Function at 0x403a50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a928
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x4213d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004021d0
test al, al
je 0x403a8e
xor eax, eax
jmp 0x403cf2
lea eax, [ebp - 0x60]
push 1
mov ecx, eax
xor edi, edi
push ecx
mov dword [ebp - 0x40], 2
mov dword [ebp - 0x4c], 0xc
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov edx, dword [ebp - 0x48]
push edi
push edi
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push str.DDUninstallSystemLocked
push edi
push edi
lea eax, [ebp - 0x4c]
push eax
call esi
mov dword [0x423664], eax
cmp eax, edi
je 0x403cdf
push str.DDUninstallSystemUnlocked
push edi
push edi
lea ecx, [ebp - 0x4c]
push ecx
call esi
mov dword [0x423668], eax
cmp eax, edi
je 0x403ccf
xor edx, edx
push 0x12
mov eax, str.AVTray.exe__unlock
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], dx
call fcn.00405560
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
mov esi, 8
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x403b44
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0xa8]
push edx
push edi
push edi
push 0x10
push edi
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403b66
xor al, al
jmp 0x403b7a
mov eax, dword [ebp - 0x3c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
mov ecx, dword [ebp - 0x38]
push ecx
call ebx
mov al, 1
test al, al
sete bl
cmp dword [ebp - 0x18], esi
jb 0x403b90
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0040a478
add esp, 4
test bl, bl
jne 0x403ccf
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
push 1
lea esi, [ebp - 0x3c]
mov dword [ebp - 4], edi
call fcn.00406910
mov eax, dword [ebp - 0x38]
cmp eax, edi
je 0x403bbd
mov ecx, dword [0x423664]
mov dword [eax], ecx
mov esi, dword [ebp - 0x3c]
add eax, 4
mov dword [ebp - 0x38], eax
cmp eax, 0x423668
jbe 0x403c43
cmp esi, 0x423668
ja 0x403c43
mov edx, dword [ebp - 0x34]
mov edi, 0x423668
sub edi, esi
sar edi, 2
cmp eax, edx
jne 0x403c33
mov ecx, eax
sub ecx, esi
sar ecx, 2
cmp ecx, 0x3ffffffe
jbe 0x403bff
push str.vector_T__too_long
call fcn.00409666
sub edx, esi
inc ecx
sar edx, 2
cmp ecx, edx
jbe 0x403c33
mov eax, edx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, eax
jae 0x403c1c
xor eax, eax
jmp 0x403c1e
add eax, edx
cmp eax, ecx
jae 0x403c24
mov eax, ecx
push eax
lea esi, [ebp - 0x3c]
call fcn.00406910
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x3c]
test eax, eax
je 0x403c3c
mov edx, dword [esi + edi*4]
mov dword [eax], edx
add eax, 4
xor edi, edi
jmp 0x403ca6
mov edx, dword [ebp - 0x34]
cmp eax, edx
jne 0x403c97
mov ecx, eax
sub ecx, esi
sar ecx, 2
cmp ecx, 0x3ffffffe
jbe 0x403c63
push str.vector_T__too_long
call fcn.00409666
sub edx, esi
inc ecx
sar edx, 2
cmp ecx, edx
jbe 0x403c97
mov eax, edx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, eax
jae 0x403c80
xor eax, eax
jmp 0x403c82
add eax, edx
cmp eax, ecx
jae 0x403c88
mov eax, ecx
push eax
lea esi, [ebp - 0x3c]
call fcn.00406910
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x3c]
cmp eax, edi
je 0x403ca3
mov ecx, dword [0x423668]
mov dword [eax], ecx
add eax, 4
push 0xffffffffffffffff
push edi
sub eax, esi
push esi
sar eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0xffffffff
je 0x403cc2
cmp eax, edi
je 0x403cc2
mov dword [ebp - 0x40], edi
cmp esi, edi
je 0x403ccf
push esi
call fcn.0040a478
add esp, 4
mov eax, dword [0x423664]
cmp eax, edi
je 0x403cdf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x423668]
cmp eax, edi
je 0x403cef
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00409cc0
mov esp, ebp
pop ebp
ret