Function at 0x6963f7
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
sub esp, 0x6c
mov eax, 0x6ba62a
call fcn.00640244
sub esp, 0x218
push ebx
lea eax, [ebp + 0x6f]
mov byte [ebp + 0x6f], 0
push eax
lea eax, [ebp + 0x1c]
mov ebx, ecx
push eax
call fcn.00695d32
and dword [ebp - 4], 0
cmp byte [ebp + 0x6f], 0
jne 0x696430
xor bl, bl
jmp 0x696977
push esi
push edi
push 0x44
pop esi
push esi
lea eax, [ebp - 0xb0]
push 0
push eax
call fcn.0065ab80
xor eax, eax
mov dword [ebp - 0xb0], esi
lea edi, [ebp + 0xc]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov esi, eax
xor edi, edi
lea eax, [ebp - 0xc4]
push edi
mov dword [ebp + 0x50], eax
lea eax, [ebp + 0x50]
push eax
push 1
push str.S:_ML__NW___LW_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
mov eax, dword [ebp + 0x50]
push edi
push edi
push 6
mov dword [ebp + 4], eax
mov dword [ebp], 0xc
mov dword [ebp + 8], 1
call fcn.0069508d
neg eax
lea ecx, [ebp - 0x224]
push 1
sbb edi, edi
lea eax, [ebp]
push 3
and edi, eax
call fcn.0049bcff
push dword [0x7a6d9c]
mov ecx, 0x7a6d98
mov byte [ebp - 4], 1
push dword [0x7a6d98]
push 0x7e9a38
call fcn.00693e3c
push eax
mov eax, 0x739ef0
push eax
push ebx
push eax
push esi
push eax
mov esi, 0x7a6da0
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.00494410
push eax
call fcn.00428762
mov ecx, eax
call fcn.005a3e4c
push eax
call fcn.00428762
mov ecx, eax
call fcn.006947f8
push eax
call fcn.00428762
mov ecx, eax
call fcn.004945c2
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x224]
call fcn.004bc889
mov byte [ebp - 4], 2
push 0x78
call fcn.0063ffa4
pop ecx
mov dword [ebp + 0x4c], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x69654c
push edi
push ebx
push 0x695776
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, eax
call fcn.006976bd
jmp 0x69654e
xor eax, eax
mov ecx, dword [ebx + 0x80]
mov byte [ebp - 4], 2
mov dword [ebx + 0x80], eax
test ecx, ecx
je 0x696568
mov eax, dword [ecx]
push 1
call dword [eax]
push 1
push 3
lea ecx, [ebp - 0x174]
call fcn.0049bcff
push esi
mov eax, 0x6c0ca0
mov byte [ebp - 4], 4
push eax
push 0x7a6db8
push eax
lea eax, [ebp - 0x6c]
push eax
push 0x6c1e94
lea eax, [ebp + 0x1c]
push eax
push 0x6c1e90
lea eax, [ebp - 0x164]
push eax
call fcn.00428762
push eax
call fcn.00494410
push eax
call fcn.00428762
push eax
call fcn.00494410
push eax
call fcn.00428762
push eax
call fcn.00494410
push eax
call fcn.00428762
push eax
call fcn.00494410
and dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], 0
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x174]
call fcn.004bc889
push 0
push 0
push 6
mov byte [ebp - 4], 6
call fcn.0069508d
test eax, eax
je 0x6966b3
call fcn.006949b3
movzx esi, byte [0x7acdad]
lea ecx, [ebp + 0x54]
neg esi
push str.lowIntegrity_created
sbb esi, esi
and esi, eax
call fcn.0040eeff
test esi, esi
mov byte [ebp - 4], 7
push 1
setne al
movzx eax, al
push eax
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.004965b6
push 0xffffffffffffffff
xor edi, edi
mov byte [ebp - 4], 8
push edi
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040efd9
push edi
push 1
lea ecx, [ebp + 0x34]
call fcn.0040f52f
push edi
push 1
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 6
call fcn.0040f52f
cmp dword [ebp - 0x10], 8
mov ecx, dword [ebp - 0x24]
jae 0x69667c
lea ecx, [ebp - 0x24]
cmp dword [ebp + 0x30], 8
mov eax, dword [ebp + 0x1c]
jae 0x696688
lea eax, [ebp + 0x1c]
lea edx, [ebp + 0xc]
push edx
lea edx, [ebp - 0xb0]
push edx
xor edx, edx
push edx
push edx
push edx
push edx
push edx
push edx
push ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
test esi, esi
je 0x6966e8
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x6966e8
cmp dword [ebp - 0x10], 8
mov ecx, dword [ebp - 0x24]
jae 0x6966bf
lea ecx, [ebp - 0x24]
cmp dword [ebp + 0x30], 8
mov eax, dword [ebp + 0x1c]
jae 0x6966cb
lea eax, [ebp + 0x1c]
lea edx, [ebp + 0xc]
push edx
lea edx, [ebp - 0xb0]
push edx
xor edx, edx
push edx
push edx
push edx
push edx
push edx
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov edi, eax
test edi, edi
jne 0x6967c8
cmp dword [ebp + 0x30], 8
mov eax, dword [ebp + 0x1c]
jae 0x6966fc
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push str.exe_exist
lea ecx, [ebp + 0x54]
mov esi, eax
call fcn.0040eeff
push 1
push esi
lea eax, [ebp + 0x54]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.00606c92
push 0xffffffffffffffff
xor ebx, ebx
mov byte [ebp - 4], 0xa
push ebx
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040efd9
push ebx
push 1
lea ecx, [ebp + 0x34]
call fcn.0040f52f
push ebx
push 1
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 6
call fcn.0040f52f
push 0x6dd904
lea ecx, [ebp + 0x54]
call fcn.0040eeff
push ebx
push str.Unable_to_create_remote_ie_process
lea eax, [ebp + 0x54]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.0046a515
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0xc
call fcn.0040efd9
push ebx
push 1
lea ecx, [ebp + 0x34]
call fcn.0040f52f
push ebx
push 1
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 6
call fcn.0040f52f
push str.remote_ieprocess
lea ecx, [ebp + 0x54]
call fcn.0040eeff
push ebx
push ebx
push ebx
lea eax, [ebp + 0x54]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x2c
call fcn.00488d2d
jmp 0x696931
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0x18]
push ecx
lea ecx, [ebx + 0x28]
mov dword [ebx + 8], eax
call fcn.006972b3
mov ecx, dword [ebx + 0x80]
test ecx, ecx
je 0x696802
push 0x7530
call fcn.00697907
test al, al
je 0x696802
mov bl, 1
jmp 0x69693c
and dword [ebp + 0x64], 0
mov dword [ebp + 0x68], 0xf
mov byte [ebp + 0x54], 0
cmp dword [ebx + 0x80], 0
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 0xe
jne 0x69684d
push str.pipe_error
call fcn.0040eeff
xor ebx, ebx
mov byte [ebp - 4], 0xf
push ebx
push str.No_pipeServer_available
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0046a515
mov byte [ebp - 4], 0x10
jmp 0x6968dd
push str.timeout_error
call fcn.0040eeff
push 1
push str.timeout_on_waiting_for_remote_ie_process_to_connect
lea eax, [ebp + 0x34]
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0046a515
push 0xffffffffffffffff
xor ebx, ebx
mov byte [ebp - 4], 0x12
push ebx
push eax
lea ecx, [ebp + 0x54]
call fcn.0040efd9
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.0040f52f
push ebx
push 1
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 0xe
call fcn.0040f52f
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
je 0x696903
push str.ie_alive
lea ecx, [ebp + 0x34]
call fcn.0040eeff
cmp dword [ebp + 0x4c], 0x103
push ebx
sete al
mov byte [ebp - 4], 0x13
movzx eax, al
push eax
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.004965b6
mov byte [ebp - 4], 0x14
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x54]
call fcn.0040efd9
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.0040f52f
push ebx
push 1
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 0xe
call fcn.0040f52f
push str.remote_ieprocess
lea ecx, [ebp + 0x34]
call fcn.0040eeff
push ebx
push ebx
push ebx
lea eax, [ebp + 0x34]
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp + 0x54]
push eax
push 0x2c
call fcn.00488d2d
push ebx
push 1
lea ecx, [ebp + 0x34]
call fcn.0040f52f
push ebx
push 1
lea ecx, [ebp + 0x54]
call fcn.0040f52f
xor esi, esi
lea ecx, [ebp - 0x24]
push esi
push 1
call fcn.004281f2
push esi
push 1
lea ecx, [ebp - 0x3c]
call fcn.0040f52f
lea ecx, [ebp - 0x174]
call fcn.0049ed61
push esi
push 1
lea ecx, [ebp - 0x6c]
call fcn.004281f2
lea ecx, [ebp - 0x224]
call fcn.0049ed61
pop edi
pop esi
push 0
push 1
lea ecx, [ebp + 0x1c]
call fcn.004281f2
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
lea esp, [ebp + 0x70]
pop ebp
ret