Function at 0x458ee0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
push ebx
push esi
push edi
mov eax, edx
mov dword [ebp - 0xc], 0
push eax
mov edi, ecx
mov dword [ebp - 0x1c], eax
push 0x405
push edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [ebp - 8], 0
call fcn.004a7730
add esp, 0xc
test eax, eax
je 0x458f6e
mov esi, dword [eax + 0x18]
test esi, esi
je 0x458f6e
mov eax, dword [esi + 4]
mov edx, 0x4eb673
test eax, eax
mov ecx, edx
cmovne ecx, eax
cmp byte [ecx], bl
je 0x458f6e
mov eax, dword [esi + 0x10]
mov ecx, edx
test eax, eax
cmovne ecx, eax
cmp byte [ecx], bl
jne 0x458f47
test byte [esi + 0x20], 2
je 0x458f6e
test byte [esi + 0x20], 8
je 0x458f77
mov edx, esi
mov ecx, edi
call fcn.00458410
mov dword [esi + 0x34], ebx
mov ecx, edi
mov eax, dword [0x59174c]
mov edx, dword [eax + 0x708]
and edx, 0x20
call fcn.0045c810
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x59174c]
mov edx, dword [eax + 0x748]
mov dword [ebp - 0x10], edx
cmp dword [0x591614], ebx
jne 0x458fdd
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x591614
push 0x4ef5fc
push 4
push 0
push 0x4eb690
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [0x591614]
test ecx, ecx
jne 0x458fc5
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.00404e60
jmp 0x458fda
mov eax, dword [ecx]
push 0x591618
push 0x4ef5ec
push 0x4ef5ec
push ecx
call dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [0x591618]
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
test ecx, ecx
je 0x458ffc
mov eax, dword [ecx]
lea edi, [ebp - 0x2c]
push edi
push edx
push ecx
call dword [eax + 0x10]
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov eax, ecx
shr eax, 0x18
push eax
mov eax, ecx
shr eax, 0x10
movzx eax, al
push eax
mov eax, ecx
shr eax, 8
movzx eax, al
push eax
movzx eax, cl
mov ecx, dword [ebp - 0x24]
push eax
mov eax, ecx
shr eax, 0x18
push eax
mov eax, ecx
shr eax, 0x10
movzx eax, al
push eax
mov eax, ecx
shr eax, 8
movzx eax, al
push eax
movzx eax, cl
mov ecx, dword [ebp - 0x28]
push eax
mov eax, ecx
shr eax, 0x10
push eax
movzx eax, cx
push eax
push dword [ebp - 0x2c]
lea eax, [ebp - 0x54]
push str._08X__04hX__04hX__02X_02X__02X_02X_02X_02X_02X_02X
push eax
call fcn.004010a0
add esp, 0x34
lea eax, [ebp - 0x54]
push 0x28
push eax
push eax
push dword [0x591f38]
call fcn.0047f5b0
add esp, 0x10
mov ecx, eax
mov dword [ebp - 0x14], ecx
cmp dword [esi + 0x2c], ebx
jne 0x4593e0
mov edi, dword [sym.imp.VCRUNTIME140.dll_strchr]
push 0x2a
push dword [esi + 0x10]
call edi
add esp, 8
test eax, eax
jne 0x458f6e
push 0x3f
push dword [esi + 0x10]
call edi
add esp, 8
test eax, eax
jne 0x458f6e
push 0x20
push dword [esi + 0x10]
call edi
add esp, 8
test eax, eax
jne 0x458f6e
push 0x22
push dword [esi + 0x10]
call edi
add esp, 8
test eax, eax
jne 0x458f6e
push 0x7c
push dword [esi + 0x10]
call edi
add esp, 8
test eax, eax
jne 0x458f6e
push 0x3c
push dword [esi + 0x10]
call edi
add esp, 8
test eax, eax
jne 0x458f6e
push 0x3e
push dword [esi + 0x10]
call edi
add esp, 8
test eax, eax
jne 0x458f6e
call fcn.00493410
test eax, eax
je 0x459169
call fcn.00493410
cmp dword [eax], ebx
je 0x459169
mov eax, dword [0x52e820]
test eax, eax
je 0x459125
mov edi, dword [eax + 0x190]
jmp 0x45912b
mov edi, dword [0x52e824]
call fcn.00493410
test eax, eax
je 0x45913d
call fcn.00493410
