Function at 0x4353c0
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68c
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x630], eax
mov eax, dword [ebp + 0x10]
push 0x20a
mov dword [ebp - 0x638], eax
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00411960
push 0x20a
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x62c], 0x105
push 0
push eax
call fcn.00411960
push 0x20a
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00411960
mov eax, dword [ebp - 0x630]
xorps xmm0, xmm0
add esp, 0x24
movlpd qword [ebp - 0x688], xmm0
xor esi, esi
movlpd qword [ebp - 0x680], xmm0
movlpd qword [ebp - 0x678], xmm0
movlpd qword [ebp - 0x670], xmm0
movlpd qword [ebp - 0x668], xmm0
movlpd qword [ebp - 0x660], xmm0
movlpd qword [ebp - 0x658], xmm0
movlpd qword [ebp - 0x650], xmm0
mov dword [ebp - 0x634], 0xffffffff
movups xmmword [ebp - 0x648], xmm0
test eax, eax
je 0x4358aa
test ebx, ebx
je 0x4358aa
test edi, edi
je 0x4358aa
mov ecx, dword [ebp + 8]
mov eax, ecx
mov dword [ebx], esi
mov dword [ebp - 0x68c], 0x44
sub eax, 0x5000
je 0x4354d5
sub eax, 6
je 0x435512
push ecx
push str.VNLSpawn64BitVnetlibTask:_Case_for_product__u_needs_to_be_implemented
push 1
call fcn.00446b80
add esp, 0xc
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00418120
test eax, eax
jne 0x435580
push str.VNLSpawn64BitVnetlibTask:_failed_to_get_generic_product_install_path
push 1
call fcn.00446b80
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00418420
test eax, eax
jne 0x435580
push str.VNLSpawn64BitVnetlibTask:_using_generic_path_for_installing_USB
push 2
call fcn.00446b80
add esp, 8
mov dword [ebp - 0x62c], 0x105
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00418120
test eax, eax
jne 0x435580
push str.VNLSpawn64BitVnetlibTask:_failed_to_obtain_generic_product_path
push 1
call fcn.00446b80
add esp, 8
call fcn.00446aa0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push str.vnetlib64.exe
lea eax, [ebp - 0x210]
push eax
push str._s_s
lea eax, [ebp - 0x41c]
push 0x105
push eax
call fcn.00419510
add esp, 0x14
test eax, eax
jns 0x4355cb
push str.VNLSpawn64BitVnetlibTask:_failed_to_create_executable_path
push 1
call fcn.00446b80
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x638]
lea eax, [ebp - 0x41c]
push ecx
push dword [ebp - 0x630]
test ecx, ecx
mov edx, str.__s______S
push eax
mov eax, str.__s______S__S
cmove eax, edx
push eax
lea eax, [ebp - 0x628]
push 0x105
push eax
call fcn.00419510
add esp, 0x18
test eax, eax
jns 0x435629
push str.VNLSpawn64BitVnetlibTask:_failed_to_create_executable_command_line
push 1
call fcn.00446b80
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x638]
mov eax, 0x49e448
test ecx, ecx
lfence
cmovne eax, ecx
push eax
push dword [ebp - 0x630]
push str.launching_process_for:__s__s
push 2
call fcn.00446b80
add esp, 0x10
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x68c]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4356ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VNLSpawn64BitVnetlibTask:_failed_to_launch_process:__d
push 1
call fcn.00446b80
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x63c]
push dword [ebp - 0x640]
push str.VNLSpawn64BitVnetlibTask:_launched_process:_pid__d_tid__d
push 2
call fcn.00446b80
add esp, 0x10
push dword [ebp - 0x644]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push str.VNLSpawn64BitVnetlibTask:_Waiting_for_process___d_loops
push 2
call fcn.00446b80
add esp, 0xc
inc esi
push 0x2710
push dword [ebp - 0x648]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x43570e
push str.VNLSpawn64BitVnetlibTask:_Waiting_for_process_returned__still_need_to_wait_longer
push 2
call fcn.00446b80
add esp, 8
jmp 0x4356d4
push eax
push str.VNLSpawn64BitVnetlibTask:_Done_waiting_for_process__code__d
push 2
call fcn.00446b80
add esp, 0xc
lea eax, [ebp - 0x634]
push eax
push dword [ebp - 0x648]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x435888
push dword [ebp - 0x634]
push str.VNLSpawn64BitVnetlibTask:_process_exit_code__d
push 0x20
call fcn.00446b80
mov ecx, dword [ebp - 0x634]
add esp, 0xc
cmp ecx, 0x103
jne 0x43579b
push str.VNLSpawn64BitVnetlibTask:_process_is_still_running__terminating
push 2
call fcn.00446b80
add esp, 8
push 0x20
push dword [ebp - 0x648]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x648]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
lea eax, [ecx - 4]
cmp eax, 0x1c
ja case.0x4357ae.5
movzx eax, byte [eax + 0x4358e8]
jmp dword [eax*4 + 0x4358d0]
push str.VNLSpawn64BitVnetlibTask:_process_needs_reboot
push 2
call fcn.00446b80
add esp, 8
mov dword [edi], 1
push str.VNLSpawn64BitVnetlibTask:_process_was_successful
push 2
call fcn.00446b80
add esp, 8
mov dword [ebx], 1
push dword [ebp - 0x648]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push str.VNLSpawn64BitVnetlibTask:_process_needs_reboot
push 2
call fcn.00446b80
add esp, 8
mov dword [edi], 1
push str.VNLSpawn64BitVnetlibTask:_process_was_not_successful
push 2
call fcn.00446b80
add esp, 8
push dword [ebp - 0x648]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push str.VNLSpawn64BitVnetlibTask:_process_was_killed
push 2
call fcn.00446b80
add esp, 8
push dword [ebp - 0x648]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push ecx
push str.VNLSpawn64BitVnetlibTask:_process_has_invalid_error_code:__d
push 2
call fcn.00446b80
add esp, 0xc
push dword [ebp - 0x648]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push edi
push ebx
push eax
push str.VNLSpawn64BitVnetlibTask:_invalid_parameters:_0x_08x_0x_08x_0x_08x
push 1
call fcn.00446b80
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.00401bd5
mov esp, ebp
pop ebp
ret