Function at 0x419340
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6b4
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
push 0x63e
mov ebx, edx
mov edi, ecx
lea edx, [ebp - 0x646]
xor ecx, ecx
push esi
push edx
mov dword [ebp - 0x64c], eax
mov dword [ebp - 0x650], esi
mov word [ebp - 0x648], cx
call fcn.00428450
add esp, 0xc
push 0x38
lea eax, [ebp - 0x68c]
push esi
push eax
call fcn.00428450
mov ecx, dword [ebp - 0x64c]
add esp, 0xc
push str.GetNativeSystemInfo
push str.kernel32
mov dword [ebp - 0x690], 0x3c
mov dword [ebp - 0x68c], 0x40
mov dword [ebp - 0x688], esi
mov dword [ebp - 0x684], esi
mov dword [ebp - 0x680], ecx
mov dword [ebp - 0x67c], edi
mov dword [ebp - 0x678], ebx
mov dword [ebp - 0x674], esi
mov dword [ebp - 0x670], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
cmp eax, esi
je 0x419405
lea edx, [ebp - 0x6b4]
push edx
call eax
movzx eax, word [ebp - 0x6b4]
cmp eax, esi
je 0x419489
cmp eax, 9
jne 0x419489
push str.Kernel32.dll
mov dword [ebp - 0x654], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, esi
je 0x419448
push str.Wow64DisableWow64FsRedirection
push edi
call ebx
lea ecx, [ebp - 0x654]
push ecx
call eax
push edi
test eax, eax
jne 0x419451
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x690]
push eax
jmp 0x419490
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 0x690]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, esi
je 0x419496
push str.Wow64RevertWow64FsRedirection
push edi
call ebx
push esi
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x419496
lea ecx, [ebp - 0x690]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x658]
imul eax, eax, 0x3e8
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp edi, esi
je 0x419543
cmp edi, 0x102
je 0x419505
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x64c]
push edi
push eax
lea ecx, [ebp - 0x648]
push str._t_t_tRunCommand__s__Exception_Result:_lu__ErrorCode:_lu___Command_Fail___
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x648]
add esp, 0x14
push edx
call fcn.00406870
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x64c]
push eax
lea ecx, [ebp - 0x648]
push str._t_t_tRunCommand__s__TimeOut__Command_Fail___
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x648]
add esp, 0xc
push edx
call fcn.00406870
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x658]
lea eax, [ebp - 0x650]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x41959d
mov edx, dword [ebp - 0x64c]
push edx
lea eax, [ebp - 0x648]
push str._t_t_tRunCommand__s__Success____but_Handle_GetExitCodeProcess_failure.
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x648]
add esp, 0xc
push ecx
call fcn.00406870
mov eax, dword [ebp - 0x650]
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x650]
mov eax, dword [ebp - 0x64c]
push edx
push eax
lea ecx, [ebp - 0x648]
push str._t_t_tRunCommand__s__Success__d____
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x648]
push edx
call fcn.00406870
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x650]
add esp, 0x14
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004217a4
mov esp, ebp
pop ebp
ret