mov eax, dword [eax]
jmp 0x45913f
xor eax, eax
push str.Connect_to__s____s
push dword [esi + 0x10]
push dword [esi + 4]
push str.Connect_to__s____s
push dword [0x52e820]
push edi
push 0
push 0xc6f
push str.Main.c
push 0
call eax
add esp, 0x28
push 0
push 0x451320
call dword [0x595ebc]
push 0x597e60
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 1
push dword [ebp - 0x1c]
mov dword [esi + 0x2c], 1
push 0x405
push dword [ebp - 0x18]
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 1
call fcn.004aa860
add esp, 0x10
push 0x597e60
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [esi + 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edx, eax
add esp, 4
mov dword [ebp - 0xc], edx
mov al, byte [edx]
test al, al
je 0x459223
mov edi, 0x5f
cmp al, 0x5c
jne 0x4591da
mov cl, 0x5f
jmp 0x45921a
cmp al, 0x3a
jne 0x4591e2
mov cl, 0x2d
jmp 0x45921a
cmp al, 0x3c
jne 0x4591ea
mov cl, 0x28
jmp 0x45921a
cmp al, 0x3e
jne 0x4591f2
mov cl, 0x29
jmp 0x45921a
cmp al, 0x22
jne 0x4591fa
mov cl, 0x27
jmp 0x45921a
cmp al, 0x2f
jne 0x459202
mov cl, 0x5f
jmp 0x45921a
cmp al, 0x7c
jne 0x45920a
mov cl, 0x2d
jmp 0x45921a
cmp al, 0x2a
jne 0x459212
mov cl, 0x23
jmp 0x45921a
cmp al, 0x3f
movzx ecx, al
cmove ecx, edi
mov byte [edx], cl
inc edx
mov al, byte [edx]
test al, al
jne 0x4591d2
mov edx, 1
mov ecx, esi
call fcn.00454580
mov ecx, esi
call fcn.00457d80
mov edx, dword [ebp - 0xc]
mov ecx, esi
call fcn.00452530
mov edx, dword [esi + 0xa4]
mov edi, eax
test edx, edx
je 0x45926b
cmp edx, dword [ebp - 0x14]
je 0x45926b
mov ecx, dword [0x59174c]
mov ecx, dword [ecx + 0x748]
call fcn.00453390
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call eax
test edi, edi
je 0x4592ff
mov edi, dword [esi + 0x14]
xor edx, edx
mov cl, 0x44
nop word [eax + eax]
lea eax, [ecx - 0x20]
cmp al, 0x5e
ja 0x459290
movsx eax, cl
mov cl, byte [eax + 0x4eecc8]
mov byte [ebp + edx - 0x184], cl
inc edx
mov cl, byte [edx + str.D0F0Yw_]
test cl, cl
jne 0x459280
mov byte [ebp + edx - 0x184], bl
lea eax, [ebp - 8]
push eax
push eax
push eax
mov edx, 0x4eb673
test edi, edi
mov ecx, edx
mov eax, str.__prompt
cmovne ecx, edi
cmp byte [ecx], bl
cmove eax, edx
push eax
lea eax, [esi + 0x3c]
push eax
push dword [ebp - 0xc]
mov eax, dword [0x59174c]
add eax, 0x384
push eax
lea eax, [ebp - 0x184]
push eax
push str._s___sSessions_s__s.rdp__s_s
lea eax, [ebp - 8]
push 0
push eax
call fcn.00482d60
add esp, 0x2c
push 5
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x45930b
mov eax, dword [0x59174c]
or dword [eax + 0x708], 8
cmp dword [esi + 0x14], ebx
lea edi, [esi + 0x14]
je 0x459329
push edi
call fcn.0047e900
add esp, 4
push dword [edi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [edi], ebx
cmp dword [esi + 0x18], ebx
lea edi, [esi + 0x18]
je 0x459347
push edi
call fcn.0047e900
add esp, 4
push dword [edi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [edi], ebx
cmp dword [ebp - 0xc], ebx
je 0x45936b
lea eax, [ebp - 0xc]
push eax
call fcn.0047e900
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push dword [ebp - 0xc]
call edi
add esp, 4
mov dword [ebp - 0xc], ebx
jmp 0x459371
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp dword [ebp - 8], ebx
je 0x45938d
lea eax, [ebp - 8]
push eax
call fcn.0047e900
add esp, 4
push dword [ebp - 8]
call edi
add esp, 4
mov dword [ebp - 8], ebx
