Function at 0x11158490
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111e7f84
mov eax, dword fs:[0]
push eax
sub esp, 0x690
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x658]
push eax
call fcn.11144330
mov edi, dword [ebp + 0xc]
add esp, 4
test eax, eax
je 0x1115852f
test edi, edi
je 0x11158501
mov eax, dword [esi + 0xc78]
test eax, eax
jne 0x11158528
push str.NSLockExit
push eax
push 1
lea ecx, [ebp - 0x658]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0xc78], eax
jmp 0x1115852f
mov eax, dword [esi + 0xc7c]
test eax, eax
jne 0x11158528
push str.NSBlankExit
push eax
push 1
lea edx, [ebp - 0x658]
push edx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0xc7c], eax
jmp 0x1115852f
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
push 0x44
push eax
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x638], eax
mov dword [ebp - 0x634], eax
mov dword [ebp - 0x630], eax
lea eax, [ebp - 0x69c]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x207
lea edx, [ebp - 0x41e]
push edx
mov ecx, 0x22
push 0
mov dword [ebp - 0x69c], 0x44
mov dword [ebp - 0x694], str.Winsta0NSLock
mov dword [ebp - 0x670], 0x80
mov word [ebp - 0x420], cx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test edi, edi
je 0x11158601
mov ecx, dword [0x1127aa68]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push 0
push 0x208
lea edx, [ebp - 0x628]
push edx
push str.ImageFile
push str.Client
call eax
lea eax, [ebp - 0x420]
lea edx, [eax + 2]
jmp 0x111585d0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x111585d0
sub eax, edx
lea ecx, [ebp - 0x628]
push ecx
sar eax, 1
lea edx, [ebp + eax*2 - 0x420]
push str.___L__s_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x111586f3
push 0x100
lea ecx, [ebp - 0x64c]
call fcn.1113c0e0
push 0x218
mov dword [ebp - 4], 0
call fcn.111709c0
add esp, 4
mov dword [ebp - 0x62c], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x11158644
push 0
push 0
push 0
mov ecx, eax
call fcn.111a9c00
mov esi, eax
jmp 0x11158646
xor esi, esi
mov dword [ebp - 0x62c], esi
push 1
lea eax, [ebp - 0x64c]
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.111a34d0
lea eax, [ebp - 0x420]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x11158670
sub eax, edx
mov edx, dword [ebp - 0x64c]
sar eax, 1
mov edi, eax
mov eax, dword [edx]
lea ecx, [ebp - 0x64c]
call eax
test al, al
jne 0x111586ac
push 0x261
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
add esp, 0xc
mov ecx, dword [ebp - 0x640]
push ecx
lea edx, [ebp + edi*2 - 0x420]
push str.___B__s_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov byte [ebp - 4], 0
test esi, esi
je 0x111586e1
mov ecx, esi
call fcn.111a3180
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [ebp - 0x64c]
mov dword [ebp - 4], 0xffffffff
call fcn.1113cd80
lea eax, [ebp - 0x63c]
push eax
lea ecx, [ebp - 0x69c]
push ecx
push 0
push 0
push 0x8000
push 0
push 0
push 0
lea edx, [ebp - 0x420]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1115873d
mov eax, dword [ebp - 0x63c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [ebp - 0x638]
push ecx
call esi
jmp 0x11158751
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_launching_lockApp__e_d_n
call fcn.111bd7b0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret