Function at 0x4208c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x459636
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x4724e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2cc], ecx
mov byte [ebp - 0x11c], 0
push 0x103
push 0
lea eax, [ebp - 0x11b]
push eax
call fcn.004463a0
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x11c]
push ecx
call fcn.004463a0
add esp, 0xc
push str.epsng_certd_qdccb.exe
lea ecx, [ebp - 0x13c]
call fcn.00405ba0
mov dword [ebp - 4], 0
push 0
push 0x2e
lea ecx, [ebp - 0x13c]
call fcn.00423000
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xffffffff
je 0x420977
mov edx, dword [ebp - 0x120]
push edx
push str.epsng_certd_qdccb.exe
lea eax, [ebp - 0x11c]
push eax
call fcn.00448140
add esp, 0xc
jmp 0x420997
lea ecx, [ebp - 0x13c]
call fcn.00405390
push eax
push str.epsng_certd_qdccb.exe
lea ecx, [ebp - 0x11c]
push ecx
call fcn.00448140
add esp, 0xc
push 1
lea edx, [ebp - 0x11c]
push edx
mov ecx, dword [ebp - 0x2cc]
add ecx, 0xdc
call fcn.00405d40
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp + 8], 0
je 0x420d4e
push 0x44
push 0
lea eax, [ebp - 0x2bc]
push eax
call fcn.004463a0
add esp, 0xc
mov dword [ebp - 0x2bc], 0x44
xor ecx, ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], ecx
mov byte [ebp - 0x274], 0
push 0x103
push 0
lea edx, [ebp - 0x273]
push edx
call fcn.004463a0
add esp, 0xc
mov ecx, 0x488a28
call fcn.0040d690
movzx eax, al
test eax, eax
je 0x420b2f
lea ecx, [ebp - 0x274]
push ecx
mov ecx, dword [ebp - 0x2cc]
add ecx, 0xdc
call fcn.00408e40
lea edx, [ebp - 0x274]
add edx, 0xffffffff
mov dword [ebp - 0x2d0], edx
mov eax, dword [ebp - 0x2d0]
mov cl, byte [eax + 1]
mov byte [ebp - 0x2d1], cl
add dword [ebp - 0x2d0], 1
cmp byte [ebp - 0x2d1], 0
jne 0x420a56
mov edi, dword [ebp - 0x2d0]
mov edx, dword [str._ngsrv_ngslotd.exe__t]
mov dword [edi], edx
mov eax, dword [0x462ab8]
mov dword [edi + 4], eax
mov ecx, dword [0x462abc]
mov dword [edi + 8], ecx
mov edx, dword [0x462ac0]
mov dword [edi + 0xc], edx
mov eax, dword [0x462ac4]
mov dword [edi + 0x10], eax
mov cx, word [0x462ac8]
mov word [edi + 0x14], cx
lea edx, [ebp - 0x168]
push edx
lea eax, [ebp - 0x2bc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x274]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x420b04
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.00405310
mov eax, dword [ebp - 0x2c0]
jmp 0x420d70
push 0xffffffffffffffff
mov edx, dword [ebp - 0x168]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x420b34
call fcn.004207b0
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x104
push 0
lea edx, [ebp - 0x274]
push edx
call fcn.004463a0
add esp, 0xc
lea eax, [ebp - 0x274]
push eax
mov ecx, dword [ebp - 0x2cc]
add ecx, 0xdc
call fcn.00408e40
lea ecx, [ebp - 0x274]
add ecx, 0xffffffff
mov dword [ebp - 0x2d8], ecx
mov edx, dword [ebp - 0x2d8]
mov al, byte [edx + 1]
mov byte [ebp - 0x2d9], al
add dword [ebp - 0x2d8], 1
cmp byte [ebp - 0x2d9], 0
jne 0x420b7c
mov edi, dword [ebp - 0x2d8]
mov ecx, dword [str._ngsrv_ngslotd.exe__u]
mov dword [edi], ecx
mov edx, dword [0x462ad0]
mov dword [edi + 4], edx
mov eax, dword [0x462ad4]
mov dword [edi + 8], eax
mov ecx, dword [0x462ad8]
mov dword [edi + 0xc], ecx
mov edx, dword [0x462adc]
mov dword [edi + 0x10], edx
mov ax, word [0x462ae0]
mov word [edi + 0x14], ax
push 0x44
push 0
lea ecx, [ebp - 0x2bc]
push ecx
call fcn.004463a0
add esp, 0xc
mov dword [ebp - 0x2bc], 0x44
xor edx, edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x15c], edx
lea eax, [ebp - 0x168]
push eax
lea ecx, [ebp - 0x2bc]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x274]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x420c61
mov dword [ebp - 0x2c4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.00405310
mov eax, dword [ebp - 0x2c4]
jmp 0x420d70
push 0xffffffffffffffff
mov eax, dword [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x168]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x164]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x104
push 0
lea eax, [ebp - 0x11c]
push eax
call fcn.004463a0
add esp, 0xc
push str.ngslotd.exe
lea ecx, [ebp - 0x158]
call fcn.00405ba0
mov byte [ebp - 4], 1
push 0
push 0x2e
lea ecx, [ebp - 0x158]
call fcn.00423000
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xffffffff
je 0x420cfa
mov ecx, dword [ebp - 0x120]
push ecx
push str.ngslotd.exe
lea edx, [ebp - 0x11c]
push edx
call fcn.00448140
add esp, 0xc
jmp 0x420d1a
lea ecx, [ebp - 0x158]
call fcn.00405390
push eax
push str.ngslotd.exe
lea eax, [ebp - 0x11c]
push eax
call fcn.00448140
add esp, 0xc
push 1
lea ecx, [ebp - 0x11c]
push ecx
mov ecx, dword [ebp - 0x2cc]
add ecx, 0xdc
call fcn.00405d40
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x158]
call fcn.00405310
mov dword [ebp - 0x2c8], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.00405310
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00441f6e
mov esp, ebp
pop ebp
ret 4