Function at 0x668b04
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
sub esp, 0x6c
mov eax, 0x6894d8
call fcn.0062921c
sub esp, 0x218
push ebx
lea eax, [ebp + 0x6f]
mov byte [ebp + 0x6f], 0
push eax
lea eax, [ebp + 0x1c]
mov ebx, ecx
push eax
call fcn.006683f5
and dword [ebp - 4], 0
cmp byte [ebp + 0x6f], 0
jne 0x668b3d
xor bl, bl
jmp 0x66907e
push esi
push edi
push 0x44
pop esi
push esi
lea eax, [ebp - 0xb0]
push 0
push eax
call fcn.0062e010
xor eax, eax
mov dword [ebp - 0xb0], esi
lea edi, [ebp + 0xc]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov esi, eax
xor edi, edi
lea eax, [ebp - 0xc4]
push edi
mov dword [ebp + 0x50], eax
lea eax, [ebp + 0x50]
push eax
push 1
push str.S:_ML__NW___LW_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
mov eax, dword [ebp + 0x50]
push edi
push edi
push 6
mov dword [ebp + 4], eax
mov dword [ebp], 0xc
mov dword [ebp + 8], 1
call fcn.0066783d
neg eax
lea ecx, [ebp - 0x224]
push 1
sbb edi, edi
lea eax, [ebp]
push 3
and edi, eax
call fcn.004950b0
push dword [0x76887c]
mov ecx, 0x768878
mov byte [ebp - 4], 1
push dword [0x768878]
push 0x7a7ce0
call fcn.006665c3
push eax
mov eax, 0x704a70
push eax
push ebx
push eax
push esi
push eax
mov esi, 0x768880
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.0048de3e
push eax
call fcn.00423ddb
mov ecx, eax
call fcn.00666ea3
push eax
call fcn.00423ddb
mov ecx, eax
call fcn.00666fa8
push eax
call fcn.00423ddb
mov ecx, eax
call fcn.0048dff0
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x224]
call fcn.004b4eed
mov byte [ebp - 4], 2
push 0x78
call fcn.006291e1
pop ecx
mov dword [ebp + 0x4c], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x668c59
push edi
push ebx
push 0x667e8c
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, eax
call fcn.00669d99
jmp 0x668c5b
xor eax, eax
mov ecx, dword [ebx + 0x80]
mov byte [ebp - 4], 2
mov dword [ebx + 0x80], eax
test ecx, ecx
je 0x668c75
mov eax, dword [ecx]
push 1
call dword [eax]
push 1
push 3
lea ecx, [ebp - 0x174]
call fcn.004950b0
push esi
mov eax, 0x68e738
mov byte [ebp - 4], 4
push eax
push 0x768898
push eax
lea eax, [ebp - 0x6c]
push eax
push 0x68f8f4
lea eax, [ebp + 0x1c]
push eax
push 0x68f8f0
lea eax, [ebp - 0x164]
push eax
call fcn.00423ddb
push eax
call fcn.0048de3e
push eax
call fcn.00423ddb
push eax
call fcn.0048de3e
push eax
call fcn.00423ddb
push eax
call fcn.0048de3e
push eax
call fcn.00423ddb
push eax
call fcn.0048de3e
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x174]
call fcn.004b4eed
xor eax, eax
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x24], al
push eax
push eax
push 6
mov byte [ebp - 4], 6
call fcn.0066783d
test eax, eax
je 0x668dba
call fcn.00667163
movzx esi, byte [0x76d119]
lea ecx, [ebp + 0x54]
neg esi
push str.lowIntegrity_created
sbb esi, esi
and esi, eax
call fcn.0040a58f
test esi, esi
mov byte [ebp - 4], 7
push 1
setne al
movzx eax, al
push eax
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.0048ff08
push 0xffffffffffffffff
xor edi, edi
mov byte [ebp - 4], 8
push edi
push eax
lea ecx, [ebp - 0x24]
call fcn.0040a669
push edi
push 1
lea ecx, [ebp + 0x34]
call fcn.0040abbf
push edi
push 1
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 6
call fcn.0040abbf
cmp dword [ebp - 0x28], 8
mov ecx, dword [ebp - 0x3c]
jae 0x668d83
lea ecx, [ebp - 0x3c]
cmp dword [ebp + 0x30], 8
mov eax, dword [ebp + 0x1c]
jae 0x668d8f
lea eax, [ebp + 0x1c]
lea edx, [ebp + 0xc]
push edx
lea edx, [ebp - 0xb0]
push edx
xor edx, edx
push edx
push edx
push edx
push edx
push edx
push edx
push ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
test esi, esi
je 0x668def
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x668def
cmp dword [ebp - 0x28], 8
mov ecx, dword [ebp - 0x3c]
jae 0x668dc6
lea ecx, [ebp - 0x3c]
cmp dword [ebp + 0x30], 8
mov eax, dword [ebp + 0x1c]
jae 0x668dd2
