Function at 0x415c30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x694
mov eax, dword [0x424050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x694], ecx
cmp dword [ebp + 8], 0
je 0x415c81
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x415c81
mov edx, dword [0x4219bc]
push edx
call fcn.004013bd
add esp, 4
mov esi, eax
mov eax, dword [ebp + 8]
push eax
call fcn.004013bd
add esp, 4
add esi, eax
cmp esi, 0x104
jb 0x415c8b
mov eax, 0x80070057
jmp 0x4163f8
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x694]
mov dword [ecx + 0xff04], eax
mov edx, dword [ebp - 0x694]
cmp dword [edx + 0xff04], 0
jne 0x415cbe
mov eax, 0x80004005
jmp 0x4163f8
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x694]
mov dword [ecx + 0xff08], eax
mov edx, dword [ebp - 0x694]
cmp dword [edx + 0xff08], 0
jne 0x415d04
mov eax, dword [ebp - 0x694]
mov ecx, dword [eax + 0xff04]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x4163f8
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [ebp - 0x694]
mov dword [edx + 0x1fa28], eax
mov eax, dword [ebp - 0x694]
cmp dword [eax + 0x1fa28], 0
jne 0x415d5d
mov ecx, dword [ebp - 0x694]
mov edx, dword [ecx + 0xff08]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x694]
mov ecx, dword [eax + 0xff04]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x4163f8
mov dword [ebp - 0x624], 0
lea edx, [ebp - 0x624]
push edx
push 0
mov eax, dword [ebp - 0x694]
push eax
push 0x415800
push 0
push 0
call fcn.00401190
add esp, 0x18
mov ecx, dword [ebp - 0x694]
mov dword [ecx + 0x1fa38], eax
mov edx, dword [ebp - 0x694]
cmp dword [edx + 0x1fa38], 0
jne 0x415de6
mov eax, dword [ebp - 0x694]
mov ecx, dword [eax + 0x1fa28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x694]
mov eax, dword [edx + 0xff08]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x694]
mov edx, dword [ecx + 0xff04]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x4163f8
call fcn.004176c0
movzx eax, al
test eax, eax
jne 0x415e70
mov ecx, dword [ebp - 0x694]
mov edx, dword [ecx + 0xff04]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
mov eax, dword [ebp - 0x694]
mov ecx, dword [eax + 0x1fa38]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x694]
mov eax, dword [edx + 0x1fa38]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x694]
mov edx, dword [ecx + 0x1fa28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x694]
mov ecx, dword [eax + 0xff08]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x694]
mov eax, dword [edx + 0xff04]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x4163f8
mov ecx, dword [0x4219bc]
push ecx
lea edx, [ebp - 0x620]
push edx
call fcn.00401ba9
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x620]
push ecx
call fcn.00401b7b
add esp, 8
lea edx, [ebp - 0x620]
push edx
call dword [0x425594]
mov ecx, dword [ebp - 0x694]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x694]
cmp dword [edx + 8], 0
jne 0x415f42
call fcn.004175d0
mov eax, dword [ebp - 0x694]
mov ecx, dword [eax + 0xff04]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
mov edx, dword [ebp - 0x694]
mov eax, dword [edx + 0x1fa38]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x694]
mov edx, dword [ecx + 0x1fa38]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x694]
mov ecx, dword [eax + 0x1fa28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x694]
mov eax, dword [edx + 0xff08]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x694]
mov edx, dword [ecx + 0xff04]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x4163f8
xor eax, eax
mov word [ebp - 0x418], ax
push 0x40e
lea ecx, [ebp - 0x418]
push ecx
call fcn.00418640
add esp, 8
test eax, eax
jne 0x415fea
call fcn.004175d0
mov edx, dword [ebp - 0x694]
mov eax, dword [edx + 0xff04]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x694]
mov edx, dword [ecx + 0x1fa38]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x694]
mov ecx, dword [eax + 0x1fa38]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x694]
mov eax, dword [edx + 0x1fa28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x694]
mov edx, dword [ecx + 0xff08]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x694]
mov ecx, dword [eax + 0xff04]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x4163f8
lea edx, [ebp - 0x418]
push edx
call fcn.004013bd
add esp, 4
movzx eax, word [ebp + eax*2 - 0x41a]
cmp eax, 0x5c
je 0x41601a
push 0x4219c0
lea ecx, [ebp - 0x418]
push ecx
call fcn.00401b7b
add esp, 8
mov edx, dword [0x42199c]
push edx
lea eax, [ebp - 0x418]
push eax
call fcn.00401b7b
add esp, 8
push 0x4219c4
lea ecx, [ebp - 0x418]
