Function at 0x405b20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x548852
mov eax, dword fs:[0]
push eax
sub esp, 0x1c0
mov eax, dword [0x595978]
xor eax, esp
mov dword [esp + 0x1b8], eax
push ebx
push esi
push edi
mov eax, dword [0x595978]
xor eax, esp
push eax
lea eax, [esp + 0x1d0]
mov dword fs:[0], eax
push 0x19
xor eax, eax
mov esi, 7
xor ebx, ebx
push 0x5780a8
lea ecx, [esp + 0x160]
mov dword [esp + 0x174], esi
mov dword [esp + 0x170], ebx
mov word [esp + 0x160], ax
call fcn.0040d980
lea ecx, [esp + 0x158]
push ecx
mov dword [esp + 0x1dc], ebx
call fcn.00437730
add esp, 4
test eax, eax
setne byte [esp + 0x13]
mov dword [esp + 0x1d8], 0xffffffff
cmp dword [esp + 0x16c], 8
jb 0x405bd5
mov edx, dword [esp + 0x158]
push edx
call fcn.0049cf83
add esp, 4
cmp byte [esp + 0x13], 0
je 0x405c4e
push 0x19
xor eax, eax
push 0x5780a8
lea ecx, [esp + 0x160]
mov dword [esp + 0x174], esi
mov dword [esp + 0x170], ebx
mov word [esp + 0x160], ax
call fcn.0040d980
lea ecx, [esp + 0x158]
push ecx
mov dword [esp + 0x1dc], 1
call fcn.00437730
add esp, 4
mov edi, eax
call fcn.00437a10
mov dword [esp + 0x1d8], 0xffffffff
cmp dword [esp + 0x16c], 8
jb 0x405c4e
mov edx, dword [esp + 0x158]
push edx
call fcn.0049cf83
add esp, 4
push 0x19
xor eax, eax
push 0x5780a8
lea ecx, [esp + 0x160]
mov dword [esp + 0x174], esi
mov dword [esp + 0x170], ebx
mov word [esp + 0x160], ax
call fcn.0040d980
lea ecx, [esp + 0x158]
push ecx
mov dword [esp + 0x1dc], 2
call fcn.00437730
add esp, 4
test eax, eax
setne al
test al, al
sete bl
mov dword [esp + 0x1d8], 0xffffffff
cmp dword [esp + 0x16c], 8
jb 0x405cc3
mov edx, dword [esp + 0x158]
push edx
call fcn.0049cf83
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test bl, bl
jne 0x405dd9
lea eax, [esp + 0xbc]
push eax
call fcn.0040a0e0
push edi
push ecx
push str.._Last_win_error
push ecx
push 0xda
push ecx
push str._at_line
push ecx
push str._psresident.cpp_
push ecx
push str._at_file
push ecx
push str._psafe::utilities::process_manager::is_process_running_L_PsInstallLoggerServer.exe__
push ecx
push str.._Failed_expression_
push ecx
lea ecx, [esp + 0xfc]
push str.Couldnt_close_the_logger_server.
push ecx
mov dword [esp + 0x220], 3
call fcn.00416190
add esp, 0xc
push eax
call fcn.00415b80
add esp, 0xc
push eax
call fcn.00415b80
add esp, 0xc
push eax
call fcn.00415b80
add esp, 0xc
push eax
call fcn.00415b80
add esp, 0xc
push eax
call fcn.00415b80
add esp, 0xc
push eax
call fcn.00409560
add esp, 4
push eax
call fcn.00415b80
add esp, 0xc
push eax
call fcn.00409730
lea ecx, [esp + 0x158]
lea eax, [esp + 0xbc]
call fcn.0040a180
mov ecx, eax
lea ebx, [esp + 0x190]
mov byte [esp + 0x1d8], 4
call fcn.004045b0
mov byte [esp + 0x1d8], 5
cmp dword [eax + 0x14], 0x10
jb 0x405db0
mov edx, dword [eax]
mov dword [esp + 0x14], edx
jmp 0x405db4
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
call fcn.0049ce20
push 0x58c098
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], vtable.std::runtime_error.0
call fcn.004a60bb
mov edx, dword [0x5b07c8]
mov edi, 8
cmp dword [0x5b07dc], edi
jae 0x405df1
mov edx, 0x5b07c8
xor eax, eax
mov word [esp + 0x174], ax
mov eax, edx
mov dword [esp + 0x188], esi
mov dword [esp + 0x184], 0
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405e12
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x17c]
call fcn.0040d980
push 0x19
push 0x5780a8
lea ecx, [esp + 0x17c]
mov dword [esp + 0x1e0], 6
call fcn.0040d6a0
mov eax, dword [esp + 0x174]
cmp dword [esp + 0x188], edi
jae 0x405e64
lea eax, [esp + 0x174]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, eax
cmp esi, 0x20
setg bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test bl, bl
jne 0x405f8f
lea ecx, [esp + 0x24]
push ecx
call fcn.0040a0e0
push edi
push ecx
push str.._Last_win_error
push ecx
push 0xe1
push ecx
push str._at_line
push ecx
push str._psresident.cpp_
push ecx
push str._at_file
push ecx
push str.ret___32
push ecx
push str.._Failed_expression_
push ecx
push esi
push ecx
lea edx, [esp + 0x6c]
push str.Error_starting_PsInstallLoggerServer.exe._Code:
push edx
mov byte [esp + 0x228], 7
call fcn.00416190
add esp, 0xc
push eax
call fcn.00409560
add esp, 4
push eax
call fcn.00415b80
add esp, 0xc
push eax
call fcn.00415b80
add esp, 0xc
push eax
call fcn.00415b80
add esp, 0xc
push eax
call fcn.00415b80
add esp, 0xc
push eax
call fcn.00415b80
add esp, 0xc
push eax
call fcn.00409560
add esp, 4
push eax
call fcn.00415b80
add esp, 0xc
push eax
call fcn.00409730
lea ecx, [esp + 0x190]
lea eax, [esp + 0x24]
call fcn.0040a180
mov ecx, eax
lea ebx, [esp + 0x1ac]
mov byte [esp + 0x1d8], 8
call fcn.004045b0
mov byte [esp + 0x1d8], 9
cmp dword [eax + 0x14], 0x10
jb 0x405f66
mov eax, dword [eax]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], eax
call fcn.0049ce20
push 0x58c098
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], vtable.std::runtime_error.0
call fcn.004a60bb
cmp dword [esp + 0x188], 8
jb 0x405fa9
mov eax, dword [esp + 0x174]
push eax
call fcn.0049cf83
add esp, 4
mov ecx, dword [esp + 0x1d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1b8]
xor ecx, esp
call fcn.0049cc86
mov esp, ebp
pop ebp
ret