Function at 0x405380
Capabilities:
Create process on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x476004
mov eax, dword fs:[0]
push eax
mov eax, 0x1ee0
call fcn.00448e60
mov eax, dword [0x4a7534]
xor eax, esp
mov dword [esp + 0x1ed8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a7534]
xor eax, esp
push eax
lea eax, [esp + 0x1ef4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1f04]
mov eax, dword [esp + 0x1f08]
xor edi, edi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0xc8], edi
mov dword [esp + 0xcc], edi
mov dword [esp + 0xd0], edi
mov dword [esp + 0xd4], edi
mov dword [esp + 0xd8], edi
mov dword [esp + 0xdc], 0xa
mov dword [esp + 0xe0], fcn.0044674b
mov dword [esp + 0xe4], fcn.00446944
mov dword [esp + 0xe8], fcn.0044666e
push 0x48272c
mov ecx, 0x4ad828
mov dword [esp + 0x1f00], edi
call fcn.0040c400
test byte [0x4b17c8], 1
jne 0x405464
or dword [0x4b17c8], 1
push 0x479d00
mov byte [0x4b17b4], 0
call fcn.00446932
add esp, 4
mov esi, 0x4b17b0
call fcn.00410570
mov bl, byte [esp + 0x1f0c]
test bl, bl
je 0x4054bc
mov edx, dword [0x4afe28]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x4ae6a4
mov dword [esp + 0x28], edi
mov dword [esp + 0x38], edx
call fcn.00428070
test al, al
jne 0x4054a6
mov eax, dword [0x4afe34]
jmp 0x4054b8
mov edx, dword [esp + 0x1c]
mov eax, dword [0x4ae6ac]
mov eax, dword [eax + edx*8 + 4]
call fcn.00428330
test al, 4
jne 0x405531
mov ecx, 0x4af6f4
cmp ecx, 0x4af834
je 0x40550a
mov edx, ecx
cmp edx, 0x4af26c
je 0x40550a
mov eax, ecx
cmp eax, 0x4af564
je 0x40550a
cmp ecx, 0x4aef4c
jne 0x4054f7
push 0x4af244
mov ecx, 0x4ae690
call fcn.00428520
test al, al
je 0x405531
mov edi, 0x4af6f4
mov esi, 0x4ae690
call fcn.004295b0
test al, al
je 0x40552f
mov esi, dword [esp + 0x20]
push esi
mov ebx, ebp
call fcn.00404b40
add esp, 4
test al, al
jne 0x405528
mov ecx, ebp
call fcn.0046c290
mov byte [esi + 8], 0
mov bl, byte [esp + 0x1f0c]
xor edi, edi
test bl, bl
je 0x40557c
mov edx, dword [0x4afe28]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x4ae6a4
mov dword [esp + 0x28], edi
mov dword [esp + 0x38], edx
call fcn.00428070
test al, al
jne 0x405562
mov eax, dword [0x4afe34]
jmp 0x405574
mov edx, dword [esp + 0x1c]
mov eax, dword [0x4ae6ac]
mov eax, dword [eax + edx*8 + 4]
call fcn.00428330
test al, 8
jne 0x405dfa
mov ecx, 0x4afd70
cmp ecx, 0x4af834
je 0x4055cc
mov edx, ecx
cmp edx, 0x4af26c
je 0x4055cc
mov eax, ecx
cmp eax, 0x4af564
je 0x4055cc
cmp ecx, 0x4aef4c
jne 0x4055b7
push 0x4af244
mov ecx, 0x4ae690
call fcn.00428520
test al, al
je 0x4055df
mov edi, 0x4afd70
mov esi, 0x4ae690
call fcn.004295b0
xor edi, edi
test al, al
je 0x4055df
push 0x4af7bc
mov ecx, 0x4ae690
call fcn.00428520
test al, al
jne 0x4055e7
test bl, bl
jne 0x405dfa
mov edx, dword [0x4a93d0]
push ebp
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], edx
call fcn.00413a40