push ecx
call fcn.00401b7b
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x418]
push eax
call fcn.00401b7b
add esp, 8
push 0x44
push 0
lea ecx, [ebp - 0x688]
push ecx
call fcn.00401c60
add esp, 0xc
mov dword [ebp - 0x688], 0x44
mov dword [ebp - 0x680], str.WinSta0Default
lea edx, [ebp - 0x63c]
push edx
lea eax, [ebp - 0x688]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea ecx, [ebp - 0x418]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x416145
mov edx, dword [ebp - 0x694]
mov eax, dword [edx + 8]
push eax
call dword [0x425598]
call fcn.004175d0
mov ecx, dword [ebp - 0x694]
mov edx, dword [ecx + 0xff04]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
mov eax, dword [ebp - 0x694]
mov ecx, dword [eax + 0x1fa38]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x694]
mov eax, dword [edx + 0x1fa38]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x694]
mov edx, dword [ecx + 0x1fa28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x694]
mov ecx, dword [eax + 0xff08]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x694]
mov eax, dword [edx + 0xff04]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x4163f8
mov ecx, dword [ebp - 0x638]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x694]
mov eax, dword [ebp - 0x63c]
mov dword [edx + 0x10], eax
push 0x4e20
mov ecx, dword [ebp - 0x694]
mov edx, dword [ecx + 8]
push edx
call dword [0x42559c]
mov ecx, dword [ebp - 0x694]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x694]
cmp dword [edx + 0xc], 0xfffffffe
je 0x41619b
mov eax, dword [ebp - 0x694]
cmp dword [eax + 0xc], 0
jne 0x41626c
mov ecx, dword [ebp - 0x694]
cmp dword [ecx + 0xc], 0xfffffffe
jne 0x4161b7
mov edx, dword [ebp - 0x694]
mov eax, dword [edx + 0xc]
push eax
call dword [0x4255a4]
mov ecx, dword [ebp - 0x694]
mov edx, dword [ecx + 8]
push edx
call dword [0x425598]
call fcn.004175d0
push 0xffffffffffffffff
mov eax, dword [ebp - 0x694]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x694]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x694]
mov edx, dword [ecx + 0xff04]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
mov eax, dword [ebp - 0x694]
mov ecx, dword [eax + 0x1fa38]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x694]
mov eax, dword [edx + 0x1fa38]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x694]
mov edx, dword [ecx + 0x1fa28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x694]
mov ecx, dword [eax + 0xff08]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x694]
mov eax, dword [edx + 0xff04]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x4163f8
mov ecx, dword [ebp - 0x694]
mov dword [ecx + 0x14], 0x14
mov edx, dword [ebp - 0x694]
mov dword [edx + 0x18], 0x80004005
mov eax, dword [ebp - 0x694]
mov dword [eax + 0x1c], 1
mov ecx, dword [ebp - 0x694]
mov edx, dword [ecx + 0x1c]
add edx, 0xc
mov dword [ebp - 0x628], edx
mov eax, dword [ebp - 0x694]
add eax, 0x20
mov dword [ebp - 0x68c], eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x628]
push ecx
mov edx, dword [ebp - 0x694]
add edx, 0x14
push edx
mov eax, dword [ebp - 0x694]
mov ecx, dword [eax + 0xc]
push ecx
call dword [0x4255ac]
mov dword [ebp - 0x62c], eax
push 0xffffffffffffffff
push 0xfef0
mov edx, dword [ebp - 0x694]
add edx, 0x14
push edx
mov eax, dword [ebp - 0x694]
mov ecx, dword [eax + 0xc]
push ecx
call dword [0x4255a8]
mov dword [ebp - 0x640], eax
mov edx, dword [ebp - 0x62c]
cmp edx, dword [ebp - 0x628]
jne 0x416338
cmp dword [ebp - 0x640], 0xd
jne 0x416338
mov eax, dword [ebp - 0x694]
add eax, 0x20
mov dword [ebp - 0x690], eax
mov ecx, dword [ebp - 0x694]
mov eax, dword [ecx + 0x18]
jmp 0x4163f8
mov edx, dword [ebp - 0x694]
mov eax, dword [edx + 0xc]
push eax
call dword [0x4255a4]
mov ecx, dword [ebp - 0x694]
mov edx, dword [ecx + 8]
push edx
call dword [0x425598]
call fcn.004175d0
push 0xffffffffffffffff
mov eax, dword [ebp - 0x694]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x694]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x694]
mov edx, dword [ecx + 0xff04]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
mov eax, dword [ebp - 0x694]
mov ecx, dword [eax + 0x1fa38]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x694]
mov eax, dword [edx + 0x1fa38]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x694]
mov edx, dword [ecx + 0x1fa28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x694]
mov ecx, dword [eax + 0xff08]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x694]
mov eax, dword [edx + 0xff04]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004013ae
mov esp, ebp
pop ebp
ret 4