Function at 0x663cab
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov eax, 0x684652
call fcn.006313fc
sub esp, 0x2a0
push ebx
lea eax, [esp + 7]
mov byte [esp + 7], 0
push eax
lea eax, [esp + 0x44]
mov ebx, ecx
push eax
call fcn.00663503
and dword [esp + 0x2ac], 0
cmp byte [esp + 7], 0
jne 0x663ce8
xor bl, bl
jmp 0x6643c0
push ebp
push esi
push edi
push 0x44
pop esi
push esi
lea eax, [esp + 0xfc]
push 0
push eax
call fcn.00635a30
xor eax, eax
mov dword [esp + 0x104], esi
lea edi, [esp + 0x88]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov esi, eax
xor ebp, ebp
lea eax, [esp + 0x13c]
push ebp
mov dword [esp + 0x34], eax
lea eax, [esp + 0x34]
push eax
push 1
push str.S:_ML__NW___LW_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
mov eax, dword [esp + 0x30]
push ebp
push ebp
push 6
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb0], 0xc
mov dword [esp + 0xb8], 1
call fcn.00662858
neg eax
lea ecx, [esp + 0x200]
push 1
sbb edi, edi
lea eax, [esp + 0xa8]
push 3
and edi, eax
call fcn.00661561
push dword [0x75aedc]
mov ecx, 0x75aed8
mov byte [esp + 0x2bc], 1
push dword [0x75aed8]
push 0x7999e8
call fcn.006613fc
push eax
mov eax, 0x6ff128
push eax
push ebx
push eax
push esi
push eax
mov esi, 0x75aee0
lea eax, [esp + 0x228]
push esi
push eax
call fcn.00490747
push eax
call fcn.0042396e
mov ecx, eax
call fcn.00661e29
push eax
call fcn.0042396e
mov ecx, eax
call fcn.00661f2e
push eax
call fcn.0042396e
mov ecx, eax
call fcn.004908f0
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x204]
call fcn.0066464c
push 0x78
mov byte [esp + 0x2bc], 2
call fcn.00630af1
pop ecx
mov dword [esp + 0x2c], eax
mov byte [esp + 0x2b8], 3
test eax, eax
je 0x663e37
push edi
push ebx
push 0x662f7b
lea ecx, [esp + 0xec]
push ecx
mov ecx, eax
call fcn.00664bbd
jmp 0x663e39
mov eax, ebp
mov ecx, dword [ebx + 0x44]
mov byte [esp + 0x2b8], 2
mov dword [ebx + 0x44], eax
test ecx, ecx
je 0x663e51
mov eax, dword [ecx]
push 1
call dword [eax]
push 1
push 3
lea ecx, [esp + 0x158]
call fcn.00661561
push esi
mov eax, 0x689678
mov byte [esp + 0x2bc], 4
push eax
push 0x75aef8
push eax
lea eax, [esp + 0xf0]
push eax
push 0x68a864
lea eax, [esp + 0x64]
push eax
push 0x68a860
lea eax, [esp + 0x180]
push eax
call fcn.0042396e
push eax
call fcn.00490747
push eax
call fcn.0042396e
push eax
call fcn.00490747
push eax
call fcn.0042396e
push eax
call fcn.00490747
push eax
call fcn.0042396e
push eax
call fcn.00490747
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0x154]
call fcn.0066464c
xor eax, eax
mov dword [esp + 0xa0], 0xf
mov dword [esp + 0x9c], eax
mov byte [esp + 0x8c], al
push eax
push eax
push 6
mov byte [esp + 0x2c4], 6
call fcn.00662858
test eax, eax
je 0x663fd7
call fcn.006621d8
movzx esi, byte [0x75f8ce]
lea ecx, [esp + 0x34]
neg esi
push str.lowIntegrity_created
sbb esi, esi
and esi, eax
call fcn.00409ba7
xor eax, eax
mov byte [esp + 0x2b8], 7
push 1
test esi, esi
setne al
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00483ac8
push 0xffffffffffffffff
xor ebp, ebp
mov byte [esp + 0x2bc], 8
push ebp
push eax
lea ecx, [esp + 0x98]
call fcn.00409c77
push ebp
push 1
lea ecx, [esp + 0x1c]
call fcn.0040a0e9
push ebp
push 1
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2c0], 6
call fcn.0040a0e9
cmp dword [esp + 0xc4], 8
mov ecx, dword [esp + 0xb0]
jae 0x663f9f
lea ecx, [esp + 0xb0]
cmp dword [esp + 0x60], 8
mov eax, dword [esp + 0x4c]
jae 0x663fae
lea eax, [esp + 0x4c]
lea edx, [esp + 0x7c]
push edx
lea edx, [esp + 0xfc]
push edx
xor edx, edx
push edx
push edx
push edx
push edx
push edx
push edx
push ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x66401d
cmp dword [esp + 0xc4], 8
mov ecx, dword [esp + 0xb0]
jae 0x663fef
lea ecx, [esp + 0xb0]
cmp dword [esp + 0x60], 8
mov eax, dword [esp + 0x4c]
jae 0x663ffe
lea eax, [esp + 0x4c]
lea edx, [esp + 0x7c]
push edx
lea edx, [esp + 0xfc]
push edx
xor edx, edx
push edx
push edx
push edx
push edx
push edx
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov edi, eax
test edi, edi
jne 0x66415a
cmp dword [esp + 0x60], 8
mov eax, dword [esp + 0x4c]
jae 0x664034
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push str.exe_exist
lea ecx, [esp + 0x38]