test al, al
jne 0x40560e
mov ecx, ebp
call fcn.0046cff0
mov ecx, ebp
call fcn.0046c290
mov esi, dword [0x4ac7bc]
cmp esi, dword [0x4ad82c]
je 0x405628
mov edi, 0x4ad828
call fcn.0040bd10
xor edi, edi
test bl, bl
je 0x40567b
push 0x4afd70
mov ecx, 0x4ae690
call fcn.00428520
test al, al
je 0x405652
push 0x4af7bc
mov ecx, 0x4ae690
call fcn.00428520
test al, al
jne 0x40567b
mov eax, dword [esp + 0x20]
cmp byte [eax + 8], 0
je 0x405667
push eax
call fcn.0040b000
jmp 0x405dfa
push 0x482748
mov ecx, 0x4ad828
call fcn.0040c400
jmp 0x405dfa
lea ecx, [esp + 0x138]
push ecx
call fcn.004039d0
mov ecx, ebp
lea edx, [esp + 0x138]
mov byte [esp + 0x1efc], 1
call fcn.0041bd30
test al, al
jne 0x4056f3
push 0x482c68
mov ecx, ebp
call fcn.0046c2f0
mov ecx, eax
call fcn.0046c360
push 0x48260c
mov ecx, eax
call fcn.0046c360
lea ecx, [esp + 0x138]
mov byte [esp + 0x1efc], 0
call fcn.00411a60
lea ecx, [esp + 0xc8]
mov dword [esp + 0x1efc], 0xffffffff
call fcn.0041c570
xor al, al
jmp 0x405e13
lea edx, [esp + 0x138]
push edx
push ebp
call fcn.004045a0
add esp, 8
test al, al
je 0x4056a2
push 0x4a93d0
lea eax, [esp + 0x5c]
push eax
push str.UserManager
call fcn.00402f70
add esp, 4
mov ecx, eax
call fcn.0043fa40
push edi
push edi
push edi
push edi
push 0x482620
push eax
lea ecx, [esp + 0xa4]
mov byte [esp + 0x1f14], 2
call fcn.0046e600
lea ecx, [esp + 0x58]
mov byte [esp + 0x1efc], 4
call fcn.0046d3c0
lea ecx, [esp + 0x8c]
call fcn.0046d690
test al, al
jne 0x4057bd
push edi
push ebp
lea ecx, [esp + 0x94]
call fcn.0046e8f0
test al, al
jne 0x4057bd
push 0x482628
mov ecx, ebp
call fcn.0046c2f0
mov ecx, eax
call fcn.0046c360
push 0x482634
lea ecx, [esp + 0x90]
mov esi, eax
call fcn.0046d3a0
push eax
mov ecx, esi
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
lea ecx, [esp + 0x8c]
call fcn.0046d3c0
jmp 0x4056c1
lea ecx, [esp + 0x68]
call fcn.00468ff0
push 0x4825ec
push 0x482c68
lea ecx, [esp + 0x70]
call fcn.00469230
mov ecx, eax
call fcn.00469230
lea ecx, [esp + 0x68]
call fcn.00468ae0
push eax
mov ecx, 0x4ad950
call fcn.0040f570
mov esi, dword [0x4ac7bc]
cmp esi, dword [0x4ad954]
je 0x40580c
mov edi, 0x4ad950
call fcn.0040bd10
lea ecx, [esp + 0x48]
mov byte [esp + 0x1b], 1
call fcn.00468ff0
lea eax, [esp + 0x138]
mov byte [esp + 0x1efc], 6
call fcn.0041b9c0
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x138]
test eax, eax
mov edi, eax
je 0x405d82
mov ecx, dword [edi]
add edi, 8
mov dword [esp + 0x78], ecx
mov ecx, edi
mov esi, 0x485ff8
call fcn.00468b10
jmp 0x405860
mov cx, word [eax]
cmp cx, word [esi]
jne 0x405886
test cx, cx
je 0x405882
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x405886
add eax, 4
add esi, 4
test cx, cx
jne 0x405860
xor eax, eax
jmp 0x40588b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x405d76
mov ecx, edi
mov esi, str.14108
call fcn.00468b10
nop
mov cx, word [eax]
