Function at 0x26c8444d
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x26ccd1bc
call fcn.26cc9320
sub esp, 0x498
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ebx
push esi
push edi
push eax
call dword [ecx + 0x50]
xor edi, edi
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
test byte [0x26ced0dc], 1
jne 0x26c846cc
xor ebx, ebx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
cmp eax, edi
mov dword [ebp - 0x14], eax
je 0x26c844a3
push edi
push eax
call fcn.26c68fca
test eax, eax
pop ecx
pop ecx
jne 0x26c84500
cmp ebx, edi
jne 0x26c846ab
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x25c]
cmp eax, edi
je 0x26c844de
mov ecx, dword [eax]
push 0x104
lea edx, [ebp - 0x4a4]
push edx
push 0x26cd8fc4
push str.INSTALL
push str.WDREPORT
push eax
call dword [ecx + 0x28]
jmp 0x26c844e5
mov word [ebp - 0x4a4], di
mov ecx, dword [ebp + 0x10]
cmp ecx, edi
je 0x26c844fb
mov eax, dword [ecx]
lea edx, [ebp - 0x4a4]
push edx
call dword [eax + 0x1c0]
xor ebx, ebx
inc ebx
jmp 0x26c84488
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x26c8459d
jle 0x26c846a2
cmp eax, 2
jle 0x26c84573
cmp eax, 3
je 0x26c8454d
cmp eax, 4
jne 0x26c846a2
push dword [ebp + 0x18]
mov eax, dword [esi]
push dword [ebp + 0x1c]
mov ecx, esi
push 0x8819
call dword [eax + 0x14]
push eax
lea eax, [ebp - 0x18]
push str.__s___IDCOMMAND_d___ETATSURTABLE__s____NOMPHYSETAT__s_
push eax
call fcn.26c77e75
add esp, 0x18
jmp 0x26c846a2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
push eax
lea eax, [ebp - 0x18]
push str.__s___REPSAVE__s_
push eax
call fcn.26c77e75
add esp, 0x10
jmp 0x26c846a2
cmp eax, 1
mov eax, str..WDE
je 0x26c84582
mov eax, str..WDR
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
push eax
push str.__s___REPSAVE__s___NOUVEAU__s_
jmp 0x26c84696
mov eax, dword [ebp + 0x14]
cmp eax, edi
je 0x26c845d5
cmp dword [eax + 0x2a8], edi
je 0x26c845d5
lea ebx, [eax + 0x2a4]
push edi
mov eax, ebx
call fcn.26c775a7
push eax
call fcn.26c691d3
test eax, eax
pop ecx
pop ecx
je 0x26c845d5
mov eax, ebx
call fcn.26c775a7
push 0xffffffffffffffff
push eax
jmp 0x26c84667
mov ebx, dword [ebp + 0x18]
push edi
push ebx
call fcn.26c691d3
test eax, eax
pop ecx
pop ecx
jne 0x26c84664
push dword [ebp + 0x20]
lea eax, [ebp - 0x298]
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
mov dword [ebp - 0x38], 0x14
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x34], ebx
call dword [eax + 0x10]
test eax, eax
jne 0x26c8467a
mov eax, dword [ebp + 0x14]
cmp eax, edi
je 0x26c848ea
lea ebx, [eax + 0x2a4]
push edi
mov eax, ebx
call fcn.26c775a7
push eax
call fcn.26c691d3
test eax, eax
pop ecx
pop ecx
je 0x26c848ea
mov esi, dword [ebp + 0x20]
call fcn.26c7aee9
mov eax, ebx
call fcn.26c775a7
push 0xffffffffffffffff
push eax
push 0x105
lea ebx, [ebp - 0x298]
call fcn.26c73ef4
mov esi, dword [ebp - 0x10]
jmp 0x26c84677
push 0xffffffffffffffff
push ebx
lea ebx, [ebp - 0x298]
push 0x105
call fcn.26c73ef4
add esp, 0xc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
push eax
lea eax, [ebp - 0x298]
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
push eax
push str.__s____s___REPSAVE__s_
lea eax, [ebp - 0x18]
push eax
call fcn.26c77e75
add esp, 0x14
push esi
call fcn.26c84e20
pop ecx
jmp 0x26c846d3
mov eax, dword [ebp + 0x20]
cmp eax, edi
