Function at 0x45f2cd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
call fcn.00401340
test al, al
jne 0x45f2fe
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
push str.startpin
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
setg al
jmp 0x45f56e
call fcn.00401340
test al, al
je 0x45f317
call fcn.00446cd0
test al, al
jne 0x45f317
inc al
jmp 0x45f56e
lea eax, [ebp - 8]
push eax
push 0x5abbac
push 0x17
xor ebx, ebx
push ebx
push 0x5abb9c
mov dword [ebp - 8], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp dword [ebp - 8], ebx
jne 0x45f33f
xor al, al
jmp 0x45f56e
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edi, dword [ebp - 8]
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ebx
call esi
cmp eax, ebx
jge 0x45f368
push eax
call fcn.005a56e0
lea eax, [ebp - 0x3c]
push eax
call esi
cmp eax, ebx
jge 0x45f378
push eax
call fcn.005a56e0
mov eax, dword [edi]
lea ecx, [ebp - 0xc]
push ecx
push 1
lea ecx, [ebp - 0x28]
push ecx
push 8
lea ecx, [ebp - 0x3c]
push ecx
push ecx
push edi
call dword [eax + 0x3c]
test eax, eax
je 0x45f3b5
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x45f3a0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x3c]
push eax
call esi
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x45f338
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45f338
cmp dword [ebp - 0x28], ebx
je 0x45f393
cmp dword [ebp - 0xc], ebx
je 0x45f3a0
push str.shlwapi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
jne 0x45f3d9
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x45f393
push str.IUnknown_QueryService
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
jne 0x45f3ec
push edi
jmp 0x45f3d1
lea ecx, [ebp - 0x10]
push ecx
push 0x5abaec
push 0x5abacc
push dword [ebp - 0xc]
mov dword [ebp - 0x10], ebx
call eax
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x45f3e9
lea edx, [ebp - 0x18]
push edx
mov dword [ebp - 0x18], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jne 0x45f42c
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x45f3e9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45f3e9
lea edx, [ebp - 0x14]
push edx
push 0x5abbec
push ebx
mov dword [ebp - 0x14], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
cmp dword [ebp - 0x14], ebx
jne 0x45f453
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x45f41d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45f41d
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x45f475
cmp dword [ebp - 0x2c], ebx
je 0x45f475
push dword [ebp - 0x2c]
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x1c]
push edx
push 0x5abbcc
mov dword [ebp - 0x1c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx]
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
jne 0x45f49f
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x45f444
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45f444
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x24], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x24]
cmp eax, ebx
jne 0x45f4c2
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x45f490
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45f490
lea edx, [ebp - 0x20]
push edx
push 0x5abbbc
mov dword [ebp - 0x20], ebx
mov ecx, dword [eax]
push eax
call dword [ecx]
cmp dword [ebp - 0x20], ebx
jne 0x45f4e7
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x45f4b3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45f4b3
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call fcn.0045ef51
mov byte [ebp + 0xb], al
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x45f503
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x45f510
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x45f51d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x45f52a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x45f537
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x45f544
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x45f558
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x3c]
push eax
call esi
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x45f56b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, byte [ebp + 0xb]
pop edi
pop esi
pop ebx
leave
ret 4