Function at 0x438560
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f4a5
mov eax, dword fs:[0]
push eax
sub esp, 0x4a8
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x360], edi
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x368], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x370], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x354], ecx
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x374], esi
mov dword [ebp - 0x358], ecx
test eax, eax
je 0x4385f7
cmp eax, 0xffffffff
je 0x4385f7
mov byte [ebp - 0x359], 1
call fcn.00408d90
cmp eax, 5
jge 0x4385fd
mov eax, 2
jmp 0x4390f4
mov byte [ebp - 0x359], cl
push esi
call fcn.00410a18
mov esi, eax
add esp, 4
mov eax, dword [edi + 0x30]
cmp eax, esi
je 0x43861b
push eax
call fcn.004039d2
add esp, 4
mov dword [edi + 0x30], esi
push dword [ebp - 0x368]
call fcn.00410a18
add esp, 4
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x370]
mov esi, 0x40c
mov edi, dword [0x57f480]
mov ecx, 0x8040c
mov dword [ebp - 4], 0
cmp dword [eax + 0x44], 0
cmovne esi, ecx
mov dword [ebp - 0x354], esi
test edi, edi
je 0x43868f
lea esi, [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov al, byte [edi + 0x48]
push esi
mov byte [ebp - 0x35a], al
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [ebp - 0x35a], 0
je 0x438689
mov byte [ebp - 0x35a], 1
jmp 0x4386ac
mov esi, dword [ebp - 0x354]
mov byte [ebp - 0x35a], 0
call fcn.00408d90
cmp eax, 5
jge 0x4386ac
or esi, 0x1000000
mov dword [ebp - 0x354], esi
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x40
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 1
push 0
push eax
mov dword [ebp - 0x74], 0x44
call fcn.004f9050
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x48], 1
je 0x438898
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x3bc], 0xf
mov dword [ebp - 0x3c0], 0
mov byte [ebp - 0x3d0], 0
or dword [eax + 0x2c], 1
cmp byte [str.type], 0
jne 0x438715
xor ecx, ecx
jmp 0x438729
mov ecx, str.type
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x438720
sub ecx, edx
push ecx
push str.type
lea ecx, [ebp - 0x3d0]
call fcn.00409210
push dword [ebp - 0x368]
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 4], 2
call fcn.004076f0
lea eax, [ebp - 0x3b8]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x4b0]
push eax
call fcn.00450460
add esp, 8
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 4
push ecx
lea ecx, [ebp - 0x394]
push ecx
mov ecx, eax
call fcn.00409310
mov ecx, eax
cmp byte [str.compute_only_renderer], 0
jne 0x438791
xor esi, esi
jmp 0x4387a9
mov esi, str.compute_only_renderer
lea edx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x4387a0
sub esi, edx
cmp dword [ecx + 0x14], 0x10
mov edi, dword [ecx + 0x10]
jb 0x4387b4
mov ecx, dword [ecx]
cmp edi, esi
mov eax, esi
cmovb eax, edi
push eax
push str.compute_only_renderer
push ecx
call fcn.0040d810
add esp, 0xc
test eax, eax
jne 0x4387e0
cmp edi, esi
jae 0x4387d7
or eax, 0xffffffff
jmp 0x4387de
xor eax, eax
cmp edi, esi
setne al
test eax, eax
sete byte [ebp - 0x361]
cmp dword [ebp - 0x380], 0x10
jb 0x4387fe
push dword [ebp - 0x394]
call fcn.004085be
add esp, 4
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x380], 0xf
mov dword [ebp - 0x384], 0
mov byte [ebp - 0x394], 0
mov byte [ebp - 4], 3
call fcn.00440330
cmp dword [ebp - 0x3a4], 8
jb 0x43883f
push dword [ebp - 0x3b8]
call fcn.004085be
add esp, 4
xor eax, eax
mov dword [ebp - 0x3a4], 7
cmp dword [ebp - 0x3bc], 0x10
mov dword [ebp - 0x3a8], 0
mov word [ebp - 0x3b8], ax
mov byte [ebp - 4], 1
jb 0x438877
push dword [ebp - 0x3d0]
call fcn.004085be
add esp, 4
cmp byte [ebp - 0x361], 0
mov esi, dword [ebp - 0x370]
je 0x43888e
xor eax, eax
mov word [esi + 0x30], ax
jmp 0x43889e
mov ax, word [ebp - 0x44]
mov word [esi + 0x30], ax
jmp 0x43889e
mov esi, dword [ebp - 0x370]
cmp byte [0x57dba0], 0
mov dword [ebp - 0x378], 0
je 0x4388ca
mov eax, dword [0x57dbac]
test eax, eax
je 0x4388ca
or dword [ebp - 0x354], 0x400
mov dword [ebp - 0x378], eax
lea eax, [ebp - 0x84]
mov dword [ebp - 0x84], 0
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x80], xmm0
call fcn.00439120
add esp, 4
test al, al
jne 0x4389e3
call fcn.00412c10
test eax, eax
jg 0x4389d9
call fcn.00412c10
test eax, eax
jg 0x438986
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x394]
push str.0x_X
push eax
call fcn.00431e10
add esp, 0xc
mov esi, eax
push 0
push 0x145
push str.src_target_process.cc
lea ecx, [ebp - 0x480]
mov byte [ebp - 4], 6
mov dword [ebp - 0x354], 1
call fcn.0046e250
mov ecx, 3
mov dword [ebp - 4], 7
add eax, 8
mov dword [ebp - 0x358], ecx
push str.security_descriptor___error:
push eax
mov dword [ebp - 0x354], ecx
call fcn.0045b4a0
add esp, 8
cmp dword [esi + 0x14], 8
jb 0x43897c
mov esi, dword [esi]
push esi
push eax
call fcn.0046e6c0
add esp, 8
mov eax, dword [ebp - 0x358]
mov dword [ebp - 4], 6
test al, 2
je 0x4389b7
and eax, 0xfffffffd
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x358], eax
mov dword [ebp - 0x354], eax
call fcn.0046e3c0
mov eax, dword [ebp - 0x358]
mov dword [ebp - 4], 1
test al, 1
je 0x4389d9
cmp dword [ebp - 0x380], 8
jb 0x4389d9
push dword [ebp - 0x394]
call fcn.004085be
add esp, 4
mov esi, 0x2c
jmp 0x4390cc
test dword [ebp - 0x48], 0x8000
je 0x4389f3
or dword [esi + 0x2c], 0x8000
mov eax, dword [ebp - 0x360]
mov edi, dword [eax + 0x10]
mov dword [eax + 0x10], 0
call fcn.00410f80
xor esi, esi
mov dword [ebp - 0x398], esi
test edi, edi
je 0x438a3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x368], eax
cmp edi, 0xffffffff
je 0x438a38
mov esi, edi
mov dword [ebp - 0x398], esi
call fcn.00410f80
mov eax, dword [ebp - 0x368]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x360]
mov byte [ebp - 4], 8
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x368], eax
mov dword [ecx + 0x18], 0
call fcn.00410f80
xor edi, edi
mov dword [ebp - 0x3a0], edi
cmp dword [ebp - 0x368], edi
je 0x438a98
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x368]
cmp eax, 0xffffffff
je 0x438a8f
mov edi, eax
mov dword [ebp - 0x3a0], edi
call fcn.00410f80
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [ebp - 0x359], 0
xorps xmm0, xmm0
mov byte [ebp - 4], 9
movdqu xmmword [ebp - 0x30], xmm0
je 0x438aba
xor ecx, ecx
cmp byte [0x57dbc0], cl
cmovne ecx, edi
jmp 0x438abc
mov ecx, esi
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x370]
push eax
mov eax, dword [ebp + 0x10]
push 0
push dword [ebp - 0x378]
movzx eax, al
push dword [ebp - 0x354]
push eax
lea eax, [ebp - 0x84]
push eax
push eax
push dword [ebp - 0x37c]
push dword [ebp - 0x374]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x438c1e
call fcn.00412c10
test eax, eax
jg 0x438bec
call fcn.00412c10
test eax, eax
jg 0x438b9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x394]
push str.0x_X
push eax
call fcn.00431e10
add esp, 0xc
mov dword [ebp - 0x78], eax
push 0
