Function at 0x68d5f2
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
sub esp, 0x6c
mov eax, 0x6b0ae1
call fcn.006375a8
sub esp, 0x218
push ebx
lea eax, [ebp + 0x6f]
mov byte [ebp + 0x6f], 0
push eax
lea eax, [ebp + 0x1c]
mov ebx, ecx
push eax
call fcn.0068cf2d
and dword [ebp - 4], 0
cmp byte [ebp + 0x6f], 0
jne 0x68d62b
xor bl, bl
jmp 0x68db6c
push esi
push edi
push 0x44
pop esi
push esi
lea eax, [ebp - 0xb0]
push 0
push eax
call fcn.00651ed0
xor eax, eax
mov dword [ebp - 0xb0], esi
lea edi, [ebp + 0xc]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov esi, eax
xor edi, edi
lea eax, [ebp - 0xc4]
push edi
mov dword [ebp + 0x50], eax
lea eax, [ebp + 0x50]
push eax
push 1
push str.S:_ML__NW___LW_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
mov eax, dword [ebp + 0x50]
push edi
push edi
push 6
mov dword [ebp + 4], eax
mov dword [ebp], 0xc
mov dword [ebp + 8], 1
call fcn.0068c35a
neg eax
lea ecx, [ebp - 0x224]
push 1
sbb edi, edi
lea eax, [ebp]
push 3
and edi, eax
call fcn.00498a19
push dword [0x799cc4]
mov ecx, 0x799cc0
mov byte [ebp - 4], 1
push dword [0x799cc0]
push 0x7dade8
call fcn.0068b022
push eax
mov eax, 0x72eb80
push eax
push ebx
push eax
push esi
push eax
mov esi, 0x799cc8
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.004914f0
push eax
call fcn.00426d32
mov ecx, eax
call fcn.0068b9c0
push eax
call fcn.00426d32
mov ecx, eax
call fcn.0068bac5
push eax
call fcn.00426d32
mov ecx, eax
call fcn.004916a2
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x224]
call fcn.004b91ca
mov byte [ebp - 4], 2
push 0x78
call fcn.00637305
pop ecx
mov dword [ebp + 0x4c], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x68d747
push edi
push ebx
push 0x68c9c4
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, eax
call fcn.0068e80d
jmp 0x68d749
xor eax, eax
mov ecx, dword [ebx + 0x80]
mov byte [ebp - 4], 2
mov dword [ebx + 0x80], eax
test ecx, ecx
je 0x68d763
mov eax, dword [ecx]
push 1
call dword [eax]
push 1
push 3
lea ecx, [ebp - 0x174]
call fcn.00498a19
push esi
mov eax, 0x6b69e0
mov byte [ebp - 4], 4
push eax
push 0x799ce0
push eax
lea eax, [ebp - 0x6c]
push eax
push 0x6b7bec
lea eax, [ebp + 0x1c]
push eax
push 0x6b7be8
lea eax, [ebp - 0x164]
push eax
call fcn.00426d32
push eax
call fcn.004914f0
push eax
call fcn.00426d32
push eax
call fcn.004914f0
push eax
call fcn.00426d32
push eax
call fcn.004914f0
push eax
call fcn.00426d32
push eax
call fcn.004914f0
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x174]
call fcn.004b91ca
xor eax, eax
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x24], al
push eax
push eax
push 6
mov byte [ebp - 4], 6
call fcn.0068c35a
test eax, eax
je 0x68d8a8
call fcn.0068bc80
movzx esi, byte [0x79fa81]
lea ecx, [ebp + 0x54]
neg esi
push str.lowIntegrity_created
sbb esi, esi
and esi, eax
call fcn.0040d4cf
test esi, esi
mov byte [ebp - 4], 7
push 1
setne al
movzx eax, al
push eax
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.0049372a
push 0xffffffffffffffff
xor edi, edi
mov byte [ebp - 4], 8
push edi
push eax
lea ecx, [ebp - 0x24]
call fcn.0040d5a9
push edi
push 1
lea ecx, [ebp + 0x34]
call fcn.0040daff
push edi
push 1
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 6
call fcn.0040daff
cmp dword [ebp - 0x28], 8
mov ecx, dword [ebp - 0x3c]
jae 0x68d871
lea ecx, [ebp - 0x3c]
cmp dword [ebp + 0x30], 8
mov eax, dword [ebp + 0x1c]
jae 0x68d87d
lea eax, [ebp + 0x1c]
lea edx, [ebp + 0xc]
push edx
lea edx, [ebp - 0xb0]
push edx
xor edx, edx
push edx
push edx
push edx
push edx
push edx
push edx
push ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
test esi, esi
je 0x68d8dd
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x68d8dd
cmp dword [ebp - 0x28], 8
mov ecx, dword [ebp - 0x3c]
jae 0x68d8b4
lea ecx, [ebp - 0x3c]
cmp dword [ebp + 0x30], 8
mov eax, dword [ebp + 0x1c]
jae 0x68d8c0
lea eax, [ebp + 0x1c]
lea edx, [ebp + 0xc]
push edx
lea edx, [ebp - 0xb0]
push edx
xor edx, edx
push edx
push edx
push edx
push edx
push edx
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov edi, eax
test edi, edi
jne 0x68d9bd
cmp dword [ebp + 0x30], 8
mov eax, dword [ebp + 0x1c]
jae 0x68d8f1
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push str.exe_exist
lea ecx, [ebp + 0x54]
mov esi, eax
call fcn.0040d4cf
push 1
push esi
lea eax, [ebp + 0x54]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.0046a068
push 0xffffffffffffffff
xor ebx, ebx
mov byte [ebp - 4], 0xa
push ebx
push eax
lea ecx, [ebp - 0x24]
call fcn.0040d5a9
push ebx
push 1
lea ecx, [ebp + 0x34]
call fcn.0040daff
push ebx
push 1
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 6
call fcn.0040daff
push 0x6d3154
lea ecx, [ebp + 0x54]
call fcn.0040d4cf
push ebx
push str.Unable_to_create_remote_ie_process
lea eax, [ebp + 0x54]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.004684c0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xc
call fcn.0040d5a9
push ebx
push 1
lea ecx, [ebp + 0x34]
call fcn.0040daff
push ebx
push 1
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 6
call fcn.0040daff
push str.remote_ieprocess
lea ecx, [ebp + 0x54]
call fcn.0040d4cf
push ebx
push ebx
push ebx
lea eax, [ebp + 0x54]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x24]
push eax
push 0x2c
call fcn.00485ab0
jmp 0x68db26
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0x18]
push ecx
lea ecx, [ebx + 0x28]
mov dword [ebx + 8], eax
call fcn.0068e440
mov ecx, dword [ebx + 0x80]
test ecx, ecx
je 0x68d9f7
push 0x7530
call fcn.0068ea57
test al, al
je 0x68d9f7
mov bl, 1
jmp 0x68db31
and dword [ebp + 0x64], 0
mov dword [ebp + 0x68], 0xf
mov byte [ebp + 0x54], 0
cmp dword [ebx + 0x80], 0
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 0xe
jne 0x68da42
push str.pipe_error
call fcn.0040d4cf
xor ebx, ebx
mov byte [ebp - 4], 0xf
push ebx
push str.No_pipeServer_available
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.004684c0
mov byte [ebp - 4], 0x10
jmp 0x68dad2
push str.timeout_error
call fcn.0040d4cf
push 1
push str.timeout_on_waiting_for_remote_ie_process_to_connect
lea eax, [ebp + 0x34]
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.004684c0
push 0xffffffffffffffff
xor ebx, ebx
mov byte [ebp - 4], 0x12
push ebx
push eax
lea ecx, [ebp + 0x54]
call fcn.0040d5a9
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.0040daff
push ebx
push 1
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 0xe
call fcn.0040daff
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
je 0x68daf8
push str.ie_alive
lea ecx, [ebp + 0x34]
call fcn.0040d4cf
cmp dword [ebp + 0x4c], 0x103
push ebx
sete al
mov byte [ebp - 4], 0x13
movzx eax, al
push eax
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0049372a
mov byte [ebp - 4], 0x14
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x54]
call fcn.0040d5a9
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.0040daff
push ebx
push 1
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 0xe
call fcn.0040daff
push str.remote_ieprocess
lea ecx, [ebp + 0x34]
call fcn.0040d4cf
push ebx
push ebx
push ebx
lea eax, [ebp + 0x34]
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp + 0x54]
push eax
push 0x2c
call fcn.00485ab0
push ebx
push 1
lea ecx, [ebp + 0x34]
call fcn.0040daff
push ebx
push 1
lea ecx, [ebp + 0x54]
call fcn.0040daff
xor esi, esi
lea ecx, [ebp - 0x24]
push esi
push 1
call fcn.0040daff
push esi
push 1
lea ecx, [ebp - 0x3c]
call fcn.004267c2
lea ecx, [ebp - 0x174]
call fcn.0049ba07
push esi
push 1
lea ecx, [ebp - 0x6c]
call fcn.004267c2
lea ecx, [ebp - 0x224]
call fcn.0049ba07
pop edi
pop esi
push 0
push 1
lea ecx, [ebp + 0x1c]
call fcn.004267c2
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
lea esp, [ebp + 0x70]
pop ebp
ret