Function at 0x40b680
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x470666
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x49ab20]
xor eax, esp
mov dword [esp + 0x264], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49ab20]
xor eax, esp
push eax
lea eax, [esp + 0x27c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28c]
push 0x206
xor ebx, ebx
lea ecx, [esp + 0x76]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x7c], ax
call fcn.00451660
add esp, 0xc
call fcn.004376be
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40b6f8
push 0x80004005
call fcn.00403ca0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x284], ebx
call fcn.0041f980
lea edx, [esp + 0x70]
jmp 0x40b720
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
cmp cx, bx
jne 0x40b720
lea ecx, [esp + 0x70]
push 0x5c
push ecx
call fcn.0045231c
xor edx, edx
lea edi, [esp + 0x78]
add esp, 8
mov word [eax + 2], dx
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x40b750
push ebp
lea eax, [esp + 0x74]
push eax
mov ecx, 7
mov esi, str.ODMHook64.exe
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x20]
push str.__s__ODMGuard64__s
push ecx
call fcn.004069a0
push 0x40
lea edx, [esp + 0x44]
push ebx
push edx
call fcn.00451660
mov esi, dword [esp + 0x34]
add esp, 0x1c
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x30]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
xor eax, eax
push ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
push esi
mov eax, 5
push ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x54], 0x44
mov word [esp + 0x84], ax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40b815
push 0x10
push 0x476828
push 0x476814
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [esi - 0x10]
mov dword [esp + 0x284], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b80e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x40b941
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00414920
mov edx, dword [esp + 0x28]
push edx
call fcn.00401a90
mov eax, dword [esp + 0x2c]
push 1
push eax
call fcn.004019a0
add esp, 0x10
xor edi, edi
call fcn.004376be
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40b854
push 0x80004005
call fcn.00403ca0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push ebp
lea ecx, [esp + 0x18]
push str.OpenDoc64__s
push ecx
mov byte [esp + 0x290], 1
call fcn.004069a0
mov edx, dword [esp + 0x30]
push edx
push str.StartODMGuardExe64
call fcn.00414dc0
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x14
lea ebx, [ebx]
mov eax, dword [esp + 0x14]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov esi, eax
test esi, esi
jne 0x40b8c8
cmp edi, 0xa
jge 0x40b8db
push 0x64
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40b8a0
push 0xffffffffffffffff
push esi
xor edi, edi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call ebp
jmp 0x40b8a0
mov ecx, dword [esp + 0x20]
push ecx
call ebp
mov edx, dword [esp + 0x1c]
push edx
call ebp
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x284], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b911
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x284], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b93c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x27c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x264]
xor ecx, esp
call fcn.004522e0
add esp, 0x274
ret 4