Function at 0x416d30
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0xffffffffffffffff
push 0x510d01
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x2cc], eax
push ebp
push esi
push edi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0x2e0]
mov dword fs:[0], eax
cmp byte [0x571bc5], 0
mov ebp, dword [esp + 0x2f0]
jne 0x417083
call fcn.0041d570
cmp byte [eax + 0x96a], 0
je 0x417083
cmp byte [0x571bc5], 0
jne 0x417083
xor esi, esi
cmp word [ebp], si
je 0x417083
call fcn.0041d570
cmp byte [eax + 0x96a], 0
je 0x417083
cmp byte [0x571bc5], 0
jne 0x417083
call fcn.0041d570
cmp byte [eax + 0x128], 0
je 0x416ddb
add eax, 0x18
jmp 0x416dde
mov eax, dword [eax + 0x14]
add eax, 4
cmp eax, esi
je 0x417087
cmp word [eax], si
je 0x417087
push esi
push esi
push esi
push esi
push str.SGTool.exe
push eax
lea ecx, [esp + 0xa4]
call fcn.0041dc60
mov dword [esp + 0x2e8], esi
mov dword [esp + 0x18], vtable.t_errorList.0
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], vtable.t_errorList::t_mem.0
mov esi, ebx
lea edi, [esp + 0x18]
mov byte [esp + 0x2e8], 1
call fcn.00424c20
test al, al
jne 0x416e68
push 0x549734
mov ecx, ebx
call fcn.004014b0
lea ecx, [esp + 0x18]
call fcn.00424be0
lea ecx, [esp + 0x8c]
call fcn.00417650
jmp 0x417093
mov eax, dword [esp + 0x2f4]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov edi, ebp
mov esi, ebx
call fcn.00424d40
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebp, eax
test ebp, ebp
jne 0x416e99
push 0x549750
jmp 0x416e47
push 0x10000000
push 6
push ebp
call fcn.00424180
add esp, 0xc
push 6
push ebp
call fcn.004241d0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 8
push 0
push 1
push 0x10000000
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], 0
call esi
push eax
push ebp
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x416ef2
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x549764
jmp 0x416e47
push 0x40
lea eax, [esp + 0x4c]
push 0
push eax
mov dword [esp + 0x50], 0x44
call fcn.004f2770
xor eax, eax
add esp, 0xc
lea ecx, [esp + 0x1b4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call fcn.004174b0
push str.__hevent
push str.__list
push str.___appiderrorreport
push 0x54644c
lea ecx, [esp + 0x9c]
mov byte [esp + 0x2f8], 2
call fcn.00417d60
push eax
push 0x54644c
lea ecx, [esp + 0x1cc]
call fcn.00417d40
mov ecx, eax
call fcn.00417d40
mov ecx, eax
call fcn.00417d40
mov ecx, eax
call fcn.00417d40
mov ecx, eax
call fcn.00417d40
mov ecx, eax
call fcn.00417d40
mov esi, eax
mov eax, dword [esp + 0x14]
call fcn.00417d20
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x48]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
mov ecx, 0x104
lea eax, [esp + 0x1d4]
call fcn.00417b00
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x417020
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
lea edi, [esp + 0x1b4]
call fcn.00417b30
lea ecx, [esp + 0x8c]
call fcn.00417d60
push eax
push str._T_vz1Y_
mov ecx, ebx
call fcn.004170c0
mov ecx, eax
call fcn.00417d40
mov ecx, eax
call fcn.00417d40
push 0x549734
mov ecx, ebx
call fcn.004014b0
mov ecx, edi
call fcn.00417650
jmp 0x416e4e
lea edi, [esp + 0x1b4]
call fcn.00417b30
mov ecx, dword [esp + 0x2c]
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x44]
push edx
push 2
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ebp
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x30]
push ecx
call esi
push ebp
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
mov ecx, edi
call fcn.00417650
lea ecx, [esp + 0x18]
call fcn.00424be0
lea ecx, [esp + 0x8c]
call fcn.00417650
mov al, 1
jmp 0x417095
push 0x549708
mov ecx, ebx
call fcn.004014b0
xor al, al
mov ecx, dword [esp + 0x2e0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x2cc]
xor ecx, esp
call fcn.004ecddb
add esp, 0x2dc
ret