Function at 0x111976a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111ea3a6
mov eax, dword fs:[0]
push eax
sub esp, 0x4d0
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 1
lea eax, [edi + 0xc]
push eax
lea ecx, [ebp - 0x430]
mov dword [ebp - 0x428], edi
call fcn.1113ea20
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [edi + 0x28], esi
je 0x111976fb
mov ecx, dword [edi + 0x28]
mov edx, dword [ecx]
mov eax, dword [edx + 0x18]
call eax
lea ecx, [ebp - 0x430]
call fcn.1113e900
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.Kernel32.dll
mov dword [ebp - 0x424], esi
call ebx
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x484], esi
mov dword [ebp - 0x480], esi
mov dword [ebp - 0x47c], esi
mov dword [ebp - 0x478], esi
mov dword [ebp - 0x474], esi
mov dword [ebp - 0x470], esi
mov dword [ebp - 0x46c], esi
mov dword [ebp - 0x468], esi
mov dword [ebp - 0x464], esi
mov dword [ebp - 0x460], esi
mov dword [ebp - 0x45c], esi
mov dword [ebp - 0x458], esi
mov dword [ebp - 0x450], esi
mov dword [ebp - 0x44c], esi
mov dword [ebp - 0x448], esi
mov dword [ebp - 0x444], esi
mov dword [ebp - 0x440], esi
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x438], esi
mov dword [ebp - 0x434], esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [ebp - 0x488]
push str.IsWow64Process
push ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x454], eax
cmp eax, esi
je 0x111977cb
lea edx, [ebp - 0x424]
push edx
push edi
call eax
jmp 0x111977d3
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x424], esi
je 0x111978b6
push 0x104
lea ecx, [ebp - 0x41e]
push ecx
mov eax, 0x22
push esi
mov word [ebp - 0x420], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x420]
push 0x5c
push edx
call dword [sym.imp.MSVCR100.dll_wcsrchr]
add esp, 8
cmp eax, esi
je 0x1119790d
mov ecx, str.winst64.exe___q__q__su
mov edx, eax
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
cmp ax, si
jne 0x11197821
push 0x44
lea eax, [ebp - 0x4dc]
push esi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 0x498]
push edx
lea eax, [ebp - 0x4dc]
push eax
push esi
push esi
push 0x4000000
push esi
xor ecx, ecx
push esi
mov word [ebp - 0x4ac], cx
push esi
lea ecx, [ebp - 0x420]
push ecx
push esi
mov dword [ebp - 0x4dc], 0x44
mov dword [ebp - 0x4b0], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, esi
je 0x1119790d
mov edx, dword [ebp - 0x498]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x498]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [ebp - 0x494]
push ecx
call edi
jmp 0x1119790d
push str.pscrinst.dll
call ebx
mov edi, eax
cmp edi, esi
je 0x111978f9
push str.PscrRemoveDeviceW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push str.RootNS_PseudoSmartCardReader
push esi
call eax
test eax, eax
jne 0x111978f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CSmartcardDeviceMngr___PscrRemoveDeviceW_failed___d__n
call fcn.111bd7b0
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1119790d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CSmartcardDeviceMngr___failed_to_load_pscrinst.dll___d__n
call fcn.111bd7b0
add esp, 8
mov edx, dword [ebp - 0x428]
mov eax, dword [edx + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp - 0x488]
cmp eax, esi
je 0x1119792e
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x430]
mov dword [ebp - 4], 0xffffffff
call fcn.1113e900
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret