Function at 0x40e560
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439120
mov eax, dword fs:[0]
push eax
sub esp, 0xa3c
mov eax, dword [0x449314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 0x800
mov dword [ebp - 0xa48], eax
lea eax, [ebp - 0xa18]
push 0
push eax
mov dword [ebp - 0xa2c], ebx
mov dword [ebp - 0xa1c], esi
call sub.VCRUNTIME140.dll_memset
push 0x104
lea eax, [ebp - 0x114]
mov byte [ebp - 0xa21], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x104
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x24
mov dword [ebp - 0xa40], 0
mov dword [ebp - 0xa38], 0
mov dword [ebp - 0xa34], 0
mov dword [ebp - 0xa30], 0
movzx eax, word [ebx]
push 0
push 0
add eax, ebx
mov dword [ebp - 4], 0
push 0x104
mov dword [ebp - 0xa44], eax
lea eax, [ebp - 0x218]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0xa38]
push eax
call fcn.0040d290
mov ebx, dword [ebp - 0xa38]
test eax, eax
je 0x40e941
mov ecx, dword [0x449ff8]
mov edi, dword [ebp - 0xa34]
test ecx, ecx
je 0x40e6a3
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x40e6a3
test byte [ecx + 8], 2
je 0x40e6a3
cmp byte [ecx + 0xf], 9
jb 0x40e6a3
mov eax, edi
sub eax, ebx
sar eax, 2
push eax
push 0x43d7ec
push 0x70
push edx
push esi
call fcn.0041c0e0
mov ecx, dword [0x449ff8]
sub edi, ebx
xor eax, eax
sar edi, 2
mov dword [ebp - 0xa3c], eax
mov dword [ebp - 0xa20], edi
test edi, edi
je 0x40e981
nop
cmp edi, eax
jbe 0x40ece5
mov esi, dword [ebx + eax*4]
mov dword [ebp - 0xa28], esi
test ecx, ecx
je 0x40e736
mov edi, dword [ecx]
mov eax, edi
mov ebx, dword [ecx + 4]
or eax, ebx
je 0x40e730
test byte [ecx + 8], 2
je 0x40e730
cmp byte [ecx + 0xf], 9
jb 0x40e730
mov edx, dword [esi + 0xc]
test edx, edx
je 0x40e70a
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e6f8
sub ecx, esi
mov esi, dword [ebp - 0xa28]
inc ecx
jmp 0x40e70f
mov ecx, 5
push 0
push ecx
test edx, edx
mov eax, 0x43cc84
cmovne eax, edx
push eax
push 0x71
push 0x43d7ec
push 0x2b
push ebx
push edi
call fcn.0041bd20
add esp, 0x20
mov edi, dword [ebp - 0xa20]
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x40e747
mov ebx, dword [ebp - 0xa28]
xor esi, esi
jmp 0x40e761
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
mov ebx, dword [ebp - 0xa28]
mov esi, eax
add esp, 8
mov eax, dword [ebx + 0xc]
push eax
lea eax, [ebp - 0x114]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
push 0x104
push str.___Citrix_Workspace
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
mov ecx, esi
add esp, 0x14
sub ecx, eax
cmp ecx, esi
jae 0x40e7a9
nop
cmp ecx, 0x104
jae 0x40ece0
mov byte [ebp + ecx - 0x114], 0
inc ecx
cmp ecx, esi
jb 0x40e790
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x40e871
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x40e83e
mov edi, dword [ecx]
mov eax, edi
mov ebx, dword [ecx + 4]
or eax, ebx
je 0x40e838
test byte [ecx + 8], 2
je 0x40e838
cmp byte [ecx + 0xf], 9
jb 0x40e838
lea ecx, [ebp - 0x218]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e7f2
sub ecx, edx
lea edx, [ecx + 1]
lea ecx, [ebp - 0x114]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e807
push 0
push edx
sub ecx, esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x114]
push eax
push 0x73
push 0x43d7ec
push 0x2b
push ebx
push edi
call fcn.0041bd20
add esp, 0x28
mov edi, dword [ebp - 0xa20]
push dword [ebp - 0xa28]
push 1
call sub.CCMSDK.dll_CCMFreeICASession_V2
mov eax, dword [ebp - 0xa3c]
mov ecx, dword [0x449ff8]
inc eax
mov dword [ebp - 0xa3c], eax
cmp eax, edi
jae 0x40e981
mov ebx, dword [ebp - 0xa38]
jmp 0x40e6c0
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x40e8c9
mov edx, dword [ecx]
mov eax, edx
mov esi, dword [ecx + 4]
or eax, esi
je 0x40e8c9
test byte [ecx + 8], 2
je 0x40e8c9
cmp byte [ecx + 0xf], 9
jb 0x40e8c9
lea ecx, [ebp - 0x114]
lea edi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e8a0
sub ecx, edi
push 0
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x114]
push eax
push 0x72
push 0x43d7ec
push 0x2b
push esi
push edx
call fcn.0041bd20
add esp, 0x20
push dword [ebx]
lea eax, [ebp - 0xa21]
push eax
push dword [ebp - 0xa2c]
call fcn.004141e0
mov edi, eax
test edi, edi
jne 0x40e8f6
push 4
push 4
push str.C2H_DesktopRedirectSuccessCount
push str.SoftwareCitrixICA_ClientCEIPDataBidirectionalContentRedirection
call fcn.00429300
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x40ec81
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x40ec81
test byte [ecx + 8], 2
je 0x40ec81
cmp byte [ecx + 0xf], 9
jb 0x40ec81
push 0
push 0x78
push 0x43d7ec
push 0x2b
push edx
push esi
call fcn.0041bd20
add esp, 0x18
jmp 0x40ec81
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x40ea1e
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x40e981
test byte [ecx + 8], 2
je 0x40e981
cmp byte [ecx + 0xf], 9
jb 0x40e981
push 0
push 0x74
push 0x43d7ec
push 0x2b
push edx
push esi
call fcn.0041bd20
mov ecx, dword [0x449ff8]
add esp, 0x18
test ecx, ecx
je 0x40ea1e
mov esi, dword [ecx]
mov eax, esi
mov edi, dword [ecx + 4]
or eax, edi
je 0x40ea1e
test byte [ecx + 8], 2
je 0x40ea1e
cmp byte [ecx + 0xf], 9
jb 0x40ea1e
mov eax, dword [ebp - 0xa1c]
test eax, eax
je 0x40e9fd
movzx edx, word [eax]
test dx, dx
je 0x40e9e7
mov ecx, eax
lea ebx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e9c0
sub ecx, ebx
mov eax, str._NULL_
sar ecx, 1
test dx, dx
cmovne eax, dword [ebp - 0xa1c]
lea ecx, [ecx*2 + 2]
jmp 0x40ea07
test dx, dx
mov eax, str._NULL_
mov ecx, 0xe
cmovne eax, dword [ebp - 0xa1c]
jmp 0x40ea07
mov ecx, 0xa
mov eax, str.NULL
push 0
push ecx
push eax
push 0x75
push 0x43d7ec
push 0x2b
push edi
push esi
call fcn.0041bd20
add esp, 0x20
mov edi, dword [ebp - 0xa2c]
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movzx eax, word [edi + 0x10]
push eax
call ebx
mov esi, eax
add esp, 4
test esi, esi
je 0x40ea64
movzx edi, word [edi + 0x10]
push edi
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test edi, edi
je 0x40ea5e
push edi
push dword [ebp - 0xa2c]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [ebp - 0xa40], esi
mov esi, dword [0x44a088]
mov edx, dword [0x44a084]
lea eax, [esi + edx]
test al, 3
jne 0x40ea9d
lea eax, [esi + 4]
shr eax, 2
cmp dword [0x44a080], eax
ja 0x40ea9d
push 1
mov ecx, 0x44a078
call fcn.00415600
mov esi, dword [0x44a088]
mov edx, dword [0x44a084]
mov ecx, dword [0x44a080]
lea eax, [ecx*4 - 1]
dec ecx
and edx, eax
add esi, edx
mov dword [0x44a084], edx
mov eax, esi
shr eax, 2
and ecx, eax
mov eax, dword [0x44a07c]
cmp dword [eax + ecx*4], 0
lea edi, [ecx*4]
jne 0x40eae6
push 0x10
call fcn.00435e86
mov ecx, dword [0x44a07c]
add esp, 4
mov dword [ecx + edi], eax
mov eax, dword [0x44a07c]
mov eax, dword [eax + edi]
and esi, 3
mov ecx, dword [ebp - 0xa40]
mov dword [eax + esi*4], ecx
inc dword [0x44a088]
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x40eb31
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x40eb31
test byte [ecx + 8], 2
je 0x40eb31
cmp byte [ecx + 0xf], 9
jb 0x40eb31
push 0
push 0x76
push 0x43d7ec
push 0x2b
push edx
push esi
call fcn.0041bd20
add esp, 0x18
push dword [ebp - 0xa48]
lea eax, [ebp - 0xa18]
push str._sSelfServicePluginSelfService.exe
push 0x400
push eax
call fcn.0041c2a0
mov ecx, dword [ebp - 0xa1c]
add esp, 0x10
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40eb60
sub ecx, edx
mov edx, dword [ebp - 0xa44]
sar ecx, 1
lea esi, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40eb80
sub edx, esi
lea edi, [ecx + 0x10]
sar edx, 1
add edi, edx
lea eax, [edi*2 + 2]
push eax
call ebx
mov esi, eax
add esp, 4
test esi, esi
jne 0x40ebf0
mov edx, dword [ebp - 0xa38]
test edx, edx
je 0x40ebe6
mov ecx, dword [ebp - 0xa30]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x40ebdc
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40ebdc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00435eb6
add esp, 8
mov eax, 4
jmp 0x40ecc2
push dword [ebp - 0xa44]
push dword [ebp - 0xa1c]
push str._qlaunch___s___s
push edi
push esi
call fcn.0041c2a0
add esp, 0x14
lea eax, [ebp - 0xa18]
push 1
push 0
push esi
push eax
push str.Open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebx, eax
mov edi, 0xa
xor eax, eax
cmp ebx, 0x20
push esi
cmovg edi, eax
mov dword [ebp - 0xa1c], edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x40ec81
mov edi, dword [ecx]
mov eax, edi
mov edx, dword [ecx + 4]
or eax, edx
je 0x40ec7b
test byte [ecx + 8], 2
je 0x40ec7b
cmp byte [ecx + 0xf], 9
jb 0x40ec7b
push ebx
push esi
lea eax, [ebp - 0xa18]
push eax
push 0x43d7ec
push 0x77
push edx
push edi
call fcn.0041c000
mov edi, dword [ebp - 0xa1c]
mov edx, dword [ebp - 0xa38]
test edx, edx
je 0x40ecc0
mov ecx, dword [ebp - 0xa30]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x40ecb6
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40ecb6
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00435eb6
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043624e
mov esp, ebp
pop ebp
ret 0xc
call fcn.0043652e
call fcn.00416030
int3