cmp cx, word [esi]
jne 0x4058c6
test cx, cx
je 0x4058c2
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x4058c6
add eax, 4
add esi, 4
test cx, cx
jne 0x4058a0
xor eax, eax
jmp 0x4058cb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x405d76
mov edx, dword [edi + 0x28]
cmp edx, dword [edi + 0x20]
jle 0x405d76
lea ecx, [esp + 0x58]
call fcn.00468ff0
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx]
push 0x482768
push eax
push 0x482764
add edx, 1
push edx
lea ecx, [esp + 0x68]
call fcn.00469260
mov ecx, eax
call fcn.00469230
mov ecx, eax
call fcn.00469260
mov ecx, eax
call fcn.00469230
lea ecx, [esp + 0x58]
call fcn.00468ae0
mov esi, eax
mov eax, dword [0x4ad954]
push 0x79
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x405947
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [edi + 0x2c]
push ecx
lea ecx, [esp + 0xf0]
call fcn.004695b0
mov edx, dword [edi + 0x28]
mov eax, dword [edi + 0x20]
push edx
push str.ev
push eax
push str._av
lea ecx, [esp + 0xfc]
call fcn.00469230
mov ecx, eax
call fcn.00469260
mov ecx, eax
call fcn.00469230
mov ecx, eax
call fcn.00469260
lea ebp, [edi + 0x10]
mov ecx, ebp
call fcn.0046d380
push eax
lea ecx, [esp + 0x100]
call fcn.00469560
push 0x482654
lea ecx, [esp + 0x100]
mov byte [esp + 0x1f00], 9
call fcn.00469230
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x110]
call fcn.00468b10
push eax
lea ecx, [esp + 0x50]
call fcn.0046d910
push ebx
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1f00], 0xa
call fcn.0046f180
lea ecx, [esp + 0xec]
call fcn.00468ae0
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
push esi
lea ecx, [esp + 0x40]
call fcn.0041d910
add esp, 8
test al, al
jne 0x405a49
push 0x482658
mov ecx, esi
call fcn.0046c2f0
mov ecx, eax
call fcn.0046c360
push 0x482664
mov ecx, edi
mov esi, eax
call fcn.00468b10
push eax
mov ecx, esi
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
mov byte [esp + 0x1b], 0
jmp 0x405d40
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x1a8]
push edx
mov byte [esp + 0x16f0], 0
call fcn.00425b80
test al, al
jne 0x405adb
push 0x482674
mov ecx, esi
call fcn.0046c2f0
mov ecx, eax
call fcn.0046c360
push ebx
push ebx
push esi
lea ecx, [esp + 0x44]
call fcn.0046e300
test al, al
jne 0x405a9d
push 0x482690
mov ecx, esi
call fcn.0046c2f0
mov ecx, eax
call fcn.0046c360
lea ecx, [esp + 0x38]
mov byte [esp + 0x1b], 0
call fcn.0046d3c0
lea ecx, [esp + 0xfc]
call fcn.00468c30
lea ecx, [esp + 0xec]
call fcn.00468c30
lea ecx, [esp + 0x58]
mov byte [esp + 0x1efc], 6
call fcn.00468c30
mov ebp, esi
jmp 0x405d76
push ebx
push ebp
push esi
lea ecx, [esp + 0x44]
call fcn.0046eda0
test al, al
jne 0x405b31
push 0x4826ac
mov ecx, esi
call fcn.0046c2f0
mov ecx, eax
call fcn.0046c360
push 0x4826b4
mov ecx, ebp
mov esi, eax
call fcn.0046d3a0
push eax
push 0x4826b0
lea ecx, [esp + 0x44]
