Function at 0x576f86
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
sub esp, 0x5c
mov eax, 0x6ba4bb
call fcn.00664608
sub esp, 0x254
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
push 1
lea ecx, [ebp - 0x260]
mov dword [ebp + 0x28], esi
mov byte [ebp + 0x5f], bl
mov byte [esi + 0x1d8], bl
call fcn.0043cc35
push str._messages_from_queue
push dword [esi + 0x1b8]
lea eax, [ebp - 0x260]
mov dword [ebp - 4], ebx
push str.Clearing
push eax
call fcn.00445564
mov ecx, eax
call fcn.0043cf21
push eax
call fcn.00445564
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0x25c]
call fcn.00440063
lea eax, [ebp + 0x3c]
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00572a8c
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], bl
call fcn.00410858
lea ecx, [esi + 0x1a8]
call fcn.00579944
push 1
lea ecx, [ebp - 0x1c8]
call fcn.0048f190
cmp dword [esi + 0x58], 1
mov eax, dword [0x7150e0]
mov byte [ebp - 4], 2
je 0x57703b
mov eax, dword [0x7150dc]
push eax
mov ecx, 0x6cdce8
lea eax, [esi + 0xcc]
push ecx
push eax
push ecx
push 0x799c60
push ecx
push 0x799c78
push ecx
push dword [ebp + 0x6c]
lea eax, [ebp - 0x1b8]
push 0x6ceedc
push dword [ebp + 0x68]
push 0x6ceed8
push eax
call fcn.00427e82
push eax
call fcn.004586c0
push eax
call fcn.00427e82
push eax
call fcn.004586c0
push eax
call fcn.00427e82
push eax
call fcn.004586c0
push eax
call fcn.00427e82
push eax
call fcn.004586c0
push eax
call fcn.00427e82
push eax
call fcn.004586c0
push eax
call fcn.00427e82
push eax
call fcn.00427e82
mov eax, dword [0x7c5544]
test eax, eax
je 0x5770ec
push eax
push 0x713e90
push 0x79a0a0
push 0x713e94
lea eax, [ebp - 0x1b8]
push eax
call fcn.00427e82
push eax
call fcn.004586c0
push eax
call fcn.00427e82
mov ecx, eax
call fcn.0056fd99
mov dword [ebp + 0x2c], fcn.0043b735
mov dword [ebp + 0x30], ebx
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x38], ebx
lea eax, [ebp]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x1b0]
call fcn.0044c47b
push 0x44
pop edi
push edi
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 4
push ebx
push eax
call fcn.006678b0
mov dword [ebp - 0x80], edi
xor eax, eax
lea edi, [ebp + 0x18]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp]
push eax
push str.creating_remote_process_using
lea eax, [ebp - 0x3c]
push eax
call fcn.004280bb
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 5
push eax
mov ecx, esi
call fcn.00572b5b
call fcn.0057b9d9
test eax, eax
je 0x5772b6
cmp dword [esi + 0xec], ebx
jne 0x5772b6
xor eax, eax
mov dword [ebp + 0x3c], ebx
push str.S_1_16_4096
lea ecx, [ebp + 0x3c]
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x50], 7
mov word [ebp + 0x3c], ax
call fcn.00427ba3
lea eax, [ebp + 0x3c]
mov byte [ebp - 4], 6
push eax
call fcn.00571027
cmp byte [0x7b6759], 0
mov ebx, eax
mov dword [ebp + 0x6c], eax
jne 0x5771b1
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor ebx, ebx
mov dword [ebp + 0x6c], ebx
and dword [ebp - 0x24], 0
lea ecx, [ebp - 0x24]
and dword [ebp - 0x14], 0
push str.lowIntegrity_created
mov byte [ebp + 0x58], 0
push dword [ebp + 0x58]
mov dword [ebp - 0x10], 0xf
push 0x14
mov byte [ebp - 0x24], 0
call fcn.0041039b
xor eax, eax
mov byte [ebp - 4], 7
test ebx, ebx
lea ecx, [ebp + 0x2c]
setne al
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0045e957
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
jb 0x577227
mov ecx, dword [ebp - 0x24]
inc eax
mov dword [ebp + 0x54], eax
mov dword [ebp + 0x58], ecx
cmp eax, 0x1000
jb 0x57721e
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x58]
push eax
call fcn.004279ae
mov eax, dword [ebp + 0x54]
mov ecx, dword [ebp + 0x58]
push eax
push ecx
call fcn.006643a9
pop ecx
pop ecx
push 8
pop ebx
lea ecx, [ebp]
cmp dword [ebp + 0x14], ebx
jb 0x577235
mov ecx, dword [ebp]
mov edi, dword [ebp + 0x68]
mov eax, edi
cmp dword [edi + 0x14], ebx
jb 0x577241
mov eax, dword [edi]
lea edx, [ebp + 0x18]
push edx
lea edx, [ebp - 0x80]
push edx
xor edx, edx
push edx
push edx
push edx
push edx
push edx
push edx
push ecx
push eax
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp + 0x54], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x6c]
test eax, eax
je 0x577276
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp + 0x50]
mov byte [ebp - 4], 5
cmp eax, ebx
jb 0x5772f4
mov ecx, dword [ebp + 0x3c]
lea eax, [eax*2 + 2]
mov dword [ebp + 0x6c], eax
