Function at 0x414b50
Capabilities:
Create process on windows
Create process suspended
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x51cef0
mov eax, dword fs:[0]
push eax
sub esp, 0x194
mov eax, dword [0x5b339c]
xor eax, esp
mov dword [esp + 0x190], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b339c]
xor eax, esp
push eax
lea eax, [esp + 0x1a8]
mov dword fs:[0], eax
push str..PSTServer.cpp
push 0x3b9
mov esi, ecx
mov ecx, dword [0x5b6bb0]
push str.CPSTServer::LaunchConfigShell
call fcn.00402490
cmp byte [esi + 0x374], 1
je 0x414e08
cmp byte [esi + 0x299], 0
je 0x414e08
mov ebx, dword [sym.imp.MSVCP90.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::operator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea edi, [esi + 0x148]
push edi
lea ebp, [esi + 0x384]
lea eax, [esp + 0x1c]
push ebp
push eax
call ebx
add esp, 0xc
mov dword [esp + 0x1b0], 0
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
setne byte [esp + 0x17]
mov dword [esp + 0x1b0], 0xffffffff
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
cmp byte [esp + 0x17], 0
jne 0x414e08
push 0x44
lea ecx, [esp + 0x48]
push 0
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [esp + 0xa4]
push eax
mov edx, 1
push 0x80
mov dword [esp + 0x4c], 0x44
mov word [esp + 0x7c], dx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x88]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov dword [esp + 0x1b0], 1
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.00414a80
mov byte [esp + 0x1b0], 2
push eax
lea ecx, [esp + 0x8c]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov byte [esp + 0x1b0], 1
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push 0x57eecc
lea ecx, [esp + 0x8c]
call dword [0x539464]
push edi
lea edx, [esp + 0x1c]
push ebp
push edx
call ebx
add esp, 0xc
mov byte [esp + 0x1b0], 3
push eax
lea ecx, [esp + 0x8c]
call dword [0x539434]
mov byte [esp + 0x1b0], 1
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push 0x57eecc
lea ecx, [esp + 0x8c]
call dword [0x539464]
lea eax, [esi + 0x20c]
push eax
lea ecx, [esp + 0x8c]
call dword [0x539434]
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0xac]
push eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0xa8]
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x414dba
mov ecx, dword [0x5b6bb0]
mov esi, dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x8c]
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
mov edx, dword [0x5b6bb0]
push eax
mov eax, dword [esi]
push str.Could_not_launch_configuration_shell___ls____error__d
push str.CPSTServer::LaunchConfigShell
push 1
push edx
call eax
mov ecx, dword [0x5b6bb0]
add esp, 0x18
push 0
push str.false
push str..PSTServer.cpp
push 0x3e6
push str.CPSTServer::LaunchConfigShell
call fcn.00402520
mov dword [esp + 0x1b0], 0xffffffff
lea ecx, [esp + 0x88]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor al, al
jmp 0x414e0a
mov ecx, dword [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x34]
push 1
push str.true
push str..PSTServer.cpp
push 0x3ee
mov dword [esi + 0x350], edx
mov ecx, dword [0x5b6bb0]
push str.CPSTServer::LaunchConfigShell
call fcn.00402520
mov dword [esp + 0x1b0], 0xffffffff
lea ecx, [esp + 0x88]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, 1
mov ecx, dword [esp + 0x1a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0051973e
add esp, 0x1a0
ret