call fcn.0046d3a0
push eax
mov ecx, esi
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
mov ecx, eax
jmp 0x405a33
push ebx
push ebx
push esi
lea ecx, [esp + 0x44]
call fcn.0046e300
test al, al
jne 0x405b73
push 0x4826c4
mov ecx, esi
call fcn.0046c2f0
mov ecx, eax
call fcn.0046c360
push 0x482634
lea ecx, [esp + 0x3c]
mov esi, eax
call fcn.0046d3a0
push eax
mov ecx, esi
call fcn.0046c360
mov ecx, eax
call fcn.0046c360
mov esi, dword [esp + 0x28]
cmp dword [esi], 3
jge 0x405d37
mov eax, dword [edi + 0x20]
cdq
mov dword [esp + 0x10c], eax
mov eax, dword [edi + 0x28]
mov dword [esp + 0x110], edx
cdq
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], eax
lea eax, [esp + 0x10c]
push eax
lea ecx, [esp + 0x118]
push ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x11c], ebx
mov dword [esp + 0xa8], ebx
call fcn.00447b5d
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0xac]
push eax
call fcn.00447b5d
add esp, 0x10
push 0x482204
lea ecx, [esp + 0x2d8]
push ecx
lea ecx, [esp + 0x50]
call fcn.00469230
mov ecx, eax
call fcn.00469230
cmp dword [edi + 0x20], 0x64
jge 0x405c7b
push 0x482774
lea ecx, [esp + 0x4c]
call fcn.00469230
jmp 0x405ccb
mov edx, dword [esp + 0x120]
mov eax, dword [esp + 0x124]
mov ecx, dword [esp + 0x128]
push edx
push 0x48277c
add eax, 1
push eax
add ecx, 0x76c
push 0x48277c
push ecx
lea ecx, [esp + 0x5c]
call fcn.00469260
mov ecx, eax
call fcn.00469230
mov ecx, eax
call fcn.00469260
mov ecx, eax
call fcn.00469230
mov ecx, eax
call fcn.00469260
push 0x482780
lea ecx, [esp + 0x4c]
call fcn.00469230
mov edx, dword [esp + 0xac]
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0xb4]
push edx
push 0x48277c
add eax, 1
push eax
add ecx, 0x76c
push 0x48277c
push ecx
lea ecx, [esp + 0x5c]
call fcn.00469260
mov ecx, eax
call fcn.00469230
mov ecx, eax
call fcn.00469260
mov ecx, eax
call fcn.00469230
mov ecx, eax
call fcn.00469260
push 0x493644
lea ecx, [esp + 0x4c]
call fcn.00469230
mov edx, dword [edi + 0x28]
mov dword [edi + 0x24], edx
add dword [esi], 1
lea ecx, [esp + 0x38]
call fcn.0046d3c0
lea ecx, [esp + 0xfc]
call fcn.00468c30
lea ecx, [esp + 0xec]
call fcn.00468c30
lea ecx, [esp + 0x58]
mov byte [esp + 0x1efc], 6
call fcn.00468c30
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x78]
test edi, edi
jne 0x405846
push 0x482788
mov ecx, 0x4ad828
call fcn.0040c400
mov esi, dword [0x4ac7bc]
cmp esi, dword [0x4ad82c]
je 0x405da9
mov edi, 0x4ad828
call fcn.0040bd10
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
xor ebx, ebx
cmp eax, ebx
jne 0x405e4f
mov eax, dword [esp + 0x20]
cmp byte [eax + 8], bl
je 0x405e3b
push eax
call fcn.0040b000
lea ecx, [esp + 0x48]
call fcn.00468c30
lea ecx, [esp + 0x68]
call fcn.00468c30
lea ecx, [esp + 0x8c]
call fcn.0046d3c0
lea ecx, [esp + 0x138]
mov byte [esp + 0x1efc], 0
call fcn.00411a60
lea ecx, [esp + 0xc8]
mov dword [esp + 0x1efc], 0xffffffff
call fcn.0041c570
mov al, 1
mov ecx, dword [esp + 0x1ef4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1ed8]
xor ecx, esp
call fcn.0044610a
add esp, 0x1eec
ret
push 0x4827a0
mov ecx, 0x4ad828
call fcn.0040c400
jmp 0x405dc8
cmp eax, 3
jle 0x405e62
push 0x4827bc
lea ecx, [esp + 0x4c]
call fcn.00469230
call fcn.00410240
mov edi, 0x482788
mov ecx, eax
call fcn.00410490
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x4ac7a4
call esi
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x4ac7a4
call edi
push 0x7fe
lea ecx, [esp + 0x16f2]
push ebx
push ecx
mov word [esp + 0x16f8], bx
call fcn.004498f0
add esp, 0xc
push str.UserManager
call fcn.00402f70
add esp, 4
add eax, 0x5d8
push eax
push 0x4826dc
lea edx, [esp + 0x16f4]
push 0x104
push edx
call fcn.00446633
push 0x40
lea eax, [esp + 0x174]
push ebx
push eax
call fcn.004498f0
xor eax, eax
add esp, 0x1c
push 0x4ac78c
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x160], 0x44
call esi
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x160]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x170c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 0x7c]
push 0x1388
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x7c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x80]
push eax
call esi
push 0x4ac78c
call edi
mov eax, dword [esp + 0x20]
cmp byte [eax + 8], 0
je 0x405f7d
push eax
call fcn.0040b000
jmp 0x406095
lea ecx, [esp + 0x68]
call fcn.00468fc0
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx]
push 0x493644
push 0x4827d4
push edx
push 0x4827c4
lea ecx, [esp + 0x78]
call fcn.00469230
mov ecx, eax
call fcn.00469260
mov ecx, eax
call fcn.00469230
mov ecx, eax
call fcn.00469230
lea ecx, [esp + 0x48]
call fcn.00468b10
push eax
lea ecx, [esp + 0x6c]
call fcn.00469230
mov esi, dword [0x4ad954]
mov edi, 0x4ad828
call fcn.0040bd10
lea ecx, [esp + 0x68]
call fcn.00468b10
push eax
mov ecx, edi
call fcn.0040c400
lea ecx, [esp + 0x58]
call fcn.00468ff0
push 0x4827dc
mov bl, 0xb
push 0x482c68
lea ecx, [esp + 0x60]
mov byte [esp + 0x1f04], bl
call fcn.00469230
mov ecx, eax
call fcn.00469230
push 1
lea eax, [esp + 0xa4]
push eax
call fcn.0042bb60
mov dword [esp + 0xa0], vtable.t_bbWebHalf.0
lea ecx, [esp + 0x68]
mov byte [esp + 0x1efc], 0xc
call fcn.00468ae0
push eax
lea ecx, [esp + 0xa4]
push ecx
call fcn.00424e00
push 0
lea edx, [esp + 0xa4]
push edx
call fcn.00425210
push 5
lea eax, [esp + 0xa4]
push eax
call fcn.00425420
lea ecx, [esp + 0xa0]
mov byte [esp + 0x1efc], bl
call fcn.00425690
lea ecx, [esp + 0x58]
mov byte [esp + 0x1efc], 6
call fcn.00468c30
cmp byte [esp + 0x1b], 0
jne 0x405dc8
push 0x48270c
mov ecx, ebp
call fcn.0046c2f0
mov ecx, eax
call fcn.0046c360
lea ecx, [esp + 0x48]
call fcn.00468c30
lea ecx, [esp + 0x68]
call fcn.00468c30
lea ecx, [esp + 0x8c]
call fcn.0046d3c0
jmp 0x4056c1