Function at 0x418440
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c6f6
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x463444]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2cc], ecx
mov byte [ebp - 0x11c], 0
push 0x103
push 0
lea eax, [ebp - 0x11b]
push eax
call fcn.0043b290
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x11c]
push ecx
call fcn.0043b290
add esp, 0xc
push str.epsng_certd_qdccb.exe
lea ecx, [ebp - 0x13c]
call fcn.00404840
mov dword [ebp - 4], 0
push 0
push 0x2e
lea ecx, [ebp - 0x13c]
call fcn.00419de0
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xffffffff
je 0x4184f7
mov edx, dword [ebp - 0x120]
push edx
push str.epsng_certd_qdccb.exe
lea eax, [ebp - 0x11c]
push eax
call fcn.0043cf50
add esp, 0xc
jmp 0x418517
lea ecx, [ebp - 0x13c]
call fcn.004048a0
push eax
push str.epsng_certd_qdccb.exe
lea ecx, [ebp - 0x11c]
push ecx
call fcn.0043cf50
add esp, 0xc
push 1
lea edx, [ebp - 0x11c]
push edx
mov ecx, dword [ebp - 0x2cc]
add ecx, 0x178
call fcn.00405640
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp + 8], 0
je 0x4188ce
push 0x44
push 0
lea eax, [ebp - 0x2bc]
push eax
call fcn.0043b290
add esp, 0xc
mov dword [ebp - 0x2bc], 0x44
xor ecx, ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], ecx
mov byte [ebp - 0x274], 0
push 0x103
push 0
lea edx, [ebp - 0x273]
push edx
call fcn.0043b290
add esp, 0xc
mov ecx, 0x479140
call fcn.0040a620
movzx eax, al
test eax, eax
je 0x4186af
lea ecx, [ebp - 0x274]
push ecx
mov ecx, dword [ebp - 0x2cc]
add ecx, 0x178
call fcn.00406590
lea edx, [ebp - 0x274]
add edx, 0xffffffff
mov dword [ebp - 0x2d0], edx
mov eax, dword [ebp - 0x2d0]
mov cl, byte [eax + 1]
mov byte [ebp - 0x2d1], cl
add dword [ebp - 0x2d0], 1
cmp byte [ebp - 0x2d1], 0
jne 0x4185d6
mov edi, dword [ebp - 0x2d0]
mov edx, dword [str._ngsrv_ngslotd.exe__t]
mov dword [edi], edx
mov eax, dword [0x454700]
mov dword [edi + 4], eax
mov ecx, dword [0x454704]
mov dword [edi + 8], ecx
mov edx, dword [0x454708]
mov dword [edi + 0xc], edx
mov eax, dword [0x45470c]
mov dword [edi + 0x10], eax
mov cx, word [0x454710]
mov word [edi + 0x14], cx
lea edx, [ebp - 0x168]
push edx
lea eax, [ebp - 0x2bc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x274]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x418684
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.004052a0
mov eax, dword [ebp - 0x2c0]
jmp 0x4188f0
push 0xffffffffffffffff
mov edx, dword [ebp - 0x168]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4186b4
call fcn.00418330
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x104
push 0
lea edx, [ebp - 0x274]
push edx
call fcn.0043b290
add esp, 0xc
lea eax, [ebp - 0x274]
push eax
mov ecx, dword [ebp - 0x2cc]
add ecx, 0x178
call fcn.00406590
lea ecx, [ebp - 0x274]
add ecx, 0xffffffff
mov dword [ebp - 0x2d8], ecx
mov edx, dword [ebp - 0x2d8]
mov al, byte [edx + 1]
mov byte [ebp - 0x2d9], al
add dword [ebp - 0x2d8], 1
cmp byte [ebp - 0x2d9], 0
jne 0x4186fc
mov edi, dword [ebp - 0x2d8]
mov ecx, dword [str._ngsrv_ngslotd.exe__u]
mov dword [edi], ecx
mov edx, dword [0x454718]
mov dword [edi + 4], edx
mov eax, dword [0x45471c]
mov dword [edi + 8], eax
mov ecx, dword [0x454720]
mov dword [edi + 0xc], ecx
mov edx, dword [0x454724]
mov dword [edi + 0x10], edx
mov ax, word [0x454728]
mov word [edi + 0x14], ax
push 0x44
push 0
lea ecx, [ebp - 0x2bc]
push ecx
call fcn.0043b290
add esp, 0xc
mov dword [ebp - 0x2bc], 0x44
xor edx, edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x15c], edx
lea eax, [ebp - 0x168]
push eax
lea ecx, [ebp - 0x2bc]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x274]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4187e1
mov dword [ebp - 0x2c4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.004052a0
mov eax, dword [ebp - 0x2c4]
jmp 0x4188f0
push 0xffffffffffffffff
mov eax, dword [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x168]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x164]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x104
push 0
lea eax, [ebp - 0x11c]
push eax
call fcn.0043b290
add esp, 0xc
push str.ngslotd.exe
lea ecx, [ebp - 0x158]
call fcn.00404840
mov byte [ebp - 4], 1
push 0
push 0x2e
lea ecx, [ebp - 0x158]
call fcn.00419de0
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xffffffff
je 0x41887a
mov ecx, dword [ebp - 0x120]
push ecx
push str.ngslotd.exe
lea edx, [ebp - 0x11c]
push edx
call fcn.0043cf50
add esp, 0xc
jmp 0x41889a
lea ecx, [ebp - 0x158]
call fcn.004048a0
push eax
push str.ngslotd.exe
lea eax, [ebp - 0x11c]
push eax
call fcn.0043cf50
add esp, 0xc
push 1
lea ecx, [ebp - 0x11c]
push ecx
mov ecx, dword [ebp - 0x2cc]
add ecx, 0x178
call fcn.00405640
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x158]
call fcn.004052a0
mov dword [ebp - 0x2c8], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.004052a0
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004381fb
mov esp, ebp
pop ebp
ret 4