp byte [0x58e9a4], bl
jne 0x40a5dd
call fcn.0040db40
cmp byte [eax + 0x128], bl
je 0x40a348
add eax, 0x18
jmp 0x40a34b
mov eax, dword [eax + 0x14]
add eax, 4
cmp eax, ebx
je 0x40a5e1
cmp word [eax], bx
je 0x40a5e1
push ebx
push ebx
push ebx
push ebx
push str.SGTool.exe
push eax
lea ecx, [esp + 0xa4]
call fcn.0040e250
mov dword [esp + 0x2e8], ebx
mov dword [esp + 0x18], vtable.t_errorList.0
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], vtable.t_errorList::t_mem.0
lea edi, [esp + 0x18]
mov byte [esp + 0x2e8], 1
call fcn.00415780
test al, al
jne 0x40a3d3
push 0x55c1d4
mov ecx, esi
call fcn.00402ea0
lea ecx, [esp + 0x18]
call fcn.00415740
lea ecx, [esp + 0x8c]
call fcn.00411680
jmp 0x40a5ed
mov eax, dword [esp + 0x2f4]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov edi, ebp
call fcn.004158a0
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebp, eax
cmp ebp, ebx
jne 0x40a3ff
push 0x55c1f0
jmp 0x40a3b2
push 6
push ebp
call fcn.00413790
push 6
push ebp
call fcn.004137e0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 0x10
push ebx
push 1
push 0x10000000
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], ebx
call edi
push eax
push ebp
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x40a44b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x55c204
jmp 0x40a3b2
push 0x40
lea eax, [esp + 0x4c]
push ebx
push eax
mov dword [esp + 0x50], 0x44
call fcn.004ff6c0
xor eax, eax
add esp, 0xc
lea ecx, [esp + 0x1b4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call fcn.004114e0
push str.__hevent
push str.__list
push 0x55c22c
mov byte [esp + 0x2f4], 2
mov edi, dword [esp + 0x20]
push 0x55c228
lea ecx, [esp + 0x9c]
call fcn.00411da0
push eax
push 0x55c228
lea ecx, [esp + 0x1cc]
call fcn.00411ca0
mov ecx, eax
call fcn.00411ca0
mov ecx, eax
call fcn.00411ca0
mov ecx, eax
call fcn.00411ca0
mov ecx, eax
call fcn.00411ca0
mov ecx, eax
call fcn.00411ca0
push edi
push 0x55db48
mov edx, eax
call fcn.00411e80
add esp, 8
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x48]
push edx
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
mov ecx, 0x104
lea eax, [esp + 0x1d4]
call fcn.00411a80
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40a57b
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call edi
mov eax, dword [esp + 0x14]
push eax
call edi
lea edi, [esp + 0x1b4]
call fcn.00411ab0
lea ecx, [esp + 0x8c]
call fcn.00411da0
push eax
push str._T_vz1Y_
mov ebx, esi
call fcn.0040a620
mov ecx, eax
call fcn.00411ca0
mov ecx, eax
call fcn.00411ca0
push 0x55c1d4
mov ecx, esi
call fcn.00402ea0
mov ecx, edi
call fcn.00411680
jmp 0x40a3b9
lea edi, [esp + 0x1b4]
call fcn.00411ab0
mov ecx, dword [esp + 0x2c]
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x44]
push edx
push 2
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ebp
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x30]
push ecx
call esi
push ebp
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
mov ecx, edi
call fcn.00411680
lea ecx, [esp + 0x18]
call fcn.00415740
lea ecx, [esp + 0x8c]
call fcn.00411680
mov al, 1
jmp 0x40a5ef
push 0x55c1a8
mov ecx, esi
call fcn.00402ea0
xor al, al
mov ecx, dword [esp + 0x2e0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c8]
xor ecx, esp
call fcn.004fa259
add esp, 0x2d8
ret