mov dword [ebp + 0x58], ecx
cmp eax, 0x1000
jb 0x5772ab
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x58]
push eax
call fcn.004279ae
mov eax, dword [ebp + 0x6c]
mov ecx, dword [ebp + 0x58]
push eax
push ecx
call fcn.006643a9
pop ecx
pop ecx
jmp 0x5772f4
push 8
pop ebx
lea eax, [ebp]
cmp dword [ebp + 0x14], ebx
jb 0x5772c4
mov eax, dword [ebp]
mov edi, dword [ebp + 0x68]
mov ecx, edi
cmp dword [edi + 0x14], ebx
jb 0x5772d0
mov ecx, dword [edi]
lea edx, [ebp + 0x18]
push edx
lea edx, [ebp - 0x80]
push edx
xor edx, edx
push edx
push edx
push edx
push edx
push edx
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov dword [ebp + 0x54], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp + 0x68], eax
cmp dword [ebp + 0x54], 0
jne 0x577451
push 1
lea ecx, [ebp - 0x118]
call fcn.0043cc35
push str._launching_process
push dword [ebp + 0x68]
lea eax, [ebp - 0x118]
mov byte [ebp - 4], bl
push str.Error
push eax
call fcn.00445564
mov ecx, eax
call fcn.0044578b
push eax
call fcn.00445564
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0x114]
call fcn.00440063
lea eax, [ebp + 0x3c]
mov byte [ebp - 4], 9
push eax
mov ecx, esi
call fcn.00572a8c
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], bl
call fcn.00410858
cmp dword [edi + 0x14], ebx
jb 0x577364
mov edi, dword [edi]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0xf
pop edi
mov esi, eax
mov dword [ebp + 0x50], edi
xor eax, eax
lea ecx, [ebp + 0x3c]
push 9
mov dword [ebp + 0x3c], eax
push str.exe_exist
mov dword [ebp + 0x4c], eax
mov byte [ebp + 0x3c], al
call fcn.00410407
push esi
lea eax, [ebp + 0x3c]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp + 0x2c]
call fcn.0045e957
mov eax, dword [ebp + 0x50]
mov byte [ebp - 4], bl
cmp eax, 0x10
jb 0x5773d6
mov ecx, dword [ebp + 0x3c]
inc eax
mov dword [ebp + 0x6c], eax
mov dword [ebp + 0x58], ecx
cmp eax, 0x1000
jb 0x5773cd
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x58]
push eax
call fcn.004279ae
mov eax, dword [ebp + 0x6c]
mov ecx, dword [ebp + 0x58]
push eax
push ecx
call fcn.006643a9
pop ecx
pop ecx
xor eax, eax
mov dword [ebp + 0x50], edi
push 7
mov dword [ebp + 0x3c], eax
lea ecx, [ebp + 0x3c]
push str.oserror
mov dword [ebp + 0x4c], eax
mov byte [ebp + 0x3c], al
call fcn.00410407
push dword [ebp + 0x68]
lea eax, [ebp + 0x3c]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp + 0x2c]
call fcn.0045e957
mov eax, dword [ebp + 0x50]
mov byte [ebp - 4], bl
cmp eax, 0x10
jb 0x57743e
mov ecx, dword [ebp + 0x3c]
inc eax
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x6c], ecx
cmp eax, 0x1000
jb 0x577435
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x6c]
push eax
call fcn.004279ae
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x6c]
push eax
push ecx
call fcn.006643a9
pop ecx
pop ecx
mov ecx, dword [ebp + 0x28]
lea eax, [ebp + 0x2c]
push eax
push str.create_process.error
call fcn.0057663b
jmp 0x5774d0
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x9c], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0xa0], eax
mov eax, dword [ebp + 0x20]
push 2
mov dword [esi + 0xa4], eax
lea eax, [esi + 0x11c]
pop ecx
xchg dword [eax], ecx
push 1
lea ecx, [ebp - 0x118]
call fcn.0043cc35
push dword [esi + 0xa4]
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 0xc
push str.started_remote_frame_process
push eax
call fcn.00445564
mov ecx, eax
call fcn.0044578b
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0x114]
call fcn.00440063
lea eax, [ebp + 0x3c]
mov byte [ebp - 4], 0xd
push eax
mov ecx, esi
call fcn.00572a8c
lea ecx, [ebp + 0x3c]
call fcn.00410858
mov byte [ebp + 0x5f], 1
lea ecx, [ebp - 0x118]
call fcn.0043d111
lea ecx, [ebp - 0x3c]
call fcn.00427afc
lea ecx, [ebp]
call fcn.00427afc
mov esi, dword [ebp + 0x30]
test esi, esi
je 0x577523
mov edi, dword [ebp + 0x34]
cmp esi, edi
je 0x577509
mov ecx, esi
call fcn.0042a0ed
add esi, ebx
cmp esi, edi
jne 0x5774f9
mov esi, dword [ebp + 0x30]
mov eax, dword [ebp + 0x38]
sub eax, esi
and eax, 0xfffffff8
push eax
push esi
call fcn.004276a2
xor eax, eax
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x34], eax
mov dword [ebp + 0x38], eax
lea ecx, [ebp - 0x1c8]
mov dword [ebp + 0x2c], 0x6ce0ac
call fcn.0049213c
lea ecx, [ebp - 0x260]
call fcn.0043d111
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + 0x5f]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add ebp, 0x60
leave
ret 8