Function at 0x403410
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.004ca2e0
xor eax, eax
push edi
push 0x40
xor edi, edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xa4]
push edi
push eax
mov byte [ebp - 1], 0
mov dword [ebp - 0xa8], 0x44
call fcn.004c9b50
push 0x38
lea ecx, [ebp - 0x60]
push edi
push ecx
mov dword [ebp - 0x64], 0x3c
call fcn.004c9b50
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0xffffffff
cmp ecx, edi
je 0x4038fa
push esi
mov esi, dword [ebp + 0xc]
cmp esi, edi
je 0x4038f9
push ebx
mov ebx, dword [ebp + 0x10]
cmp ebx, edi
je 0x4038f8
mov eax, dword [ebp + 0x14]
cmp eax, edi
je 0x4038f8
mov edx, dword [0x52fe34]
cmp byte [edx + 0x125fa], 0
mov edi, dword [ebp + 0x18]
je 0x4034e4
push edi
push eax
push ebx
push esi
push ecx
lea eax, [ebp - 0x1a8]
push str.CAttachDlg::StartAttach_HWNDx_08X__PID_u__Bits_u__Type_u__AltMode_u
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
push 1
push 1
lea ecx, [ebp - 0x1a8]
push ecx
mov ecx, dword [0x52fe2c]
call fcn.00409280
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x2004]
push edx
push ecx
call fcn.0042bf60
add esp, 8
test eax, eax
je 0x40354f
push 0x30
push 0x12
call fcn.0042b600
mov ecx, dword [0x52fe14]
mov edx, dword [ebp - 0x1ff0]
push 0
push 0
push ecx
push eax
push edx
mov dword [ebp - 8], eax
call fcn.0042be80
add esp, 0x1c
mov dword [ebp - 0xc], eax
test eax, eax
je 0x40353a
cmp dword [eax], 0x34
jb 0x40353a
cmp dword [eax + 0x30], 0
je 0x40353a
mov byte [ebp - 1], 1
jmp 0x4038f8
lea eax, [ebp - 8]
push eax
call fcn.0042b550
lea ecx, [ebp - 0xc]
push ecx
call fcn.0042b550
add esp, 8
push esi
push 0x4e4e20
lea edx, [ebp - 0x938]
push str._spipeConEmuHk_u
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
push 0
push 3
call fcn.0044cf40
push eax
push 0
push 0xc0000000
lea eax, [ebp - 0x938]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x4035a8
cmp eax, 0xffffffff
je 0x4035a8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
jmp 0x4037e9
mov ecx, dword [0x52fe2c]
add ecx, 0x5c8
push ecx
lea edx, [ebp - 0x530]
push edx
call fcn.00402ef0
add esp, 8
mov eax, 0x4e4dd4
cmp ebx, 0x40
je 0x4035d3
mov eax, 0x4e4db8
push eax
push 0x144
lea eax, [ebp - 0x530]
push eax
call fcn.004017b0
test edi, edi
je 0x403617
cmp dword [ebp + 0x14], 1
jne 0x403617
mov ecx, dword [0x52fe14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push eax
push esi
lea edx, [ebp - 0x2a8]
push str.__ATTACH__CONPID_u__GID_u__GHWND_08X
push edx
call ebx
add esp, 0x14
jmp 0x403635
push esi
lea eax, [ebp - 0x2a8]
push str.__INJECT_u
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
xor edi, edi
xor ecx, ecx
cmp dword [ebp + 0x14], 2
mov dword [ebp - 0x7c], 1
mov word [ebp - 0x78], cx
jne 0x403654
mov ecx, dword [0x52fe2c]
push esi
call fcn.0041c160
push esi
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x4036da
call esi
mov edx, dword [0x52fe14]
mov eax, edi
neg eax
sbb eax, eax
and eax, 0xffff8000
add eax, 0x8000
or eax, 0x140
mov dword [ebp - 0x60], eax
mov eax, dword [0x52fe2c]
lea ecx, [ebp - 0x530]
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x5c], edx
lea ecx, [ebp - 0x64]
lea edx, [ebp - 0x2a8]
add eax, 0x5c8
push ecx
mov dword [ebp - 0x58], str.runas
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], 2
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne al
test al, al
je 0x403722
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], edx
jmp 0x40371e
mov edx, edi
neg edx
lea eax, [ebp - 0x24]
push eax
sbb edx, edx
lea ecx, [ebp - 0xa8]
push ecx
push 0
push 0
and edx, 0x7fffff0
add edx, 0x10
or edx, 0x4000020
push edx
push 0
push 0
push 0
lea eax, [ebp - 0x2a8]
push eax
lea ecx, [ebp - 0x530]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne al
test al, al
jne 0x403790
call esi
mov esi, eax
mov eax, str.injection
test edi, edi
jne 0x403734
mov eax, str.console
lea edx, [ebp - 0x2a8]
push edx
lea ecx, [ebp - 0x530]
push ecx
push eax
lea edx, [ebp - 0xd40]
push str.Cant_start__s_server_n_s__s
push edx
call ebx
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x1a8]
push str.ConEmu_Attach__PID_u__TID_u
push eax
call ebx
push 0
lea ecx, [ebp - 0x1a8]
push ecx
push 0
lea edx, [ebp - 0xd40]
push esi
push edx
call fcn.004263e0
add esp, 0x24
jmp 0x4038e5
test edi, edi
je 0x40379d
mov byte [ebp - 1], 1
jmp 0x4038e5
mov eax, dword [ebp - 0x24]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x24]
lea ecx, [ebp - 0x10]
push ecx
push edx
mov dword [ebp - 0x10], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4037d4
push eax
call esi
mov eax, dword [ebp - 0x10]
cmp eax, 0x81
je 0x4037e9
cmp eax, 0x90
jne 0x4038e5
push 0x40
push 0x36
call fcn.0042b600
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add esp, 8
mov dword [ebp - 8], eax
call esi
cmp dword [ebp + 0x14], 2
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x30], eax
mov edx, dword [ebp - 8]
mov eax, dword [0x52fe14]
mov dword [edx + 0x34], eax
jne 0x403820
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x38], edx
mov eax, dword [0x52fe14]
mov ecx, dword [ebp - 8]
push 0
push 0
push eax
push 0x1f4
push ecx
lea edx, [ebp - 0x938]
push edx
call fcn.0042b980
add esp, 0x18
mov dword [ebp - 0xc], eax
test eax, eax
je 0x403861
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
cmp ecx, dword [edx]
jb 0x403861
cmp dword [eax + 0x30], 0
je 0x403861
mov byte [ebp - 1], 1
jmp 0x4038e5
lea eax, [ebp - 0x730]
push str.Failed_to_start_console_server_in_the_remote_process
push eax
call fcn.00402f50
mov eax, dword [ebp - 0x28]
add esp, 8
test eax, eax
je 0x403897
cmp eax, 0xffffffff
je 0x403897
push str._nHooks_already_was_set
push 0xff
lea ecx, [ebp - 0x730]
push ecx
call fcn.004017b0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call esi
push eax
lea edx, [ebp - 0x1a8]
push str.ConEmu_Attach__PID_u__TID_u
push edx
call ebx
mov eax, dword [ebp - 0xc]
add esp, 0x10
test eax, eax
je 0x4038c7
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
cmp ecx, dword [edx]
jb 0x4038c7
mov eax, dword [eax + 0x34]
jmp 0x4038ca
or eax, 0xffffffff
push 0
lea ecx, [ebp - 0x1a8]
push ecx
push 0
push eax
lea edx, [ebp - 0x730]
push edx
call fcn.004263e0
add esp, 0x14
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4038f8
cmp eax, 0xffffffff
je 0x4038f8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
lea eax, [ebp - 8]
push eax
call fcn.0042b550
lea ecx, [ebp - 0xc]
push ecx
call fcn.0042b550
mov al, byte [ebp - 1]
add esp, 8
pop edi
mov esp, ebp
pop ebp
ret