Function at 0x439800
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x50e60c
mov eax, dword fs:[0]
push eax
sub esp, 0x3f4
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x3f0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x408]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x418]
xor ebx, ebx
mov edi, ecx
cmp byte [0x547c38], bl
jne 0x439c2e
call fcn.00442f80
cmp byte [eax + 0xb72], bl
je 0x439c2e
cmp byte [0x547c38], bl
jne 0x439c2e
cmp word [edi], bx
je 0x439c2e
call fcn.00442f80
cmp byte [eax + 0xb72], bl
je 0x439c2e
cmp byte [0x547c38], bl
jne 0x439c2e
call fcn.00442f80
cmp byte [eax + 0x128], bl
je 0x4398a7
add eax, 0x18
jmp 0x4398aa
mov eax, dword [eax + 0x14]
lea esi, [eax + 4]
cmp esi, ebx
je 0x439c32
cmp word [esi], bx
je 0x439c32
lea ecx, [esp + 0x2dc]
call fcn.0043a090
mov eax, esi
lea edx, [esp + 0x2dc]
mov dword [esp + 0x410], ebx
call fcn.0043a2e0
push ebx
push ebx
push ebx
push ebx
push ebx
push str.SGTool.exe
lea ecx, [esp + 0xa8]
call fcn.00436ef0
lea eax, [esp + 0x9c]
cmp byte [esp + 0x1ac], bl
jne 0x43990c
mov eax, dword [esp + 0x98]
cmp word [eax + 4], 0x2e
jne 0x439928
lea ecx, [esp + 0x90]
lea esi, [esp + 0x2dc]
call fcn.00438040
jmp 0x43993c
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x2e0]
call fcn.004374e0
mov dword [esp + 0x90], vtable.t_str.0
cmp byte [esp + 0x1ac], bl
jne 0x43996b
mov eax, dword [esp + 0x98]
lea ecx, [esp + 0x9c]
cmp eax, ecx
je 0x43996b
push eax
call fcn.004ccef0
add esp, 4
mov dword [esp + 0x410], 1
mov dword [esp + 0x18], vtable.t_errorList.0
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], vtable.t_errorList::t_mem.0
mov esi, ebp
lea ebx, [esp + 0x18]
mov byte [esp + 0x410], 2
call fcn.00446640
test al, al
jne 0x4399cf
push 0x529230
mov ecx, ebp
call fcn.00402960
lea ecx, [esp + 0x18]
call fcn.00446600
lea ecx, [esp + 0x2dc]
call fcn.0043a230
jmp 0x439c3e
mov edx, dword [esp + 0x41c]
push edx
push edi
lea eax, [esp + 0x20]
push eax
mov esi, ebp
call fcn.00446720
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
test esi, esi
jne 0x4399ff
push 0x52924c
jmp 0x4399ae
push 6
push esi
call fcn.00444ea0
push 6
push esi
call fcn.00444ef0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 0x10
push 0
push 1
push 0x10000000
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], 0
call edi
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x439a50
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x529260
jmp 0x4399ae
push 0x40
lea edx, [esp + 0x4c]
push 0
push edx
mov dword [esp + 0x50], 0x44
call fcn.004d3fc0
xor eax, eax
add esp, 0xc
lea ecx, [esp + 0x1b4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call fcn.0043a090
push 0x5213d8
push 0x52139c
lea edx, [esp + 0x1bc]
mov byte [esp + 0x418], 3
call fcn.0043a8a0
add esp, 8
lea ecx, [esp + 0x2dc]
call fcn.00437460
push eax
push 0x52139c
lea edx, [esp + 0x1bc]
call fcn.0043a8a0
push 0x5213d8
push 0x52139c
lea edx, [esp + 0x1c4]
call fcn.0043a8a0
push str.___appiderrorreport
push 0x52139c
lea edx, [esp + 0x1cc]
call fcn.0043a8a0
push str.__list
push 0x52139c
lea edx, [esp + 0x1d4]
call fcn.0043a8a0
push str.__hevent
push 0x52139c
lea edx, [esp + 0x1dc]
call fcn.0043a8a0
mov eax, dword [esp + 0x3c]
push eax
push 0x529348
lea edx, [esp + 0x1e4]
call fcn.0043a8a0
add esp, 0x30
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x48]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
mov ecx, 0x104
lea eax, [esp + 0x1d4]
call fcn.0043a5d0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x439bc6
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
lea edi, [esp + 0x1b4]
call fcn.0043a600
lea ecx, [esp + 0x2dc]
call fcn.00437460
push eax
push str._T_vz1Y_
mov ebx, ebp
call fcn.00439c70
mov ecx, eax
call fcn.00439dd0
mov ecx, eax
call fcn.00439dd0
push 0x529230
mov ecx, ebp
call fcn.00402960
mov ecx, edi
call fcn.0043a230
jmp 0x4399b5
lea edi, [esp + 0x1b4]
call fcn.0043a600
mov ecx, dword [esp + 0x2c]
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x44]
push edx
push 2
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [esp + 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0x30]
push ecx
call edi
push esi
call edi
mov edx, dword [esp + 0x14]
push edx
call edi
lea ecx, [esp + 0x1b4]
call fcn.0043a230
lea ecx, [esp + 0x18]
call fcn.00446600
lea ecx, [esp + 0x2dc]
call fcn.0043a230
mov al, 1
jmp 0x439c40
push 0x5291ec
mov ecx, ebp
call fcn.00402960
xor al, al
mov ecx, dword [esp + 0x408]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3f0]
xor ecx, esp
call fcn.004ccee1
add esp, 0x400
ret