Function at 0x405e40
Capabilities:
Create process on windows
Create thread
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200ac
call fcn.0041d6a0
mov eax, dword [0x424284]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x58
mov ebx, edx
push 8
mov dword [ebp - 0x2002c], ebx
mov dword [ebp - 0x20030], eax
mov dword [ebp - 0x20038], ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x2003c], eax
test eax, eax
jne 0x405ebf
push eax
push str.invgate_hook__
push str.hook
push 0xc00003eb
push 1
call fcn.004021b0
add esp, 0x14
mov eax, 0x64
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x2005c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebx + 0x70508]
push eax
mov dword [ebp - 0x20044], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, ebx
call fcn.0040c920
push 1
push 0x4202bc
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
push 0x10
push eax
call fcn.004149b0
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add esp, 0x14
lea ecx, [ebp - 0x24]
push ecx
push str.INVGATE_HOOK_VERSION
call esi
mov edx, dword [ebp - 0x20030]
push edx
push str.INVGATE_EVENT
call esi
mov eax, dword [ebp - 0x20038]
push eax
push str.INVGATE_ACTION
call esi
test edi, edi
je 0x405f38
mov eax, dword [edi]
call fcn.0040f9a0
push eax
jmp 0x405f3d
push 0x4201bc
push str.INVGATE_TRIGGER
call esi
mov eax, dword [ebx + 0x70554]
call fcn.0040f9a0
push eax
push str.INVGATE_LAST_CONTROL
call esi
call fcn.004086d0
push eax
push str.INVGATE_EXE
call esi
push str.32_bit
push str.INVGATE_CONFIGURATION
call esi
push 0x4203cc
push str.INVGATE_VERSION
call esi
push str.02_11_2023
push str.INVGATE_BUILD_DATE
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4202bc
push 0xffffffffffffffff
lea ecx, [ebp - 0x24]
push 0x10
push ecx
call fcn.004149b0
add esp, 0x14
lea edx, [ebp - 0x24]
push edx
push str.INVGATE_PID
call esi
lea eax, [ebx + 0x70538]
push eax
lea ecx, [ebp - 0x2005c]
mov edi, str.INVGATE_RUNTIME
call fcn.00405830
mov eax, dword [ebx + 0x704d8]
add esp, 4
test eax, eax
je 0x406018
push eax
push 0x4202bc
push 0xffffffffffffffff
lea ecx, [ebp - 0x24]
push 0x10
push ecx
call fcn.004149b0
add esp, 0x14
lea edx, [ebp - 0x24]
push edx
push str.INVGATE_APPLICATION_PID
call esi
lea eax, [ebx + 0x70540]
push eax
lea ecx, [ebp - 0x2005c]
mov edi, str.INVGATE_APPLICATION_RUNTIME
call fcn.00405830
add esp, 4
push 0x4201bc
jmp 0x4060ac
push 0x4201bc
push str.INVGATE_APPLICATION_PID
call esi
mov ebx, dword [ebp - 0x20030]
mov edi, str.Start
call fcn.004080a0
test eax, eax
je 0x40606c
mov ebx, dword [ebp - 0x20038]
mov edi, 0x420034
call fcn.004080a0
test eax, eax
je 0x40606c
push 0x4201bc
push str.INVGATE_APPLICATION_RUNTIME
call esi
push 0x4201bc
push str.INVGATE_EXITCODE
call esi
mov ebx, dword [ebp - 0x2002c]
jmp 0x4060b3
mov ebx, dword [ebp - 0x2002c]
lea edx, [ebx + 0x70540]
lea ecx, [ebx + 0x70548]
push edx
mov edi, str.INVGATE_APPLICATION_RUNTIME
call fcn.00405830
mov eax, dword [ebx + 0x704e0]
add esp, 4
push eax
push 0x4202bc
push 0xffffffffffffffff
lea ecx, [ebp - 0x24]
push 0x10
push ecx
call fcn.004149b0
add esp, 0x14
lea edx, [ebp - 0x24]
push edx
push str.INVGATE_EXITCODE
call esi
mov eax, dword [ebp + 0x10]
push eax
push 0x4202bc
push 0xffffffffffffffff
lea ecx, [ebp - 0x24]
push 0x10
push ecx
call fcn.004149b0
add esp, 0x14
lea edx, [ebp - 0x24]
push edx
push str.INVGATE_DEADLINE
call esi
lea edi, [ebx + 2]
push edi
push str.INVGATE_SERVICE_NAME
mov dword [ebp - 0x20034], edi
call esi
lea eax, [ebx + 0x202]
push eax
push str.INVGATE_SERVICE_DISPLAYNAME
call esi
mov ecx, dword [ebx + 0x70558]
push ecx
push 0x4202bc
push 0xffffffffffffffff
lea edx, [ebp - 0x24]
push 0x10
push edx
call fcn.004149b0
add esp, 0x14
lea eax, [ebp - 0x24]
push eax
push str.INVGATE_START_REQUESTED_COUNT
call esi
mov ecx, dword [ebx + 0x7055c]
push ecx
push 0x4202bc
push 0xffffffffffffffff
lea edx, [ebp - 0x24]
push 0x10
push edx
call fcn.004149b0
add esp, 0x14
lea eax, [ebp - 0x24]
push eax
push str.INVGATE_START_COUNT
call esi
mov ecx, dword [ebx + 0x70560]
push ecx
push 0x4202bc
push 0xffffffffffffffff
lea edx, [ebp - 0x24]
push 0x10
push edx
call fcn.004149b0
add esp, 0x14
lea eax, [ebp - 0x24]
push eax
push str.INVGATE_EXIT_COUNT
call esi
mov ecx, dword [ebx + 0x704e8]
push ecx
push 0x4202bc
push 0xffffffffffffffff
lea edx, [ebp - 0x24]
push 0x10
push edx
call fcn.004149b0
add esp, 0x14
lea eax, [ebp - 0x24]
push eax