mov esi, eax
call fcn.00409ba7
push 1
push esi
lea eax, [esp + 0x3c]
mov byte [esp + 0x2c0], 9
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00483ac8
push 0xffffffffffffffff
xor ebx, ebx
mov byte [esp + 0x2bc], 0xa
push ebx
push eax
lea ecx, [esp + 0x98]
call fcn.00409c77
push ebx
push 1
lea ecx, [esp + 0x1c]
call fcn.0040a0e9
push ebx
push 1
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2c0], 6
call fcn.0040a0e9
push str.Unable_to_create_remote_ie_process
lea ecx, [esp + 0x68]
call fcn.00409ba7
push 0x6a461c
lea ecx, [esp + 0x38]
mov byte [esp + 0x2bc], 0xb
call fcn.00409ba7
push ebx
lea eax, [esp + 0x68]
mov byte [esp + 0x2bc], 0xc
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00483a6d
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x98]
mov byte [esp + 0x2c4], 0xd
call fcn.00409c77
push ebx
push 1
lea ecx, [esp + 0x1c]
call fcn.0040a0e9
push ebx
push 1
lea ecx, [esp + 0x3c]
call fcn.0040a0e9
push ebx
push 1
lea ecx, [esp + 0x6c]
mov byte [esp + 0x2c0], 6
call fcn.0040a0e9
push str.remote_ieprocess
lea ecx, [esp + 0x68]
call fcn.00409ba7
push ebx
push ebx
lea eax, [esp + 0x6c]
mov byte [esp + 0x2c0], 0xe
push ebx
push eax
lea eax, [esp + 0x9c]
push eax
push 0x2c
call fcn.00484725
lea ecx, [esp + 0x64]
jmp 0x66436e
mov eax, dword [esp + 0x7c]
mov ecx, dword [ebx + 0x44]
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x80]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x88]
mov dword [ebx + 8], eax
test ecx, ecx
je 0x664191
push 0x7530
call fcn.00664dfe
test al, al
je 0x664191
mov bl, 1
jmp 0x664376
and dword [esp + 0x44], 0
mov dword [esp + 0x48], 0xf
mov byte [esp + 0x34], 0
cmp dword [ebx + 0x44], 0
mov byte [esp + 0x2b8], 0xf
jne 0x664224
push str.No_pipeServer_available
lea ecx, [esp + 0x18]
call fcn.00409ba7
push str.pipe_error
lea ecx, [esp + 0x68]
mov byte [esp + 0x2bc], 0x10
call fcn.00409ba7
xor ebx, ebx
mov byte [esp + 0x2b8], 0x11
push ebx
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0xd4]
push eax
call fcn.00483a6d
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x2c4], 0x12
call fcn.00409c77
push ebx
push 1
lea ecx, [esp + 0xd0]
call fcn.0040a0e9
lea ecx, [esp + 0x64]
jmp 0x664318
push str.timeout_on_waiting_for_remote_ie_process_to_connect
lea ecx, [esp + 0x68]
call fcn.00409ba7
push str.timeout_error
lea ecx, [esp + 0x18]
mov byte [esp + 0x2bc], 0x13
call fcn.00409ba7
push 1
lea eax, [esp + 0x68]
mov byte [esp + 0x2bc], 0x14
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0xd4]
push eax
call fcn.00483a6d
push 0xffffffffffffffff
xor ebx, ebx
mov byte [esp + 0x2bc], 0x15
push ebx
push eax
lea ecx, [esp + 0x40]
call fcn.00409c77
push ebx
push 1
lea ecx, [esp + 0xd0]
call fcn.0040a0e9
push ebx
push 1
lea ecx, [esp + 0x1c]
call fcn.0040a0e9
push ebx
push 1
lea ecx, [esp + 0x6c]
mov byte [esp + 0x2c0], 0xf
call fcn.0040a0e9
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x80]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
je 0x664334
push str.ie_alive
lea ecx, [esp + 0x18]
call fcn.00409ba7
xor eax, eax
mov byte [esp + 0x2b8], 0x16
cmp dword [esp + 0x2c], 0x103
push ebx
sete al
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0xd4]
push eax
call fcn.00483ac8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x2c4], 0x17
call fcn.00409c77
lea ecx, [esp + 0xc8]
push ebx
push 1
call fcn.0040a0e9
push ebx
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c0], 0xf
call fcn.0040a0e9
push str.remote_ieprocess
lea ecx, [esp + 0x18]
call fcn.00409ba7
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
mov byte [esp + 0x2c4], 0x18
push eax
lea eax, [esp + 0x44]
push eax
push 0x2c
call fcn.00484725
push ebx
push 1
lea ecx, [esp + 0x1c]
call fcn.0040a0e9
lea ecx, [esp + 0x34]
push ebx
push 1
call fcn.0040a0e9
xor ebp, ebp
lea ecx, [esp + 0x8c]
push ebp
push 1
call fcn.0040a0e9
push ebp
push 1
lea ecx, [esp + 0xb8]
call fcn.0042341c
lea ecx, [esp + 0x150]
call fcn.006620b4
push ebp
push 1
lea ecx, [esp + 0xe8]
call fcn.0042341c
lea ecx, [esp + 0x200]
call fcn.006620b4
pop edi
pop esi
pop ebp
push 0
push 1
lea ecx, [esp + 0x48]
call fcn.0042341c
mov ecx, dword [esp + 0x2a4]
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret