Function at 0x403bd1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9b4
mov eax, dword [0x4101e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x944], ecx
call dword [sym.imp.Mso30Win32Client.dll_Ordinal_1043]
mov dword [ebp - 0x954], eax
lea ecx, [ebp - 0x94c]
lea eax, [ebp - 0x958]
mov dword [ebp - 0x958], 0x40d4a4
push eax
mov dword [ebp - 0x950], str.LaunchSyncCenter
call fcn.00401f89
push ecx
mov eax, esi
lea ecx, [ebp - 0x94c]
cdq
push edx
push eax
push str.LaunchContext
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_1620]
mov ecx, eax
call fcn.004069c7
mov esi, 0x208
lea eax, [ebp - 0x210]
push esi
xor ebx, ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea eax, [ebp - 0x5a8]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea eax, [ebp - 0x940]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [ebp - 0x9b0], 0x44
lea edi, [ebp - 0x968]
stosd dword es:[edi], eax
push 0x40
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x9ac]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x30
lea eax, [ebp - 0x210]
mov esi, 0x104
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
push esi
push eax
call edi
mov esi, eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call edi
sub eax, esi
mov esi, 0x104
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x5a8]
push esi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
push str.msouc.exe
lea eax, [ebp - 0x5a8]
push esi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov esi, dword [ebp - 0x944]
add esp, 0x34
test esi, esi
je 0x403d31
push 0x104
push esi
call edi
push eax
push esi
lea eax, [ebp - 0x940]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x18
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
lea eax, [ebp - 0x968]
push eax
lea eax, [ebp - 0x9b0]
push eax
push ebx
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x940]
push eax
lea eax, [ebp - 0x5a8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test esi, esi
setne cl
movzx ecx, cl
push ecx
lea ecx, [ebp - 0x94c]
call fcn.00401fd8
test esi, esi
je 0x403d99
push dword [ebp - 0x964]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x968]
call esi
mov bl, 1
jmp 0x403e07
mov esi, dword [sym.imp.Mso30Win32Client.dll_Ordinal_612]
lea eax, [ebp - 0x3a0]
mov edi, 0xc8
push edi
push eax
push 0x556ddf37
push dword [0x41344c]
call esi
lea eax, [ebp - 0x3a0]
push eax
push str.32770
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x403dd8
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x403e07
push edi
lea eax, [ebp - 0x738]
push eax
push 0xb123ffd0
push dword [0x41344c]
call esi
push 0x10010
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x738]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x94c]
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_177]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409d37
mov esp, ebp
pop ebp
ret