Function at 0x412d42
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1310
call fcn.00448890
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1294], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x12a0], eax
lea eax, [ebp - 0x1220]
push edi
xor edi, edi
mov dword [ebp - 0x1228], eax
lea eax, [ebp - 0x1288]
mov esi, ecx
mov dword [ebp - 0x1290], 0x80004005
mov dword [ebp - 0x128c], edi
mov dword [ebp - 0x1230], edi
mov dword [ebp - 0x122c], edi
mov dword [ebp - 0x1224], edi
call fcn.00413d2c
mov eax, dword [esi + 0x58]
movzx ecx, byte [esi + 0x85]
mov dword [ebp - 0x1270], eax
lea eax, [esi + 0x84]
movzx edx, byte [eax]
mov dword [ebp - 0x1264], eax
lea eax, [esi + 0x70]
mov dword [ebp - 0x1268], eax
lea eax, [ebp - 0x129c]
push eax
lea eax, [ebp - 0x1288]
shl ecx, 0x10
push eax
mov eax, dword [ebp - 0x1294]
or ecx, edx
push 2
mov dword [ebp - 0x126c], ecx
call fcn.00413558
add esp, 0xc
test eax, eax
jne 0x412f82
cmp dword [ebp - 0x129c], edi
je 0x412e11
or dword [ebx], 0x200
cmp dword [ebp - 0x1298], edi
je 0x412e25
push dword [ebp - 0x1298]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test byte [ebx], 2
je 0x412e43
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x128c], eax
cmp eax, edi
je 0x412f82
push 0x22
pop eax
mov word [ebp - 0x220], ax
push 0x106
lea eax, [ebp - 0x21e]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x22
pop ecx
add eax, eax
mov word [ebp + eax - 0x21e], cx
push str.__ipc
lea eax, [ebp + eax - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x44
lea eax, [ebp - 0x1310]
push edi
push eax
call fcn.00445b20
mov eax, dword [ebx]
mov dword [ebp - 0x12b4], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x12b0], eax
mov eax, dword [ebp - 0x128c]
mov dword [ebp - 0x12ac], eax
mov eax, dword [ebp - 0x129c]
add esp, 0xc
mov dword [ebp - 0x1310], 0x44
mov dword [ebp - 0x12b8], edi
cmp eax, edi
jne 0x412ed2
mov eax, dword [ebp - 0x1294]
mov eax, dword [eax + 8]
push 0x18
mov dword [ebp - 0x12a8], eax
mov eax, dword [esi + 0x78]
mov dword [ebp - 0x12a4], eax
pop eax
mov word [ebp - 0x12de], ax
lea eax, [ebp - 0x12b8]
mov dword [ebp - 0x12dc], eax
lea eax, [ebp - 0x12c8]
push eax
lea eax, [ebp - 0x1310]
push eax
push edi
push edi
push 0x20
push edi
push edi
push edi
lea eax, [ebp - 0x220]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x412f72
push dword [ebp - 0x12c8]
call esi
mov eax, dword [ebp - 0x12a0]
mov ecx, dword [ebp - 0x12c4]
or dword [eax], 4
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x12bc]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0x12c0]
mov dword [eax + 0x10], ecx
test byte [ebx], 2
je 0x412f6c
push 0x400001
push 0x40
push 0xffffffffffffffff
push dword [ebp - 0x128c]
call fcn.00413639
add esp, 0x10
mov dword [ebp - 0x1290], edi
cmp dword [ebp - 0x128c], edi
je 0x412f82
push dword [ebp - 0x128c]
call esi
lea eax, [ebp - 0x1230]
call fcn.00409c7e
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1290]
pop edi
xor ecx, ebp
pop esi
call fcn.00447d7e
leave
ret