mov edi, dword [ebp - 0x18]
mov eax, dword [0x59174c]
test byte [eax + 0x708], 8
jne 0x4595d1
and dword [esi + 0x24], 0xfffffdcb
mov eax, dword [0x59174c]
and dword [eax + 0x708], 0xfffffffb
call fcn.00493410
test eax, eax
je 0x459452
call fcn.00493410
cmp dword [eax], ebx
je 0x459452
mov eax, dword [0x52e820]
test eax, eax
je 0x45940a
mov eax, dword [eax + 0x190]
jmp 0x45940f
mov edx, dword [esi + 0xa4]
test edx, edx
je 0x459390
cmp edx, ecx
je 0x459390
mov ecx, dword [0x59174c]
mov ecx, dword [ecx + 0x748]
call fcn.00453390
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call eax
jmp 0x459390
mov eax, dword [0x52e824]
mov dword [ebp - 0x10], eax
call fcn.00493410
test eax, eax
je 0x459424
call fcn.00493410
mov eax, dword [eax]
jmp 0x459426
xor eax, eax
push str.Logging_on_session__s____s
push dword [esi + 0x10]
push dword [esi + 4]
push str.Logging_on_session__s____s
push dword [0x52e820]
push dword [ebp - 0x10]
push 0
push 0xca0
push str.Main.c
push 0
call eax
add esp, 0x28
mov eax, dword [0x59174c]
test byte [eax + 0x708], 8
jne 0x45949a
test dword [esi + 0x24], 0x204
jne 0x45949a
push ecx
push 0
push 0
mov edx, esi
mov ecx, edi
call fcn.00457e80
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x45949a
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x59174c]
test byte [ecx + 0x708], 8
je 0x459460
test dword [esi + 0x24], 0x200
jne 0x4594ae
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x59174c]
test byte [eax + 0x708], 8
jne 0x4594fd
nop dword [eax]
mov eax, dword [esi + 0x24]
and eax, 0x206
cmp eax, 4
jne 0x4594fd
push ecx
push 0
push 0
mov edx, esi
mov ecx, edi
call fcn.00457e80
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x4594fd
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x59174c]
test byte [eax + 0x708], 8
je 0x4594c0
mov eax, dword [0x59174c]
test byte [eax + 0x708], 8
je 0x459518
push 0
push 0x451320
call dword [0x595ebc]
cmp dword [ebp + 8], 0
je 0x4595d1
test byte [esi + 0x9c], 4
je 0x4595c5
mov eax, dword [esi + 0xa4]
test eax, eax
je 0x459542
cmp eax, dword [ebp - 0x14]
jne 0x4595c5
cmp dword [esi + 0xac], 0
je 0x4595c5
call fcn.00493410
test eax, eax
je 0x4595b7
call fcn.00493410
cmp dword [eax], 0
je 0x4595b7
mov eax, dword [0x52e820]
test eax, eax
je 0x45956f
mov eax, dword [eax + 0x190]
jmp 0x459574
mov eax, dword [0x52e824]
mov dword [ebp - 0x14], eax
call fcn.00493410
test eax, eax
je 0x459589
call fcn.00493410
mov eax, dword [eax]
jmp 0x45958b
xor eax, eax
push str.Minimizing_session__s____s
push dword [esi + 0x10]
push dword [esi + 4]
push str.Minimizing_session__s____s
push dword [0x52e820]
push dword [ebp - 0x14]
push 0
push 0x919
push str.Main.c
push 0
call eax
add esp, 0x28
push 2
push dword [esi + 0xac]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x59174c]
and dword [eax + 0x708], 0xffffffbf
cmp dword [esi + 0x2c], 2
je 0x459614
mov eax, dword [0x59174c]
test byte [eax + 0x708], 8
je 0x459614
push 1
push dword [ebp - 0x1c]
mov dword [esi + 0x2c], 0
push 0x405
push edi
mov dword [esi + 0x30], 0
call fcn.004aa860
mov eax, dword [0x59174c]
add esp, 0x10
and dword [eax + 0x708], 0xffffffbf
xor ebx, ebx
mov dword [esi + 0x34], 0
mov ecx, edi
mov eax, dword [0x59174c]
mov edx, dword [eax + 0x708]
and edx, 0x20
call fcn.0045c810
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret