Function at 0x40def0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4390e0
mov eax, dword fs:[0]
push eax
sub esp, 0xa38
mov eax, dword [0x449314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0x800
mov dword [ebp - 0xa44], eax
lea eax, [ebp - 0xa18]
push 0
push eax
mov dword [ebp - 0xa40], esi
mov dword [ebp - 0xa1c], ebx
call sub.VCRUNTIME140.dll_memset
push 0x104
lea eax, [ebp - 0x114]
mov byte [ebp - 0xa1d], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x104
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x24
mov dword [ebp - 0xa30], 0
mov dword [ebp - 0xa2c], 0
mov dword [ebp - 0xa28], 0
push 0
push 0
push 0x104
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movzx eax, word [esi]
add eax, esi
mov dword [ebp - 0xa38], eax
lea eax, [ebp - 0xa30]
push eax
call fcn.0040d290
mov ebx, dword [ebp - 0xa30]
test eax, eax
je 0x40e2be
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x40e022
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x40e022
test byte [ecx + 8], 2
je 0x40e022
cmp byte [ecx + 0xf], 9
jb 0x40e022
push 0
push 0x7b
push 0x43d7ec
push 0x2b
push edx
push esi
call fcn.0041bd20
mov ecx, dword [0x449ff8]
add esp, 0x18
mov edx, dword [ebp - 0xa2c]
xor eax, eax
sub edx, ebx
mov dword [ebp - 0xa34], eax
sar edx, 2
mov dword [ebp - 0xa3c], edx
test edx, edx
je 0x40e2fe
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
nop dword [eax]
cmp edx, eax
jbe 0x40e54b
mov esi, dword [ebx + eax*4]
mov dword [ebp - 0xa24], esi
test ecx, ecx
je 0x40e0c6
mov edi, dword [ecx]
mov eax, edi
mov ebx, dword [ecx + 4]
or eax, ebx
je 0x40e0c0
test byte [ecx + 8], 2
je 0x40e0c0
cmp byte [ecx + 0xf], 9
jb 0x40e0c0
mov edx, dword [esi + 0xc]
test edx, edx
je 0x40e09a
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e088
sub ecx, esi
mov esi, dword [ebp - 0xa24]
inc ecx
jmp 0x40e09f
mov ecx, 5
push 0
push ecx
test edx, edx
mov eax, 0x43cc84
cmovne eax, edx
push eax
push 0x7c
push 0x43d7ec
push 0x2b
push ebx
push edi
call fcn.0041bd20
add esp, 0x20
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x40e0d7
mov ebx, dword [ebp - 0xa24]
xor esi, esi
jmp 0x40e0ed
push 0x104
push eax
call edi
mov ebx, dword [ebp - 0xa24]
mov esi, eax
add esp, 8
mov eax, dword [ebx + 0xc]
push eax
lea eax, [ebp - 0x114]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
push 0x104
push str.___Citrix_Workspace
call edi
mov ecx, esi
add esp, 0x14
sub ecx, eax
cmp ecx, esi
jae 0x40e139
nop word [eax + eax]
cmp ecx, 0x104
jae 0x40e546
mov byte [ebp + ecx - 0x114], 0
inc ecx
cmp ecx, esi
jb 0x40e120
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x40e207
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x40e1ce
mov edi, dword [ecx]
mov eax, edi
mov ebx, dword [ecx + 4]
or eax, ebx
je 0x40e1c8
test byte [ecx + 8], 2
je 0x40e1c8
cmp byte [ecx + 0xf], 9
jb 0x40e1c8
lea ecx, [ebp - 0x218]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e182
sub ecx, edx
lea edx, [ecx + 1]
lea ecx, [ebp - 0x114]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e197
push 0
push edx
sub ecx, esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x114]
push eax
push 0x7e
push 0x43d7ec
push 0x2b
push ebx
push edi
call fcn.0041bd20
add esp, 0x28
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
push dword [ebp - 0xa24]
push 1
call sub.CCMSDK.dll_CCMFreeICASession_V2
mov eax, dword [ebp - 0xa34]
mov edx, dword [ebp - 0xa3c]
inc eax
mov ecx, dword [0x449ff8]
mov dword [ebp - 0xa34], eax
cmp eax, edx
jae 0x40e2fe
mov ebx, dword [ebp - 0xa30]
jmp 0x40e050
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x40e25a
mov edx, dword [ecx]
mov eax, edx
mov esi, dword [ecx + 4]
or eax, esi
je 0x40e25a
test byte [ecx + 8], 2
je 0x40e25a
cmp byte [ecx + 0xf], 9
jb 0x40e25a
lea ecx, [ebp - 0x114]
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e231
sub ecx, edi
push 0
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x114]
push eax
push 0x7d
push 0x43d7ec
push 0x2b
push esi
push edx
call fcn.0041bd20
add esp, 0x20
push dword [ebx]
lea eax, [ebp - 0xa1d]
push eax
push dword [ebp - 0xa40]
call fcn.004141e0
mov ebx, eax
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x40e4e7
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x40e4e7
test byte [ecx + 8], 2
je 0x40e4e7
cmp byte [ecx + 0xf], 9
jb 0x40e4e7
push 0
push 0x82
push 0x43d7ec
push 0x2b
push edx
push esi
call fcn.0041bd20
add esp, 0x18
jmp 0x40e4e7
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x40e3ad
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x40e2fe
test byte [ecx + 8], 2
je 0x40e2fe
cmp byte [ecx + 0xf], 9
jb 0x40e2fe
push 0
push 0x7f
push 0x43d7ec
push 0x2b
push edx
push esi
call fcn.0041bd20
mov ecx, dword [0x449ff8]
add esp, 0x18
test ecx, ecx
je 0x40e3ad
mov esi, dword [ecx]
mov eax, esi
mov edi, dword [ecx + 4]
or eax, edi
je 0x40e3ad
test byte [ecx + 8], 2
je 0x40e3ad
cmp byte [ecx + 0xf], 9
jb 0x40e3ad
mov eax, dword [ebp - 0xa1c]
test eax, eax
je 0x40e381
movzx edx, word [eax]
test dx, dx
je 0x40e369
mov ecx, eax
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e340
sub ecx, ebx
mov eax, str._NULL_
mov ebx, dword [ebp - 0xa1c]
sar ecx, 1
test dx, dx
cmovne eax, ebx
lea ecx, [ecx*2 + 2]
jmp 0x40e391
mov ebx, dword [ebp - 0xa1c]
test dx, dx
mov eax, str._NULL_
mov ecx, 0xe
cmovne eax, ebx
jmp 0x40e391
mov ebx, dword [ebp - 0xa1c]
mov ecx, 0xa
mov eax, str.NULL
push 0
push ecx
push eax
push 0x80
push 0x43d7ec
push 0x2b
push edi
push esi
call fcn.0041bd20
add esp, 0x20
jmp 0x40e3b3
mov ebx, dword [ebp - 0xa1c]
push dword [ebp - 0xa44]
lea eax, [ebp - 0xa18]
push str._sSelfServicePluginSelfService.exe
push 0x400
push eax
call fcn.0041c2a0
mov ecx, ebx
add esp, 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e3d7
sub ecx, edx
mov edx, dword [ebp - 0xa38]
sar ecx, 1
lea esi, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40e3f0
sub edx, esi
lea edi, [ecx + 0x10]
sar edx, 1
add edi, edx
lea eax, [edi*2 + 2]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x40e464
mov edx, dword [ebp - 0xa30]
test edx, edx
je 0x40e45a
mov ecx, dword [ebp - 0xa28]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x40e450
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40e450
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00435eb6
add esp, 8
mov eax, 4
jmp 0x40e528
push dword [ebp - 0xa38]
push ebx
push str._qlaunch___s___s
push edi
push esi
call fcn.0041c2a0
add esp, 0x14
lea eax, [ebp - 0xa18]
push 1
push 0
push esi
push eax
push str.Open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x40e4d0
mov ebx, dword [ecx]
mov eax, ebx
mov edx, dword [ecx + 4]
or eax, edx
je 0x40e4d0
test byte [ecx + 8], 2
je 0x40e4d0
cmp byte [ecx + 0xf], 9
jb 0x40e4d0
push edi
push esi
lea eax, [ebp - 0xa18]
push eax
push 0x43d7ec
push 0x81
push edx
push ebx
call fcn.0041c000
xor eax, eax
mov ebx, 0xa
cmp edi, 0x20
push esi
cmovg ebx, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov edx, dword [ebp - 0xa30]
test edx, edx
je 0x40e526
mov ecx, dword [ebp - 0xa28]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x40e51c
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40e51c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00435eb6
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043624e
mov esp, ebp
pop ebp
ret 0xc
call fcn.0043652e
call fcn.00416030
int3