Function at 0x455ef0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539272
mov eax, dword fs:[0]
push eax
sub esp, 0x8ac
mov eax, dword [0x58c758]
xor eax, ebp
mov dword [ebp - 0x30], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8a8], ecx
push str.__disablesp_0
lea ecx, [ebp - 0x1c]
call fcn.00401e30
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041acc0
add esp, 8
mov byte [ebp - 4], 1
push str._safemon360tray.exe
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x880]
push edx
call fcn.00403700
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x880]
call fcn.0043e290
push eax
call fcn.00401c70
add esp, 4
test eax, eax
jne 0x455fcc
push 0x546078
push 0x58f750
call fcn.004045b0
add esp, 8
mov dword [ebp - 0x884], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x880]
call fcn.00401eb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401eb0
mov eax, dword [ebp - 0x884]
jmp 0x4562fd
push 0x546074
lea eax, [ebp - 0x880]
push eax
push 0x546074
lea ecx, [ebp - 0x888]
push ecx
call fcn.004283b0
add esp, 0xc
mov dword [ebp - 0x8ac], eax
mov edx, dword [ebp - 0x8ac]
mov dword [ebp - 0x8b0], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x8b0]
push eax
lea ecx, [ebp - 0x88c]
push ecx
call fcn.00403700
add esp, 0xc
mov dword [ebp - 0x8b4], eax
mov edx, dword [ebp - 0x8b4]
mov dword [ebp - 0x8b8], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x8b8]
push eax
lea ecx, [ebp - 0x880]
call fcn.00401970
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x88c]
call fcn.00401eb0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x888]
call fcn.00401eb0
push 0x44
push 0
lea ecx, [ebp - 0x87c]
push ecx
call fcn.004b0ac0
add esp, 0xc
mov dword [ebp - 0x87c], 0x44
push 0x10
push 0
lea edx, [ebp - 0x2c]
push edx
call fcn.004b0ac0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x834], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x832]
push ecx
call fcn.004b0ac0
add esp, 0xc
lea ecx, [ebp - 0x880]
call fcn.0043e290
push eax
lea edx, [ebp - 0x834]
push edx
call fcn.004b1f36
add esp, 8
lea ecx, [ebp - 0x1c]
call fcn.0043e290
push eax
lea eax, [ebp - 0x834]
push eax
call fcn.004b1f08
add esp, 8
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x87c]
push edx
lea ecx, [ebp - 0x18]
call fcn.0043e290
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x834]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x45615f
push 0x546038
push 0x58f750
call fcn.004045b0
add esp, 8
mov dword [ebp - 0x890], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x880]
call fcn.00401eb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401eb0
mov eax, dword [ebp - 0x890]
jmp 0x4562fd
cmp dword [ebp - 0x28], 0
je 0x45616f
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c], 0
jne 0x4561b4
mov dword [ebp - 0x894], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x880]
call fcn.00401eb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401eb0
mov eax, dword [ebp - 0x894]
jmp 0x4562fd
push 0x2bf20
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x456215
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x898], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x880]
call fcn.00401eb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401eb0
mov eax, dword [ebp - 0x898]
jmp 0x4562fd
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x456277
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x89c], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x880]
call fcn.00401eb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401eb0
mov eax, dword [ebp - 0x89c]
jmp 0x4562fd
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], 0xffffffff
je 0x4562c3
mov dword [ebp - 0x8a0], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x880]
call fcn.00401eb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401eb0
mov eax, dword [ebp - 0x8a0]
jmp 0x4562fd
mov dword [ebp - 0x8a4], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x880]
call fcn.00401eb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401eb0
mov eax, dword [ebp - 0x8a4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.004b0a79
mov esp, ebp
pop ebp
ret