Function at 0x410a50
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x710
mov eax, dword [0x435e80]
xor eax, esp
mov dword [esp + 0x70c], eax
mov eax, dword [esp + 0x71c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x720]
push edi
mov edi, dword [esp + 0x728]
xor ebx, ebx
push 0x40
lea ecx, [esp + 0x84]
push ebx
push ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x84], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x88], ebx
call fcn.00412590
xor eax, eax
push 0x40
lea edx, [esp + 0xd4]
push ebx
push edx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0xd8], ebx
call fcn.00412590
xor eax, eax
push 0x206
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x86], eax
mov dword [esp + 0x8a], eax
mov dword [esp + 0x8e], eax
mov word [esp + 0x92], ax
lea eax, [esp + 0x122]
push ebx
push eax
mov dword [esp + 0x64], ebx
mov word [esp + 0x8c], bx
mov word [esp + 0x128], bx
call fcn.00412590
push 0x206
lea ecx, [esp + 0x336]
push ebx
push ecx
mov word [esp + 0x33c], bx
call fcn.00412590
push 0x206
lea edx, [esp + 0x54a]
push ebx
push edx
mov word [esp + 0x550], bx
call fcn.00412590
add esp, 0x3c
xor ebp, ebp
cmp esi, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
jne 0x410b8f
lea eax, [ebx - 8]
jmp 0x410ec5
mov eax, dword [esp + 0x734]
cmp eax, 0xffffffff
je 0x410ba8
imul eax, eax, 0x3e8
mov dword [esp + 0x734], eax
cmp dword [esp + 0x738], ebx
mov dword [esp + 0xc0], 0x44
mov edx, 1
je 0x410bd0
mov word [esp + 0xf0], bx
mov dword [esp + 0xec], edx
mov eax, 0xc
mov dword [esp + 0x5c], eax
mov dword [esp + 0x50], eax
mov eax, dword [esi + 8]
cmp eax, 4
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], edx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov ecx, 2
jne 0x410ee1
cmp dword [esi + 0x14], ecx
jne 0x410ede
cmp dword [esi + 0x98], ebx
jne 0x410ede
lea eax, [esi + 0xcf]
push eax
lea ecx, [esi + 0x9c]
push ecx
lea edx, [esi + 0x102]
push edx
push esi
call fcn.00406dc0
add esp, 0x10
test eax, eax
je 0x410e5e
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x410c40
sub eax, edx
cmp dword [esi + 0x268], 7
mov edi, eax
jne 0x410c70
lea ecx, [esi + 0x26c]
lea ebp, [ecx + 1]
nop
mov dl, byte [ecx]
add ecx, 1
cmp dl, bl
jne 0x410c60
sub ecx, ebp
lea eax, [ecx + 3]
jmp 0x410c72
mov eax, ebx
cmp dword [esi + 0x2c0], 3
jne 0x410c94
lea ecx, [esi + 0x2c4]
lea ebp, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
cmp dl, bl
jne 0x410c84
sub ecx, ebp
add ecx, 3
jmp 0x410c96
mov ecx, ebx
add edi, ecx
lea edi, [edi + eax + 0x12]
push edi
mov dword [esp + 0x14], edi
call fcn.00412f17
mov ebp, eax
add esp, 4
cmp ebp, ebx
jne 0x410ccf
push str.Failed_to_allocate_memory_to_schedule_the_process.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push 1
push esi
call fcn.004120f0
mov edi, 0xfffffff3
jmp 0x410e79
mov eax, dword [esp + 0x14]
mov edx, ebp
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x410cd7
cmp dword [esi + 0x268], 7
jne 0x410d13
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x410cf1
lea ecx, [esi + 0x26c]
push ecx
sub eax, edx
add eax, ebp
push str.__m_s
push eax
call fcn.00413e72
add esp, 0xc
cmp dword [esi + 0x2c0], 3
jne 0x410d43
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x410d21
sub eax, edx
lea edx, [esi + 0x2c4]
push edx
add eax, ebp
push str.__g_s
push eax
call fcn.00413e72
add esp, 0xc
lea eax, [edi + edi]
push eax
call fcn.00412f17
mov edi, eax
add esp, 4
cmp edi, ebx
mov dword [esp + 0x20], edi
je 0x410caf
mov ecx, dword [esp + 0x10]
push ecx
push edi
push 0xffffffffffffffff
push ebp
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [esp + 0x68]
push edx
mov dword [esp + 0x50], edi
mov byte [esp + 0x4d], bl
mov dword [esp + 0x48], ebx
mov byte [esp + 0x4c], bl
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x70]
movzx edx, word [esp + 0x72]
mov ecx, eax
shl ecx, 4
sub ecx, eax
lea eax, [edx + ecx*4 + 1]
movzx ecx, word [esp + 0x76]
imul eax, eax, 0xea60
add eax, ecx
push str.netapi32.dll
mov dword [esp + 0x44], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esp + 0x1c], eax
jne 0x410de2
push str.Failed_to_load_the_NETAPI32.DLL
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push 1
push esi
call fcn.004120f0
mov edi, 0xfffffff5
jmp 0x410e79
push str.NetScheduleJobAdd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
jne 0x410e0f
push str.Failed_to_get_the_NetScheduleJobAdd_function.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push 1
push esi
call fcn.004120f0
mov edi, 0xfffffffa
jmp 0x410e79
lea edx, [esp + 0x78]
push edx
lea ecx, [esp + 0x44]
push ecx
push ebx
call eax
mov edi, eax
cmp edi, ebx
je 0x410e47
push str.Failed_to_schedule_the_process.
push edi
push 3
push 1
push esi
call fcn.004120f0
sub edi, 0x888
add esp, 0x14
neg edi
sbb edi, edi
and edi, 5
add edi, 0xffffffec
jmp 0x410e7c
push str.Process_was_successfully_scheduled.
push ebx
push 1
push 3
push esi
call fcn.004120f0
mov edi, 1
jmp 0x410e79
push str.Failed_to_logon_as_Administrator_to_schedule_the_process.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push 1
push esi
call fcn.004120f0
mov edi, 0xfffffff4
add esp, 0x14
push esi
call fcn.00406f90
add esp, 4
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x410e94
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebp, ebx
je 0x410ea1
push ebp
call fcn.00412262
add esp, 4
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x410eb2
push eax
call fcn.00412262
add esp, 4
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x410ec3
push eax
call fcn.00412262
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x71c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00412a21
add esp, 0x710
ret
cmp eax, 4
jbe 0x41124c
cmp dword [esi + 0x14], ecx
jne 0x41124c
cmp dword [esi + 0x98], ebx
jne 0x41124c
cmp dword [esp + 0x738], ebx
mov dword [esp + 0x7c], 0x44
je 0x410f1c
mov word [esp + 0xac], bx
mov dword [esp + 0xa8], edx
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x104
lea edx, [esp + 0x108]
push edx
push 0xffffffffffffffff
lea eax, [esi + 0x9c]
push eax
push ebx
push ebx
call edi
push 0x104
lea ecx, [esp + 0x310]
push ecx
push 0xffffffffffffffff
lea edx, [esi + 0xcf]
push edx
push ebx
push ebx
call edi
push 0x104
lea eax, [esp + 0x518]
push eax
push 0xffffffffffffffff
lea ecx, [esi + 0x102]
push ecx
push ebx
push ebx
call edi
lea edx, [esp + 0x104]
push 0x40
push edx
call fcn.00413616
add esp, 8
test eax, eax
je 0x410f8e
mov dword [esp + 0x28], 1
mov eax, dword [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x410f95
sub eax, edx
mov ebp, eax
lea eax, [ebp + ebp + 2]
push eax
call fcn.00412f17
add esp, 4
cmp eax, ebx
mov dword [esp + 0x18], eax
jne 0x410fda
push str.Could_not_allocate_the_memory_to_convert_the_executable_name.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push 1
push esi
call fcn.004120f0
add esp, 0x14
mov edi, 0xfffffff3
jmp 0x410eb2
mov ecx, dword [esp + 0x10]
add ebp, 1
push ebp
push eax
push 0xffffffffffffffff
push ecx
push ebx
push ebx
call edi
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x410ff1
sub eax, edx
cmp dword [esi + 0x268], 7
mov edi, eax
jne 0x411020
lea ecx, [esi + 0x26c]
lea ebp, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
cmp dl, bl
jne 0x411010
sub ecx, ebp
lea eax, [ecx + 3]
jmp 0x411022
mov eax, ebx
cmp dword [esi + 0x2c0], 3
jne 0x411044
lea ecx, [esi + 0x2c4]
lea ebp, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
cmp dl, bl
jne 0x411034
sub ecx, ebp
add ecx, 3
jmp 0x411046
mov ecx, ebx
add edi, ecx
lea eax, [edi + eax + 0x12]
push eax
mov dword [esp + 0x14], eax
call fcn.00412f17
mov ebp, eax
add esp, 4
cmp ebp, ebx
jne 0x411082
push str.Failed_to_allocate_memory_to_schedule_the_process.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push 1
push esi
call fcn.004120f0
add esp, 0x14
mov edi, 0xfffffff3
jmp 0x410e94
mov eax, dword [esp + 0x14]
mov edx, ebp
sub edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x411090
cmp dword [esi + 0x268], 7
jne 0x4110d2
mov eax, ebp
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4110b0
sub eax, edx
lea edx, [esi + 0x26c]
push edx
add eax, ebp
push str.__m_s
push eax
call fcn.00413e72
add esp, 0xc
cmp dword [esi + 0x2c0], 3
jne 0x411102
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4110e0
lea ecx, [esi + 0x2c4]
push ecx
sub eax, edx
add eax, ebp
push str.__g_s
push eax
call fcn.00413e72
add esp, 0xc
mov edx, dword [esp + 0x10]
lea eax, [edx + edx]
push eax
call fcn.00412f17
mov edi, eax
add esp, 4
cmp edi, ebx
mov dword [esp + 0x20], edi
je 0x41105f
mov ecx, dword [esp + 0x10]
push ecx
push edi
push 0xffffffffffffffff
push ebp
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esp + 0x1c], eax
jne 0x411167
push str.Failed_to_load_the_ADVAPI32.DLL
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push 1
push esi
call fcn.004120f0
add esp, 0x14
mov edi, 0xfffffff5
jmp 0x410e85
push str.CreateProcessWithLogonW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
jne 0x41119a
push str.Failed_to_get_the_CreateProcessWithLogonW_function.
mov edi, 0xfffffffa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push 1
push esi
call fcn.004120f0
add esp, 0x14
jmp 0x410e85
lea edx, [esp + 0x30]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x80]
push ecx
push ebx
push ebx
push ebx
push edi
push edx
push 1
lea ecx, [esp + 0x32c]
push ecx
mov ecx, dword [esp + 0x4c]
neg ecx
sbb ecx, ecx
not ecx
lea edx, [esp + 0x538]
and ecx, edx
push ecx
lea ecx, [esp + 0x12c]
push ecx
call eax
test eax, eax
je 0x41120d
push str.Running_the_installation_process_as_an_administrator.
push ebx
push 1
push 3
push esi
mov edi, 2
call fcn.004120f0
mov edx, dword [esp + 0x44]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x14
push edx
call esi
mov eax, dword [esp + 0x34]
push eax
call esi
jmp 0x410e85
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Failed_to_create_the_installation_process_as_an_administrator.
mov edi, eax
push edi
push 3
push 1
push esi
call fcn.004120f0
add esp, 0x14
cmp edi, 0x52e
je 0x411242
cmp edi, 0x3e5
je 0x411242
mov edi, 0xffffffef
jmp 0x410e85
mov edi, 0xfffffff4
jmp 0x410e85
mov ebp, dword [esp + 0x14]
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0xc4]
push edx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x78]
push ecx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x41133c
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x411280
sub eax, edx
mov edx, eax
mov eax, ebp
lea edi, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x411292
sub eax, edi
lea edx, [eax + edx + 0x80]
push edx
call fcn.00412f17
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x4112db
mov ecx, dword [esp + 0x10]
mov eax, ebp
push eax
push ecx
push str.Running__s__s_
push edi
call fcn.00413e72
push edi
push ebx
push 1
push 3
push esi
call fcn.004120f0
push edi
call fcn.00412262
add esp, 0x28
mov edx, dword [esp + 0x34]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call ebp
xor edi, edi
cmp dword [esp + 0x730], 1
jne 0x411330
mov eax, dword [esp + 0x734]
mov ecx, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x411330
cmp eax, 0x80
je 0x411330
push str.Timeout_or_other_error_occurred_while_waiting_for_the_installation_process.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push 1
push esi
call fcn.004120f0
add esp, 0x14
mov edi, 0xffffffea
mov edx, dword [esp + 0x30]
push edx
call ebp
jmp 0x410ec3
push str.Failed_to_create_the_installation_process.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push 1
push esi
call fcn.004120f0
add esp, 0x14
mov edi, 0xffffffee
jmp 0x410ec3