Function at 0x57ed10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e17a9
mov eax, dword fs:[0]
push eax
sub esp, 0x4b0
mov eax, dword [0x676580]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4b4], ecx
mov eax, dword [ebp - 0x4b4]
cmp dword [eax + 0xc], 0
jne 0x57ed92
cmp dword [0x67e1c8], 0
je 0x57ed8b
mov dword [ebp - 0x494], 0
lea ecx, [ebp - 0x494]
push ecx
push 0x61acf0
push 0x61acd4
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447700
xor eax, eax
jmp 0x57f1dc
mov ecx, dword [ebp - 0x4b4]
add ecx, 0x28
call fcn.0040ee60
movzx edx, al
test edx, edx
je 0x57edec
cmp dword [0x67e1c8], 0
je 0x57ede5
mov dword [ebp - 0x498], 0
lea eax, [ebp - 0x498]
push eax
push str.exe_path_is_empty
push 0x61ad10
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447700
xor eax, eax
jmp 0x57f1dc
mov ecx, dword [ebp - 0x4b4]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x4b4]
add eax, 0x28
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.005c2e90
add esp, 0xc
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040ee60
movzx edx, al
test edx, edx
je 0x57ee84
cmp dword [0x67e1c8], 0
je 0x57ee60
mov dword [ebp - 0x49c], 0
lea eax, [ebp - 0x49c]
push eax
push str.expanded_exe_path_is_empty
push 0x61ad50
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447700
mov dword [ebp - 0x4a0], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00403270
mov eax, dword [ebp - 0x4a0]
jmp 0x57f1dc
lea ecx, [ebp - 0x18]
call fcn.00403290
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x4b4]
add ecx, 0x30
call fcn.0040ee60
movzx ecx, al
test ecx, ecx
jne 0x57eefc
mov edx, dword [ebp - 0x4b4]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0x4b4]
add ecx, 0x30
push ecx
lea edx, [ebp - 0x4a4]
push edx
call fcn.005c2e90
add esp, 0xc
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x4bc], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x4bc]
push ecx
lea ecx, [ebp - 0x18]
call fcn.0040ca60
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4a4]
call fcn.00403270
mov ecx, dword [ebp - 0x4b4]
add ecx, 0x2c
call fcn.0040ee60
movzx edx, al
test edx, edx
jne 0x57ef2c
mov eax, dword [ebp - 0x4b4]
mov ecx, dword [eax + 0x2c]
push ecx
push 0x61ada4
lea edx, [ebp - 0x18]
push edx
call fcn.0042ac70
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.0045b180
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x4b4]
movzx ecx, byte [eax + 0x34]
test ecx, ecx
je 0x57efe7
cmp dword [0x67e1c8], 0
je 0x57efc3
mov dword [ebp - 0x4a8], 0
lea edx, [ebp - 0x4a8]
push edx
push str.__with_low_permissions.
lea ecx, [ebp - 0x18]
call fcn.00493020
push eax
push 0x61add4
lea ecx, [ebp - 0x10]
call fcn.00493020
push eax
push 0x61adc8
push 0x61adac
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447700
lea ecx, [ebp - 0x18]
call fcn.00493020
push eax
lea ecx, [ebp - 0x10]
call fcn.00493020
push eax
call fcn.00575fd0
add esp, 8
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x57f1b2
cmp dword [0x67e1c8], 0
je 0x57f067
mov dword [ebp - 0x4ac], 0
lea eax, [ebp - 0x4ac]
push eax
push str.__with_normal_permissions.
lea ecx, [ebp - 0x18]
call fcn.00493020
push eax
push str._param
lea ecx, [ebp - 0x10]
call fcn.00493020
push eax
push 0x61ae34
push 0x61ae18
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447700
lea ecx, [ebp - 0x490]
call fcn.00403290
mov byte [ebp - 4], 3
push 0
lea ecx, [ebp - 0x10]
call fcn.0043e0c0
movzx ecx, ax
cmp ecx, 0x22
jne 0x57f0a6
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0x61ae8c
lea ecx, [ebp - 0x490]
push ecx
call fcn.00403240
add esp, 0x10
jmp 0x57f0c2
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0x61ae98
lea ecx, [ebp - 0x490]
push ecx
call fcn.00403240
add esp, 0x10
mov word [ebp - 0x434], 0
push 0x410
push 0
lea edx, [ebp - 0x432]
push edx
call fcn.00524800
add esp, 0xc
lea ecx, [ebp - 0x490]
call fcn.00493020
push eax
push 0x208
lea eax, [ebp - 0x434]
push eax
call fcn.0052456c
add esp, 0xc
mov dword [ebp - 0x48c], 0x44
push 0x40
push 0
lea ecx, [ebp - 0x488]
push ecx
call fcn.00524800
add esp, 0xc
mov word [ebp - 0x45c], 0xa
mov dword [ebp - 0x444], 0
xor edx, edx
mov dword [ebp - 0x440], edx
mov dword [ebp - 0x43c], edx
mov dword [ebp - 0x438], edx
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x48c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x434]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x57f1a3
cmp dword [ebp - 0x444], 0
je 0x57f18d
mov eax, dword [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x440], 0
je 0x57f1a3
mov ecx, dword [ebp - 0x440]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x490]
call fcn.00403270
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x4b0], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00403270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00403270
mov eax, dword [ebp - 0x4b0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005236f2
mov esp, ebp
pop ebp
ret