je 0x26c848ea
push 0x3349f
push 0x26cd4138
call fcn.26c7af7a
pop ecx
pop ecx
jmp 0x26c848ea
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp eax, edi
mov dword [ebp - 0x10], eax
je 0x26c8484a
mov al, byte [0x26ced0dc]
test al, 1
je 0x26c846f2
cmp dword [ebp + 0xc], edi
je 0x26c846f2
cmp dword [ebp + 0xc], 4
jne 0x26c84748
push dword [ebp - 0x10]
mov ebx, dword [sym.imp.USER32.dll_IsIconic]
call ebx
test eax, eax
je 0x26c84719
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0xf120
push 0x112
push dword [ebp - 0x10]
call ebx
jmp 0x26c84738
push dword [ebp - 0x10]
call ebx
neg eax
sbb eax, eax
and eax, 4
add eax, 5
push eax
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov al, byte [0x26ced0dc]
jmp 0x26c8474e
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x14], edi
mov ecx, dword [ebp + 0xc]
sub ecx, edi
mov byte [ebp - 4], 1
je 0x26c847b2
dec ecx
je 0x26c8479e
dec ecx
je 0x26c84792
dec ecx
je 0x26c84788
dec ecx
jne 0x26c8483d
push dword [ebp + 0x18]
lea eax, [ebp - 0x14]
push dword [ebp + 0x1c]
push str.SCRIPT_WDETAT_____r_nLOG___r_nInfoLog_0__r_nCreeEtatSurTable__s__s__r_n
push eax
call fcn.26c77e75
add esp, 0x10
jmp 0x26c8480e
test al, 1
je 0x26c8483d
jmp 0x26c847dc
test al, 1
jne 0x26c847dc
push edi
push 0x8447
jmp 0x26c847a8
test al, 1
jne 0x26c847dc
push edi
push 0x8442
push 0x111
jmp 0x26c84838
cmp dword [ebp + 0x14], edi
je 0x26c847c9
push dword [ebp + 0x14]
push dword [ebp - 0x10]
call fcn.26c84bb6
mov al, byte [0x26ced0dc]
pop ecx
pop ecx
test al, 1
je 0x26c847f6
mov eax, dword [esi]
push edi
push dword [ebp + 0x18]
mov ecx, esi
call dword [eax + 0x1c]
test eax, eax
jne 0x26c8483d
push dword [ebp + 0x20]
push dword [ebp + 8]
call fcn.26c84903
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
call fcn.26c7749e
jmp 0x26c848ea
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x14]
push str.SCRIPT_WDETAT_____r_nLOG___r_nInfoLog_0__r_nOuvreEtat__s_0__r_n
push eax
call fcn.26c77e75
add esp, 0xc
lea eax, [ebp - 0x14]
call fcn.26c77895
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
cmp eax, edi
mov dword [ebp - 0x24], 0x10000001
jne 0x26c8482c
mov eax, 0x26cd8fc4
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x10]
push 0x4a
push dword [ebp - 0x10]
call ebx
lea ecx, [ebp - 0x14]
call fcn.26c7749e
jmp 0x26c848e7
test byte [0x26ced0dc], 1
je 0x26c84863
push dword [ebp + 0x20]
push dword [ebp + 8]
call fcn.26c84903
jmp 0x26c846c5
push 0x44
pop esi
push esi
lea eax, [ebp - 0x8c]
push edi
push eax
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x48]
push edi
push eax
mov dword [ebp - 0x8c], esi
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
call fcn.26c84406
push dword [ebp + 0x14]
lea eax, [ebp - 0x18]
push dword [ebp - 0x14]
push eax
call fcn.26c849a5
add esp, 0x28
mov esi, eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x8c]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
push esi
jne 0x26c848e0
call dword [sym.imp.MSVCRT.dll_free]
mov esi, dword [ebp + 0x20]
cmp esi, edi
pop ecx
je 0x26c848ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call fcn.26c7b5cf
jmp 0x26c848ea
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
xor edi, edi
inc edi
lea ecx, [ebp - 0x18]
call fcn.26c7749e
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret