Function at 0x4275bb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x714
mov eax, dword [0x518764]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x634], eax
xor eax, eax
push 0x44
push eax
mov dword [ebp - 0x64c], eax
mov dword [ebp - 0x638], eax
mov dword [ebp - 0x654], eax
mov dword [ebp - 0x630], eax
lea eax, [ebp - 0x6d0]
push eax
mov dword [ebp - 0x644], ebx
call fcn.004a7f20
xor eax, eax
lea edi, [ebp - 0x664]
stosd dword es:[edi], eax
push 0x44
push 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x714]
push eax
call fcn.004a7f20
xor eax, eax
lea edi, [ebp - 0x674]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x62c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20c]
mov edi, 0x208
push edi
push 0
push eax
call fcn.004a7f20
push edi
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004a7f20
push edi
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.004a7f20
xor edx, edx
add esp, 0x3c
mov dword [ebp - 0x650], edx
mov dword [ebp - 0x63c], edx
mov dword [ebp - 0x648], edx
mov dword [ebp - 0x640], edx
test esi, esi
jne 0x42769e
push 0xfffffffffffffff8
pop eax
jmp 0x427eca
mov eax, dword [ebp + 0x18]
cmp eax, 0xffffffff
je 0x4276af
imul eax, eax, 0x3e8
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x1c]
xor edi, edi
inc edi
mov dword [ebp - 0x714], 0x44
test eax, eax
je 0x4276d2
xor ecx, ecx
mov dword [ebp - 0x6e8], edi
mov word [ebp - 0x6e4], cx
cmp dword [esi + 8], 4
push 0xc
pop ecx
mov dword [ebp - 0x68c], ecx
mov dword [ebp - 0x688], edx
mov dword [ebp - 0x684], edi
mov dword [ebp - 0x680], ecx
mov dword [ebp - 0x67c], edx
mov dword [ebp - 0x678], edx
jne 0x4279b0
cmp dword [esi + 0x14], 2
jne 0x427d76
cmp dword [esi + 0x98], edx
jne 0x427d76
lea eax, [esi + 0xcf]
push eax
lea eax, [esi + 0x9c]
push eax
lea eax, [esi + 0x102]
push eax
push esi
call fcn.00421a07
add esp, 0x10
test eax, eax
je 0x427989
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x427742
sub ebx, ecx
cmp dword [esi + 0x268], 7
jne 0x42776f
lea ecx, [esi + 0x26c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42775d
sub ecx, edx
lea eax, [ecx + 3]
mov dword [ebp - 0x64c], eax
push 3
pop edi
cmp dword [esi + 0x2c0], edi
jne 0x427791
lea ecx, [esi + 0x2c4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427783
sub ecx, edx
lea eax, [ecx + 3]
jmp 0x427797
mov eax, dword [ebp - 0x638]
mov ecx, dword [ebp - 0x64c]
add eax, ebx
add ecx, 0x12
add eax, ecx
push eax
mov dword [ebp - 0x634], eax
call fcn.004ac04c
mov ebx, eax
mov dword [ebp - 0x63c], ebx
pop ecx
test ebx, ebx
jne 0x4277dc
push str.Failed_to_allocate_memory_to_schedule_the_process.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 1
push esi
call fcn.00429952
add esp, 0x14
push 0xfffffffffffffff3
jmp 0x4279a3
mov ecx, dword [ebp - 0x644]
mov edx, ebx
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x4277e6
cmp dword [esi + 0x268], 7
jne 0x42781f
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4277fe
sub ecx, edx
lea eax, [esi + 0x26c]
push eax
push str.__m_s
lea eax, [ecx + ebx]
push eax
call fcn.00418a96
add esp, 0xc
cmp dword [esi + 0x2c0], edi
jne 0x42784d
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42782c
sub ecx, edx
lea eax, [esi + 0x2c4]
push eax
push str.__g_s
lea eax, [ecx + ebx]
push eax
call fcn.00418a96
add esp, 0xc
mov eax, dword [ebp - 0x634]
add eax, eax
push eax
call fcn.004ac04c
mov dword [ebp - 0x648], eax
pop ecx
test eax, eax
je 0x4277bd
push dword [ebp - 0x634]
push eax
push 0xffffffffffffffff
push ebx
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x668], eax
lea eax, [ebp - 0x62c]
push eax
mov word [ebp - 0x66c], bx
mov dword [ebp - 0x670], ebx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x624]
imul ecx, eax, 0x3c
movzx eax, word [ebp - 0x622]
inc eax
push str.netapi32.dll
add eax, ecx
imul ecx, eax, 0xea60
movzx eax, word [ebp - 0x61e]
add ecx, eax
mov dword [ebp - 0x674], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x630], eax
test eax, eax
jne 0x427901
push str.Failed_to_load_the_NETAPI32.DLL
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 1
push esi
call fcn.00429952
add esp, 0x14
push 0xfffffffffffffff5
jmp 0x4279a3
push str.NetScheduleJobAdd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x42792d
push str.Failed_to_get_the_NetScheduleJobAdd_function.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 1
push esi
call fcn.00429952
add esp, 0x14
push 0xfffffffffffffffa
jmp 0x4279a3
lea ecx, [ebp - 0x654]
push ecx
lea ecx, [ebp - 0x674]
push ecx
push ebx
call eax
mov dword [ebp - 0x640], eax
test eax, eax
je 0x427972
push str.Failed_to_schedule_the_process.
push eax
push edi
push 1
push esi
call fcn.00429952
xor ebx, ebx
add esp, 0x14
cmp dword [ebp - 0x640], 0x888
setne bl
dec ebx
and ebx, 0xfffffffb
add ebx, 0xfffffff1
jmp 0x4279a4
push str.Process_was_successfully_scheduled.
push ebx
push 1
push edi
push esi
call fcn.00429952
xor ebx, ebx
add esp, 0x14
inc ebx
jmp 0x4279a4
push str.Failed_to_logon_as_Administrator_to_schedule_the_process.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push edi
push esi
call fcn.00429952
add esp, 0x14
push 0xfffffffffffffff4
pop ebx
push esi
call fcn.00421b8b
pop ecx
jmp 0x427e84
jbe 0x427d76
push 2
pop ebx
cmp dword [esi + 0x14], ebx
jne 0x427d70
cmp dword [esi + 0x98], edx
jne 0x427d70
mov dword [ebp - 0x6d0], 0x44
test eax, eax
je 0x4279eb
xor eax, eax
mov dword [ebp - 0x6a4], edi
mov word [ebp - 0x6a0], ax
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0xffffffffffffffff
lea eax, [esi + 0x9c]
push eax
push edx
push edx
call edi
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0xffffffffffffffff
lea eax, [esi + 0xcf]
push eax
push 0
push 0
call edi
push 0x104
lea eax, [ebp - 0x61c]
push eax
push 0xffffffffffffffff
lea eax, [esi + 0x102]
push eax
push 0
push 0
call edi
lea eax, [ebp - 0x20c]
push 0x40
push eax
call fcn.004a92b3
pop ecx
pop ecx
test eax, eax
je 0x427a5d
xor eax, eax
inc eax
mov dword [ebp - 0x640], eax
mov edi, dword [ebp - 0x634]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x427a66
sub edi, ecx
lea eax, [edi*2 + 2]
push eax
call fcn.004ac04c
pop ecx
mov ecx, eax
mov dword [ebp - 0x650], ecx
test ecx, ecx
jne 0x427aaa
push str.Could_not_allocate_the_memory_to_convert_the_executable_name.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push 1
push esi
call fcn.00429952
add esp, 0x14
push 0xfffffffffffffff3
pop ebx
jmp 0x427ec8
lea eax, [edi + 1]
push eax
push ecx
push 0xffffffffffffffff
push dword [ebp - 0x634]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [ebp - 0x644]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x427aca
sub edx, ecx
cmp dword [esi + 0x268], 7
jne 0x427af7
lea ecx, [esi + 0x26c]
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427ae5
sub ecx, edi
lea eax, [ecx + 3]
mov dword [ebp - 0x64c], eax
push 3
pop edi
cmp dword [esi + 0x2c0], edi
jne 0x427b23
lea ecx, [esi + 0x2c4]
lea eax, [ecx + 1]
mov dword [ebp - 0x638], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427b11
sub ecx, dword [ebp - 0x638]
lea eax, [ecx + 3]
jmp 0x427b29
mov eax, dword [ebp - 0x638]
mov ecx, dword [ebp - 0x64c]
add eax, edx
add ecx, 0x12
add eax, ecx
push eax
mov dword [ebp - 0x638], eax
call fcn.004ac04c
pop ecx
mov ecx, eax
mov dword [ebp - 0x63c], ecx
test ecx, ecx
jne 0x427b6f
push str.Failed_to_allocate_memory_to_schedule_the_process.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 1
push esi
call fcn.00429952
add esp, 0x14
push 0xfffffffffffffff3
pop ebx
jmp 0x427eb7
mov edx, dword [ebp - 0x644]
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x630], eax
mov ecx, eax
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x427b81
cmp dword [esi + 0x268], 7
mov ecx, dword [ebp - 0x63c]
jne 0x427bd0
mov edx, ecx
lea eax, [edx + 1]
mov dword [ebp - 0x630], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x427ba5
sub edx, dword [ebp - 0x630]
lea eax, [esi + 0x26c]
push eax
push str.__m_s
lea eax, [edx + ecx]
push eax
call fcn.00418a96
mov ecx, dword [ebp - 0x63c]
add esp, 0xc
cmp dword [esi + 0x2c0], edi
jne 0x427c08
mov edx, ecx
lea eax, [edx + 1]
mov dword [ebp - 0x630], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x427be3
sub edx, dword [ebp - 0x630]
lea eax, [esi + 0x2c4]
push eax
push str.__g_s
lea eax, [edx + ecx]
push eax
call fcn.00418a96
add esp, 0xc
mov eax, dword [ebp - 0x638]
add eax, eax
push eax
call fcn.004ac04c
mov dword [ebp - 0x648], eax
pop ecx
test eax, eax
jne 0x427c41
push str.Failed_to_allocate_memory_to_schedule_the_process.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 1
push esi
call fcn.00429952
add esp, 0x14
push 0xfffffffffffffff3
pop ebx
jmp 0x427e95
push dword [ebp - 0x638]
push eax
mov eax, dword [ebp - 0x63c]
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x630], eax
test eax, eax
jne 0x427c8c
push str.Failed_to_load_the_ADVAPI32.DLL
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 1
push esi
call fcn.00429952
add esp, 0x14
push 0xfffffffffffffff5
jmp 0x427c3b
push str.CreateProcessWithLogonW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
test ecx, ecx
jne 0x427cbe
push 0xfffffffffffffffa
pop ebx
push str.Failed_to_get_the_CreateProcessWithLogonW_function.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 1
push esi
call fcn.00429952
add esp, 0x14
jmp 0x427e84
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x6d0]
push eax
xor eax, eax
lea edx, [ebp - 0x61c]
push eax
push eax
push eax
mov eax, dword [ebp - 0x648]
push eax
mov eax, dword [ebp - 0x650]
push eax
push 1
lea eax, [ebp - 0x414]
push eax
mov eax, dword [ebp - 0x640]
neg eax
sbb eax, eax
not eax
and eax, edx
push eax
lea eax, [ebp - 0x20c]
push eax
call ecx
test eax, eax
je 0x427d38
push str.Running_the_installation_process_as_an_administrator.
push 0
push 1
push edi
push esi
call fcn.00429952
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x14
push dword [ebp - 0x664]
call esi
push dword [ebp - 0x660]
call esi
jmp 0x427e84
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Failed_to_create_the_installation_process_as_an_administrator.
mov ebx, eax
push ebx
push edi
push 1
push esi
call fcn.00429952
add esp, 0x14
cmp ebx, 0x52e
je 0x427d69
cmp ebx, 0x3e5
je 0x427d69
push 0xffffffffffffffef
jmp 0x427e83
push 0xfffffffffffffff4
jmp 0x427e83
mov ebx, dword [ebp - 0x644]
mov edi, dword [ebp - 0x634]
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x714]
push eax
push edx
push edx
push edx
push edx
lea eax, [ebp - 0x680]
push eax
lea eax, [ebp - 0x68c]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x427e68
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427db1
sub ecx, edx
mov edx, ebx
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x427dbf
sub edx, edi
lea eax, [ecx + 0x80]
add eax, edx
push eax
call fcn.004ac04c
mov dword [ebp - 0x640], eax
pop ecx
push 3
pop edi
test eax, eax
je 0x427e11
push ebx
push dword [ebp - 0x634]
push str.Running__s__s_
push eax
call fcn.00418a96
mov ebx, dword [ebp - 0x640]
push ebx
push 0
push 1
push edi
push esi
call fcn.00429952
push ebx
call fcn.004ac047
add esp, 0x28
push dword [ebp - 0x660]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp dword [ebp + 0x14], 1
jne 0x427e5a
push dword [ebp + 0x18]
push dword [ebp - 0x664]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x427e5a
cmp eax, 0x80
je 0x427e5a
push str.Timeout_or_other_error_occurred_while_waiting_for_the_installation_process.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 1
push esi
call fcn.00429952
add esp, 0x14
push 0xffffffffffffffea
pop ebx
push dword [ebp - 0x664]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x427ec8
push str.Failed_to_create_the_installation_process.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push 1
push esi
call fcn.00429952
add esp, 0x14
push 0xffffffffffffffee
pop ebx
mov eax, dword [ebp - 0x630]
test eax, eax
je 0x427e95
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x63c]
test eax, eax
je 0x427ea6
push eax
call fcn.004ac047
pop ecx
mov eax, dword [ebp - 0x648]
test eax, eax
je 0x427eb7
push eax
call fcn.004ac047
pop ecx
mov eax, dword [ebp - 0x650]
test eax, eax
je 0x427ec8
push eax
call fcn.004ac047
pop ecx
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a50d6
leave
ret