push str.INVGATE_THROTTLE_COUNT
call esi
lea ecx, [ebx + 0x28414]
push ecx
add ebx, 0x18416
push ebx
push str.__s___s
push 0xffffffffffffffff
push 0x8000
lea edx, [ebp - 0x10028]
push edx
call fcn.004149b0
add esp, 0x18
lea eax, [ebp - 0x10028]
push eax
push str.INVGATE_COMMAND_LINE
call esi
mov ecx, dword [ebp - 0x20030]
mov esi, dword [ebp - 0x20038]
push ecx
lea ebx, [ebp - 0x20028]
mov ecx, esi
call fcn.0040c0b0
add esp, 4
test eax, eax
je 0x40624a
mov eax, dword [ebp - 0x20030]
push 0
mov edx, edi
push edx
push esi
push eax
push 0x40000439
push 1
call fcn.004021b0
mov eax, dword [ebp - 0x2002c]
add esp, 0x18
call fcn.0040c970
mov ecx, dword [ebp - 0x20044]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebp - 0x2003c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0x64
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20028]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406253
sub eax, edx
sar eax, 1
jne 0x4062a8
mov eax, dword [ebp - 0x2002c]
call fcn.0040c970
mov eax, dword [ebp - 0x20044]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x2003c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
push 0x44
lea edx, [ebp - 0x200a8]
push 0
push edx
call fcn.0041a110
xor eax, eax
mov dword [ebp - 0x20054], eax
mov dword [ebp - 0x20050], eax
mov dword [ebp - 0x2004c], eax
mov dword [ebp - 0x20048], eax
mov eax, dword [ebp - 0x2002c]
add esp, 0xc
cmp byte [eax + 0x70470], 0
mov dword [ebp - 0x200a8], 0x44
je 0x406301
lea esi, [ebp - 0x200a8]
mov edi, eax
call fcn.00407730
mov esi, dword [ebp - 0x20038]
xor al, al
test dword [ebp - 0x2007c], 0x100
je 0x406311
mov al, 1
lea ecx, [ebp - 0x20054]
push ecx
mov ecx, dword [ebp - 0x2002c]
lea edx, [ebp - 0x200a8]
push edx
add ecx, 0x30412
push ecx
push 0
push 0x400
movzx edx, al
push edx
push 0
push 0
lea eax, [ebp - 0x20028]
push eax
push 0
mov dword [ebp - 0x20040], 0x65
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4064d7
lea esi, [ebp - 0x200a8]
call fcn.004077c0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x400
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, dword [ebp - 0x2003c]
mov dword [esi], eax
test eax, eax
je 0x4063b3
mov ecx, dword [ebp - 0x20038]
mov edx, dword [ebp - 0x20030]
push ecx
mov ecx, dword [ebp - 0x20034]
push edx
push ecx
push str._s___s__s_
push 0xffffffffffffffff
push 0x200
push eax
call fcn.004149b0
add esp, 0x1c
mov edx, dword [ebp - 0x20054]
mov ecx, dword [ebp + 0x10]
lea edi, [esi + 0x10]
mov dword [esi + 4], edx
mov eax, dword [ebp - 0x2004c]
push edi
push edx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
call fcn.00408da0
add esp, 8
test eax, eax
je 0x4063e3
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x20060]
push eax
push 0
push esi
push fcn.00405700
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x406494
cmp byte [ebp + 0x14], 0
je 0x406441
mov ecx, dword [ebp - 0x2002c]
lea eax, [ecx + 0x704b4]
mov ecx, dword [ecx + 0x704d0]
push 0
push ecx
mov dword [ebp - 0x20040], 0
call fcn.00405c10
mov edx, dword [esi]
push edx
push edi
call fcn.004058c0
add esp, 0x10
jmp 0x40652d
mov eax, dword [ebp + 0x10]
mov edx, dword [esi]
add eax, 0x4e20
push eax
mov eax, dword [ebp - 0x2002c]
mov ecx, dword [eax + 0x704d0]
push str.invgate_hook
push ecx
lea ebx, [eax + 0x704b4]
mov ecx, edi
call fcn.00410a70
add esp, 0xc
lea edx, [ebp - 0x20034]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [ebp - 0x20034]
push edi
mov dword [ebp - 0x20040], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40652d
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.00402080
push eax
push 0xc0000424
push 1
call fcn.004021b0
add esp, 0x10
push esi
call fcn.00405700
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x4064cd
push eax
push 0
call ebx
push eax
call edi
push esi
push 0
call ebx
push eax
call edi
jmp 0x40652d
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.00402080
mov edx, dword [ebp - 0x20034]
push eax
mov eax, dword [ebp - 0x20030]
lea ecx, [ebp - 0x20028]
push ecx
push edx
push esi
push eax
push 0x40000438
push 1
call fcn.004021b0
mov ecx, dword [ebp - 0x2003c]
add esp, 0x20
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea esi, [ebp - 0x200a8]
call fcn.004077c0
mov eax, dword [ebp - 0x2002c]
call fcn.0040c970
mov edx, dword [ebp - 0x20044]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x20040]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041427b
mov esp, ebp
pop ebp
ret