Function at 0x40a400
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x40c4e9
mov eax, dword fs:[0]
push eax
sub esp, 0xa6c
mov eax, dword [0x41105c]
xor eax, esp
mov dword [esp + 0xa68], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x41105c]
xor eax, esp
push eax
lea eax, [esp + 0xa80]
mov dword fs:[0], eax
push 0xff
lea eax, [esp + 0x80]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edi, edi
cmp word [esp + 0x7c], bx
mov ebp, vtable.String.0
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], edi
je 0x40a480
lea edi, [esp + 0x7c]
lea eax, [esp + 0x3c]
call fcn.0040ac90
mov edi, dword [esp + 0x40]
lea edx, [esp + 0x3c]
lea esi, [esp + 0x6c]
mov dword [esp + 0xa88], ebx
call fcn.0040b1a0
cmp edi, ebx
je 0x40a4a1
push edi
call fcn.00401621
add esp, 4
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x68], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x60], ebx
mov byte [esp + 0xa88], 4
mov edi, 0x40ec4c
lea eax, [esp + 0x4c]
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x58], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x50], ebx
call fcn.0040ac90
lea ecx, [esp + 0x6c]
push ecx
lea eax, [esp + 0x50]
lea ecx, [esp + 0x20]
call fcn.00401190
push eax
call fcn.0040b220
mov byte [esp + 0x1f], al
mov eax, dword [esp + 0x24]
add esp, 4
cmp eax, ebx
mov dword [esp + 0x1c], ebp
je 0x40a51f
push eax
call fcn.00401621
add esp, 4
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x50]
cmp eax, ebx
je 0x40a530
push eax
call fcn.00401621
add esp, 4
cmp byte [esp + 0x1b], bl
je 0x40a6c3
call fcn.0040a070
test al, al
lea esi, [esp + 0x2c]
lea eax, [esp + 0x6c]
je 0x40a58b
push str.FetionFX.exe
call fcn.0040af60
mov eax, dword [eax + 4]
cmp eax, ebx
jne 0x40a561
mov eax, 0x40eb08
mov edi, eax
lea eax, [esp + 0x3c]
call fcn.0040ac90
mov eax, dword [esp + 0x30]
cmp eax, ebx
mov dword [esp + 0x2c], ebp
je 0x40a581
push eax
call fcn.00401621
add esp, 4
mov edi, 0x40ec84
jmp 0x40a706
push str.VmDotNet_
call fcn.0040af60
push eax
mov eax, 0x4120a0
lea ecx, [esp + 0x20]
call fcn.00401190
mov eax, dword [eax + 4]
cmp eax, ebx
jne 0x40a5b0
mov eax, 0x40eb08
mov edi, eax
lea eax, [esp + 0x6c]
call fcn.0040ac90
mov eax, dword [esp + 0x20]
cmp eax, ebx
mov dword [esp + 0x1c], ebp
je 0x40a5d4
push eax
call fcn.00401621
add esp, 4
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x30]
cmp eax, ebx
mov dword [esp + 0x2c], ebp
je 0x40a5e9
push eax
call fcn.00401621
add esp, 4
push str.FetionVM.exe
lea esi, [esp + 0x30]
lea eax, [esp + 0x70]
call fcn.0040af60
mov edi, dword [eax + 4]
cmp edi, ebx
jne 0x40a607
mov edi, 0x40eb08
lea eax, [esp + 0x3c]
call fcn.0040ac90
mov eax, dword [esp + 0x30]
cmp eax, ebx
mov dword [esp + 0x2c], ebp
je 0x40a625
push eax
call fcn.00401621
add esp, 4
mov edi, str.__AppStart
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
call fcn.0040ac90
mov edi, str._....FetionFX.exe_
lea eax, [esp + 0x4c]
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x58], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x50], ebx
call fcn.0040ac90
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
call fcn.00401190
mov eax, dword [eax + 4]
cmp eax, ebx
jne 0x40a67f
mov eax, 0x40eb08
mov edi, eax
lea eax, [esp + 0x5c]
call fcn.0040ac90
mov eax, dword [esp + 0x30]
cmp eax, ebx
mov dword [esp + 0x2c], ebp
je 0x40a6a3
push eax
call fcn.00401621
add esp, 4
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x50]
cmp eax, ebx
je 0x40a6b4
push eax
call fcn.00401621
add esp, 4
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x40a744
push eax
jmp 0x40a73c
push str._Fetion.exe
lea esi, [esp + 0x30]
lea eax, [esp + 0x70]
call fcn.0040af60
mov eax, dword [eax + 4]
cmp eax, ebx
jne 0x40a6e1
mov eax, 0x40eb08
mov edi, eax
lea eax, [esp + 0x3c]
call fcn.0040ac90
mov eax, dword [esp + 0x30]
cmp eax, ebx
mov dword [esp + 0x2c], ebp
je 0x40a701
push eax
call fcn.00401621
add esp, 4
mov edi, str._AppStart
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
call fcn.0040ac90
mov esi, dword [esp + 0x20]
cmp esi, ebx
mov edi, 0x40eb08
je 0x40a72e
mov edi, esi
lea eax, [esp + 0x5c]
call fcn.0040ac90
cmp esi, ebx
je 0x40a744
push esi
call fcn.00401621
add esp, 4
mov eax, dword [0x412094]
cmp eax, ebx
mov edx, 0x40eb08
je 0x40a754
mov edx, eax
mov edi, dword [esp + 0x60]
cmp edi, ebx
mov ecx, 0x40eb08
je 0x40a763
mov ecx, edi
mov ebp, dword [esp + 0x40]
cmp ebp, ebx
mov eax, 0x40eb08
je 0x40a772
mov eax, ebp
push edx
push ecx
push eax
lea eax, [esp + 0x288]
push str.__s___s__s
push eax
call fcn.004018ad
mov esi, dword [esp + 0x84]
add esp, 0x14
cmp esi, ebx
mov eax, 0x40eb08
je 0x40a79c
mov eax, esi
push 0x412cfc
push 0x412cb8
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x29c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
sete byte [esp + 0x1b]
cmp edi, ebx
je 0x40a7d0
push edi
call fcn.00401621
add esp, 4
cmp ebp, ebx
je 0x40a7dd
push ebp
call fcn.00401621
add esp, 4
cmp esi, ebx
je 0x40a7ea
push esi
call fcn.00401621
add esp, 4
mov al, byte [esp + 0x1b]
mov ecx, dword [esp + 0xa80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa68]
xor ecx, esp
call fcn.0040129b
add esp, 0xa78
ret