Function at 0x40df95
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0xc8
mov eax, 0x50d1d5
call fcn.004f41e2
mov esi, ecx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x40e242
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x40e242
xor edi, edi
mov dword [ebp - 0x74], edi
cmp word [eax], di
je 0x40e242
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x70], edi
call fcn.004e25a1
push edi
lea eax, [ebp - 0x6c]
mov dword [ebp - 4], edi
push eax
mov ecx, esi
call fcn.0041129d
push 0x40
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0xd0]
push edi
push eax
mov dword [ebp - 0xd4], 0x44
call fcn.004f5a90
xor eax, eax
lea edi, [ebp - 0x90]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esi + 0xa90]
mov esi, eax
mov dword [ebp - 0x80], eax
xor edi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x40e01f
mov edx, dword [ebx + 0x18]
sub esi, ecx
sar esi, 1
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x40e034
mov eax, dword [ebp - 0x7c]
sub edx, ecx
sar edx, 1
test eax, eax
je 0x40e06c
mov ecx, eax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x74]
jne 0x40e04f
sub ecx, edi
sar ecx, 1
xor edi, edi
lea eax, [ecx + 0xac]
mov dword [ebp - 0x78], eax
jmp 0x40e073
mov dword [ebp - 0x78], 0xaa
mov ecx, dword [ebx + 0x20]
test ecx, ecx
je 0x40e08f
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x74]
jne 0x40e07d
sub ecx, edi
sar ecx, 1
jmp 0x40e091
mov ecx, edi
lea edi, [edx + esi]
add edi, dword [ebp - 0x78]
add edi, ecx
lea eax, [edi + edi]
push eax
call fcn.004e1c0a
mov esi, eax
pop ecx
test esi, esi
je 0x40e231
push 0x22
pop eax
push dword [ebp - 0x80]
mov word [esi], ax
xor eax, eax
push edi
push esi
mov word [esi + 2], ax
call fcn.004019cd
push 0x524d94
push edi
push esi
call fcn.004019cd
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x40e0ea
push eax
push edi
push esi
call fcn.004019cd
push 0x5225e4
push edi
push esi
call fcn.004019cd
push 0x5260c0
push edi
push esi
call fcn.004019cd
mov eax, dword [0x5a23ec]
cmp byte [eax + 0x10f91], 0
je 0x40e110
push 0x5260d8
push edi
push esi
call fcn.004019cd
cmp dword [ebx + 0x20], 0
je 0x40e120
push dword [ebx + 0x20]
push edi
push esi
call fcn.004019cd
push 0x5260ec
push edi
push esi
call fcn.004019cd
push dword [ebx + 0x18]
push edi
push esi
call fcn.004019cd
cmp dword [ebx + 0x3c], 2
je 0x40e156
cmp dword [ebx + 0x44], 2
je 0x40e14f
xor eax, eax
cmp dword [ebx + 0x4c], eax
je 0x40e162
cmp dword [ebx + 0x44], 2
jne 0x40e162
push str.__new_console:r
jmp 0x40e15b
push str.__new_console:a
push edi
push esi
call fcn.004019cd
cmp dword [ebx + 0x3c], 2
je 0x40e1b2
cmp dword [ebx + 0x44], 2
je 0x40e1b2
mov ecx, dword [ebx + 0x4c]
test ecx, ecx
je 0x40e1b2
xor edi, edi
cmp word [ecx], di
je 0x40e1b2
lea edx, [ebp - 0x90]
xor eax, eax
cmp dword [ebx + 0x48], 2
push edx
lea edx, [ebp - 0xd4]
sete al
push edx
push dword [ebx + 0x1c]
inc eax
push edi
push 0x4000020
push esi
push edi
push eax
lea eax, [ebx + 0x54]
push eax
push dword [ebx + 0x50]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
xor ebx, ebx
jmp 0x40e1d3
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xd4]
push eax
push dword [ebx + 0x1c]
xor ebx, ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x70], eax
test eax, eax
jne 0x40e1f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push str.Failed_to_start_new_ConEmu_window
push 0x10
push eax
push esi
call fcn.00420ad9
add esp, 0x14
jmp 0x40e22a
mov eax, dword [ebp - 0x90]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40e212
cmp eax, 0xffffffff
je 0x40e212
push eax
mov dword [ebp - 0x90], ebx
call edi
mov eax, dword [ebp - 0x8c]
test eax, eax
je 0x40e22a
cmp eax, 0xffffffff
je 0x40e22a
push eax
mov dword [ebp - 0x8c], ebx
call edi
push esi
call fcn.004e1bea
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.004e25e0
cmp dword [ebp - 0x70], 0
setne al
jmp 0x40e244
xor al, al
call fcn.004f418c
ret 4