Function at 0x40cb02
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0x2bc
mov eax, 0x5a1193
call fcn.0058141a
call fcn.0041e81f
test eax, eax
jne 0x40ce8d
call fcn.0041e986
test eax, eax
jne 0x40ce8d
call fcn.0041e8e4
test eax, eax
jne 0x40ce8d
call fcn.00426899
xor esi, esi
test eax, eax
je 0x40cdca
mov edi, 0x104
lea eax, [ebp - 0x11c]
push edi
push esi
push eax
call fcn.005838b0
add esp, 0xc
lea ecx, [ebp - 0x11c]
call fcn.0041d882
push edi
lea eax, [ebp - 0x224]
push esi
push eax
call fcn.005838b0
add esp, 0xc
lea ecx, [ebp - 0x224]
call fcn.0041d882
lea eax, [ebp - 0x11c]
push str._sassteam.exe
push eax
call fcn.00589e70
push 0x38
lea eax, [ebp - 0x2c4]
push esi
push eax
call fcn.005838b0
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x2c8], 0x3c
mov dword [ebp - 0x2b8], eax
add esp, 0x14
lea eax, [ebp - 0x224]
mov dword [ebp - 0x2c4], 0x40
mov dword [ebp - 0x2b0], eax
lea eax, [ebp - 0x2c8]
mov dword [ebp - 0x2c0], esi
push eax
mov dword [ebp - 0x2bc], esi
mov dword [ebp - 0x2b4], 0x5e66b6
mov dword [ebp - 0x2ac], esi
mov dword [ebp - 0x2a8], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp dword [ebp - 0x290], esi
je 0x40cc18
push 0xffffffffffffffff
push dword [ebp - 0x290]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [0x623a70], esi
mov dword [0x623a6c], esi
mov dword [0x623a68], esi
mov dword [0x623a64], esi
mov dword [0x623a60], esi
call fcn.0041e81f
test eax, eax
jne 0x40ce8d
call fcn.0041e986
test eax, eax
jne 0x40ce8d
call fcn.0041e8e4
test eax, eax
jne 0x40ce8d
call fcn.0041e5f7
test eax, eax
jne 0x40ce7c
call fcn.0041e986
test eax, eax
jne 0x40ce7c
call fcn.0041e8e4
test eax, eax
jne 0x40ce7c
mov edi, 0x5e7de4
mov edx, 0x5eb78c
push edi
push 1
mov ecx, edi
call fcn.00434e91
test eax, eax
jne 0x40cd4f
cmp dword [0x624018], esi
je 0x40cd4f
mov edx, str.Disable_features_which_require_activation_
lea ecx, [ebp - 0x254]
call fcn.00429b1a
mov ebx, eax
mov edx, str.Do_you_want_to_disable_the_option_to_control_Secondary_KVMs_from_this_computer_
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x23c]
call fcn.00429b1a
mov byte [ebp - 4], 1
cmp dword [ebx + 0x14], 8
jb 0x40cce8
mov ebx, dword [ebx]
cmp dword [eax + 0x14], 8
jb 0x40ccf0
mov eax, dword [eax]
push 0x134
push ebx
mov edx, eax
call fcn.004340ee
cmp eax, 6
lea ecx, [ebp - 0x23c]
push esi
push 1
sete bl
call fcn.00403bb4
lea ecx, [ebp - 0x254]
push esi
push 1
call fcn.00403bb4
test bl, bl
je 0x40cd49
push edi
mov esi, 0x5e66b4
mov edx, str.AllowSecondaryKVM
push esi
mov ecx, edi
call fcn.0042b829
push edi
push esi
mov edx, 0x5eb78c
mov ecx, edi
call fcn.0042b829
jmp 0x40ce8d
push esi
call fcn.0058bc3e
mov edx, str.Revert_to_secondary_mode_
lea ecx, [ebp - 0x23c]
call fcn.00429b1a
mov ebx, eax
mov edx, str.Unable_to_activate_this_computer.__Do_you_want_to_make_this_computer_act_as_a_secondary_instead_
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x254]
call fcn.00429b1a
mov byte [ebp - 4], 3
cmp dword [ebx + 0x14], 8
jb 0x40cd84
mov ebx, dword [ebx]
cmp dword [eax + 0x14], 8
jb 0x40cd8c
mov eax, dword [eax]
push 0x134
push ebx
mov edx, eax
call fcn.004340ee
cmp eax, 6
lea ecx, [ebp - 0x254]
push esi
push 1
sete bl
call fcn.00403bb4
lea ecx, [ebp - 0x23c]
push esi
push 1
call fcn.00403bb4
test bl, bl
je 0x40cd49
push edi
push 0x5e66b4
jmp 0x40cd38
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x40ce3a
sub esp, 0xc
call fcn.0040c99e
push esi
mov dword [ebp - 0x288], eax
call fcn.0058b8b4
pop ecx
mov ecx, edx
mov ebx, eax
mov edx, dword [ebp - 0x288]
sub eax, edx
mov dword [ebp - 0x28c], ecx
sbb ecx, esi
cmp ecx, esi
jg 0x40ce1e
jl 0x40ce07
cmp eax, 0xe10
jae 0x40ce1e
cmp esi, dword [ebp - 0x28c]
jg 0x40ce1e
jl 0x40ce15
cmp edx, ebx
ja 0x40ce1e
call fcn.0041e5f7
test eax, eax
jne 0x40ce8d
push 0xa
lea eax, [ebp - 0x11c]
push eax
push ebx
call fcn.0058b78d
pop ecx
lea eax, [ebp - 0x11c]
push eax
call fcn.0040c9eb
call fcn.0042939c
mov dword [0x623a70], esi
mov dword [0x623a6c], esi
mov dword [0x623a68], esi
mov dword [0x623a64], esi
mov dword [0x623a60], esi
call fcn.0041e5f7
test edi, edi
je 0x40ce98
test eax, eax
jne 0x40ce7c
call fcn.0041e986
test eax, eax
jne 0x40ce7c
call fcn.0041e8e4
test eax, eax
je 0x40ce8d
push dword [0x624060]
call dword [sym.imp.KERNEL32.DLL_SetEvent]
call fcn.00434c48
xor eax, eax
inc eax
call fcn.005813c4
ret 8
test eax, eax
jne 0x40ce7c
call fcn.0041e986
test eax, eax
jne 0x40ce7c
call fcn.0041e8e4
test eax, eax
jne 0x40ce7c
mov edi, 0x5e7de4
mov edx, 0x5eb78c
push edi
push 1
mov ecx, edi
call fcn.00434e91
test eax, eax
jne 0x40cf37
cmp dword [0x624018], esi
je 0x40cf37
mov edx, str.Disable_features_which_require_activation_
lea ecx, [ebp - 0x23c]
call fcn.00429b1a
mov ebx, eax
mov edx, str.Do_you_want_to_disable_the_option_to_control_Secondary_KVMs_from_this_computer_
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x254]
call fcn.00429b1a
mov byte [ebp - 4], 5
cmp dword [ebx + 0x14], 8
jb 0x40cf03
mov ebx, dword [ebx]
cmp dword [eax + 0x14], 8
jb 0x40cf0b
mov eax, dword [eax]
push 0x134
push ebx
mov edx, eax
call fcn.004340ee
cmp eax, 6
lea ecx, [ebp - 0x254]
push esi
push 1
sete bl
call fcn.00403bb4
lea ecx, [ebp - 0x23c]
jmp 0x40cd17
mov edx, str.Revert_to_secondary_mode_
lea ecx, [ebp - 0x284]
call fcn.00429b1a
mov ebx, eax
mov edx, str.Do_you_want_to_make_this_computer_act_as_a_secondary_instead_
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x26c]
call fcn.00429b1a
mov byte [ebp - 4], 7
cmp dword [ebx + 0x14], 8
jb 0x40cf6c
mov ebx, dword [ebx]
cmp dword [eax + 0x14], 8
jb 0x40cf74
mov eax, dword [eax]
push 0x134
push ebx
mov edx, eax
call fcn.004340ee
cmp eax, 6
lea ecx, [ebp - 0x26c]
push esi
push 1
sete bl
call fcn.00403bb4
lea ecx, [ebp - 0x284]
jmp 0x40cdb3