lea eax, [ebp + 0x1c]
lea edx, [ebp + 0xc]
push edx
lea edx, [ebp - 0xb0]
push edx
xor edx, edx
push edx
push edx
push edx
push edx
push edx
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov edi, eax
test edi, edi
jne 0x668ecf
cmp dword [ebp + 0x30], 8
mov eax, dword [ebp + 0x1c]
jae 0x668e03
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push str.exe_exist
lea ecx, [ebp + 0x54]
mov esi, eax
call fcn.0040a58f
push 1
push esi
lea eax, [ebp + 0x54]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.005f09d6
push 0xffffffffffffffff
xor ebx, ebx
mov byte [ebp - 4], 0xa
push ebx
push eax
lea ecx, [ebp - 0x24]
call fcn.0040a669
push ebx
push 1
lea ecx, [ebp + 0x34]
call fcn.0040abbf
push ebx
push 1
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 6
call fcn.0040abbf
push 0x6aacec
lea ecx, [ebp + 0x54]
call fcn.0040a58f
push ebx
push str.Unable_to_create_remote_ie_process
lea eax, [ebp + 0x54]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.004652bb
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xc
call fcn.0040a669
push ebx
push 1
lea ecx, [ebp + 0x34]
call fcn.0040abbf
push ebx
push 1
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 6
call fcn.0040abbf
push str.remote_ieprocess
lea ecx, [ebp + 0x54]
call fcn.0040a58f
push ebx
push ebx
push ebx
lea eax, [ebp + 0x54]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x24]
push eax
push 0x2c
call fcn.004827b0
jmp 0x669038
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0x18]
push ecx
lea ecx, [ebx + 0x28]
mov dword [ebx + 8], eax
call fcn.006699cc
mov ecx, dword [ebx + 0x80]
test ecx, ecx
je 0x668f09
push 0x7530
call fcn.00669fe3
test al, al
je 0x668f09
mov bl, 1
jmp 0x669043
and dword [ebp + 0x64], 0
mov dword [ebp + 0x68], 0xf
mov byte [ebp + 0x54], 0
cmp dword [ebx + 0x80], 0
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 0xe
jne 0x668f54
push str.pipe_error
call fcn.0040a58f
xor ebx, ebx
mov byte [ebp - 4], 0xf
push ebx
push str.No_pipeServer_available
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.004652bb
mov byte [ebp - 4], 0x10
jmp 0x668fe4
push str.timeout_error
call fcn.0040a58f
push 1
push str.timeout_on_waiting_for_remote_ie_process_to_connect
lea eax, [ebp + 0x34]
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.004652bb
push 0xffffffffffffffff
xor ebx, ebx
mov byte [ebp - 4], 0x12
push ebx
push eax
lea ecx, [ebp + 0x54]
call fcn.0040a669
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.0040abbf
push ebx
push 1
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 0xe
call fcn.0040abbf
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
je 0x66900a
push str.ie_alive
lea ecx, [ebp + 0x34]
call fcn.0040a58f
cmp dword [ebp + 0x4c], 0x103
push ebx
sete al
mov byte [ebp - 4], 0x13
movzx eax, al
push eax
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0048ff08
mov byte [ebp - 4], 0x14
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x54]
call fcn.0040a669
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.0040abbf
push ebx
push 1
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 0xe
call fcn.0040abbf
push str.remote_ieprocess
lea ecx, [ebp + 0x34]
call fcn.0040a58f
push ebx
push ebx
push ebx
lea eax, [ebp + 0x34]
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp + 0x54]
push eax
push 0x2c
call fcn.004827b0
push ebx
push 1
lea ecx, [ebp + 0x34]
call fcn.0040abbf
push ebx
push 1
lea ecx, [ebp + 0x54]
call fcn.0040abbf
xor esi, esi
lea ecx, [ebp - 0x24]
push esi
push 1
call fcn.0040abbf
push esi
push 1
lea ecx, [ebp - 0x3c]
call fcn.0042386b
lea ecx, [ebp - 0x174]
call fcn.00498203
push esi
push 1
lea ecx, [ebp - 0x6c]
call fcn.0042386b
lea ecx, [ebp - 0x224]
call fcn.00498203
pop edi
pop esi
push 0
push 1
lea ecx, [ebp + 0x1c]
call fcn.0042386b
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
lea esp, [ebp + 0x70]
pop ebp
ret