Function at 0x405645
Capabilities:
Create process on windows
Create process suspended
Create thread
Get common file path
Resume thread
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x698
mov eax, dword [0x409044]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0
mov esi, ecx
mov dword [ebp - 0x628], edx
push 0
mov dword [ebp - 0x62c], esi
mov dword [ebp - 0x630], eax
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov ebx, eax
test ebx, ebx
jne 0x405699
call fcn.00405d29
mov esi, eax
test esi, esi
js 0x4058f8
mov esi, dword [ebp - 0x62c]
push 0x104
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
test byte [0x4095c1], 0x20
mov edi, eax
je 0x4056c1
push esi
mov edx, 0x401498
call fcn.0040541c
mov esi, 0x80004005
test edi, edi
je 0x4058f1
mov eax, 0x104
cmp edi, eax
jae 0x4058f1
push 0x401ba0
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchAppend]
test eax, eax
js 0x4058f1
push dword [ebp - 0x62c]
lea eax, [ebp - 0x624]
push 0x400
push 0x401bc0
push 0x208
push eax
call fcn.004037f2
add esp, 0x14
test eax, eax
js 0x4058f1
push 0x40
lea eax, [ebp - 0x690]
mov dword [ebp - 0x694], 0x44
push 0
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x640]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x640]
push eax
xor edi, edi
lea eax, [ebp - 0x694]
push eax
push edi
push edi
push 4
push edi
push edi
push edi
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x405789
call fcn.00405d29
mov esi, eax
test esi, esi
js 0x4058f1
push dword [ebp - 0x640]
push ebx
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x40579e
mov esi, edi
jmp 0x4057ad
call fcn.00405d29
mov esi, eax
test esi, esi
js 0x4058cb
test byte [ebp - 0x628], 2
je 0x40587b
push 1
push edi
push edi
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_core_io_l1_1_0.dll_CreateIoCompletionPort]
mov edi, eax
test edi, edi
je 0x4057fb
push 8
lea eax, [ebp - 0x648]
mov dword [ebp - 0x648], ebx
push eax
push 7
push ebx
mov dword [ebp - 0x644], edi
call dword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
jne 0x4057f7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
test edi, edi
jne 0x40580a
call fcn.00405d29
mov esi, eax
test esi, esi
js 0x4058a1
lea eax, [ebp - 0x644]
xor esi, esi
push eax
push esi
push edi
push 0x405610
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x628], eax
test eax, eax
jne 0x405837
call fcn.00405d29
mov esi, eax
test esi, esi
js 0x405872
push dword [ebp - 0x63c]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
mov ecx, dword [ebp - 0x628]
lea edx, [ebp - 0x630]
push ecx
xor eax, eax
mov dword [ebp - 0x630], ecx
push ecx
test ecx, ecx
push 0xffffffffffffffff
setne al
push eax
call fcn.00405b89
push dword [ebp - 0x628]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4058a1
push dword [ebp - 0x63c]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
test byte [ebp - 0x628], 0x40
je 0x4058a1
mov edx, dword [ebp - 0x640]
mov ecx, dword [ebp - 0x630]
call fcn.00405a73
test byte [0x4095c1], 0x20
je 0x4058c7
push dword [ebp - 0x62c]
push dword [ebp - 0x640]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetProcessId]
push eax
mov edx, 0x401418
call fcn.00405ac4
test esi, esi
jns 0x4058d9
push 5
push dword [ebp - 0x640]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
push dword [ebp - 0x640]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x63c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408730
leave
ret 4