push 0x197
push str.src_target_process.cc
lea ecx, [ebp - 0x480]
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x354], 4
call fcn.0046e250
mov ecx, 0xc
mov dword [ebp - 4], 0xb
add eax, 8
mov dword [ebp - 0x358], ecx
push str.CreateProcessAsUserW_failed_to_create_sandbox_process___error:
push eax
mov dword [ebp - 0x354], ecx
call fcn.0045b4a0
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x78]
cmp dword [eax + 0x14], 8
jb 0x438b92
mov eax, dword [eax]
push eax
push ecx
call fcn.0046e6c0
add esp, 8
mov eax, dword [ebp - 0x358]
mov dword [ebp - 4], 0xa
test al, 8
je 0x438bcd
and eax, 0xfffffff7
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x358], eax
mov dword [ebp - 0x354], eax
call fcn.0046e3c0
mov eax, dword [ebp - 0x358]
mov dword [ebp - 4], 9
test al, 4
je 0x438bec
and eax, 0xfffffffb
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x358], eax
call fcn.004087d0
mov eax, dword [ebp - 0x80]
test eax, eax
je 0x438c01
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x80], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x36c]
mov dword [ebp - 0x354], 0x12
mov dword [ecx], eax
jmp 0x439048
lea eax, [ebp - 0x30]
xorps xmm0, xmm0
push eax
lea ecx, [ebp - 0x20]
movdqu xmmword [ebp - 0x20], xmm0
call fcn.00439470
push dword [ebp - 0x20]
mov byte [ebp - 4], 0xc
call fcn.00439510
mov eax, dword [ebp - 0x80]
add esp, 4
test eax, eax
je 0x438c56
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x80], 0
mov ecx, dword [ebp - 0x360]
mov eax, dword [ecx + 0x20]
test eax, eax
je 0x438d8c
cmp byte [ebp - 0x35a], 0
jne 0x438d8c
push dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x438d8c
call fcn.00412c10
test eax, eax
jg 0x438d64
call fcn.00412c10
test eax, eax
jg 0x438d14
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x394]
push str.0x_X
push eax
call fcn.00431e10
add esp, 0xc
mov dword [ebp - 0x78], eax
push 0
push 0x1b1
push str.src_target_process.cc
lea ecx, [ebp - 0x480]
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x354], 0x10
call fcn.0046e250
push dword [ebp - 0x78]
mov ecx, 0x30
mov dword [ebp - 4], 0xe
add eax, 8
mov dword [ebp - 0x358], ecx
push str.job_object___error:
push eax
mov dword [ebp - 0x354], ecx
call fcn.0045b4a0
add esp, 8
push eax
call fcn.0045e1d0
add esp, 8
mov eax, dword [ebp - 0x358]
mov dword [ebp - 4], 0xd
test al, 0x20
je 0x438d45
and eax, 0xffffffdf
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x358], eax
mov dword [ebp - 0x354], eax
call fcn.0046e3c0
mov eax, dword [ebp - 0x358]
mov dword [ebp - 4], 0xc
test al, 0x10
je 0x438d64
and eax, 0xffffffef
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x358], eax
call fcn.004087d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x36c]
push 0
push dword [ebp - 0x20]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x354], 0x14
jmp 0x43903c
cmp byte [0x57dbc0], 0
je 0x438de5
cmp byte [ebp - 0x359], 0
je 0x438de5
test esi, esi
je 0x438de5
cmp esi, 0xffffffff
je 0x438de5
push esi
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.0047bef0
add esp, 0xc
test eax, eax
jns 0x438de5
push eax
call fcn.004763f0
mov ecx, dword [ebp - 0x36c]
add esp, 4
push 0
push dword [ebp - 0x20]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x354], 0x2d
jmp 0x43903c
mov eax, dword [ebp - 0x360]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x438f34
cmp ecx, 0xffffffff
je 0x438f34
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x78]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
jne 0x438f26
call fcn.00412c10
test eax, eax
jg 0x438efe
call fcn.00412c10
test eax, eax
jg 0x438eac
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x394]
push str.0x_X
push eax
call fcn.00431e10
add esp, 0xc
mov dword [ebp - 0x374], eax
push 0
push 0x1d6
push str.src_target_process.cc
lea ecx, [ebp - 0x480]
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x354], 0x40
call fcn.0046e250
push dword [ebp - 0x374]
mov ecx, 0xc0
mov dword [ebp - 4], 0x10
add eax, 8
mov dword [ebp - 0x358], ecx
push str.set_thread_token___error:
push eax
mov dword [ebp - 0x354], ecx
call fcn.0045b4a0
add esp, 8
push eax
call fcn.0045e1d0
add esp, 8
mov eax, dword [ebp - 0x358]
mov dword [ebp - 4], 0xf
test al, al
jns 0x438edf
and eax, 0xffffff7f
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x358], eax
mov dword [ebp - 0x354], eax
call fcn.0046e3c0
mov eax, dword [ebp - 0x358]
mov dword [ebp - 4], 0xc
test al, 0x40
je 0x438efe
and eax, 0xffffffbf
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x358], eax
call fcn.004087d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x36c]
push 0
push dword [ebp - 0x20]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x354], 0x15
jmp 0x43903c
mov ecx, dword [ebp - 0x360]
lea ecx, [ecx + 0x14]
call fcn.00410ed0
cmp byte [ebp - 0x359], 0
je 0x438f7b
push edi
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.0047bef0
add esp, 0xc
test eax, eax
jns 0x438f7b
push eax
call fcn.004763f0
mov ecx, dword [ebp - 0x36c]
add esp, 4
push 0
push dword [ebp - 0x20]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x354], 0x2e
jmp 0x43903c
lea eax, [ebp - 0x350]
mov dword [ebp - 0x350], 0x1003f
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x438fbe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x36c]
push 0
push dword [ebp - 0x20]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x354], 0x16
jmp 0x43903c
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [ebp - 0x39c]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x20]
push eax
call fcn.004396d0
test al, al
jne 0x438fff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x36c]
push 0
push dword [ebp - 0x20]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x354], 0x17
jmp 0x43903c
push dword [ebp - 0x78]
push dword [ebp - 0x374]
call fcn.00439800
mov ecx, dword [ebp - 0x360]
add esp, 8
mov dword [ecx + 0x2c], eax
lea eax, [ebp - 0x3b0]
push eax
lea ecx, [ebp - 0x20]
call fcn.00439890
mov ecx, dword [ebp - 0x360]
push eax
call fcn.004398f0
xor eax, eax
mov dword [ebp - 0x354], eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 9
call fcn.00439940
mov byte [ebp - 4], 8
test edi, edi
je 0x43908b
cmp edi, 0xffffffff
je 0x43908b
call fcn.00410f80
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x43908b
call fcn.004103b0
mov edi, dword [ebp - 0x358]
test edi, 0x400
je 0x439091
lea ecx, [ebp - 0x480]
and edi, 0xfffffbff
call fcn.0046e3c0
jmp 0x439091
mov edi, dword [ebp - 0x358]
mov byte [ebp - 4], 1
test esi, esi
je 0x4390c6
cmp esi, 0xffffffff
je 0x4390c6
call fcn.00410f80
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4390c6
call fcn.004103b0
test edi, 0x800
je 0x4390c6
lea ecx, [ebp - 0x480]
call fcn.0046e3c0
mov esi, dword [ebp - 0x354]
push 0
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x4390f2
push eax
call fcn.004039d2
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret 0x18