Function at 0x404910
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x10158
call fcn.00416f60
sub rsp, rax
mov rax, qword [0x0042a008]
xor rax, rsp
mov qword [rsp + 0x10110], rax
mov qword [rsp + 0x10150], rbx
mov qword [rsp + 0x10148], rbp
mov qword [rsp + 0x10130], r12
mov qword [rsp + 0x10128], r13
mov r12, r8
mov r13, rcx
mov rbx, rdx
mov qword [rsp + 0x10120], r15
xor r15d, r15d
lea rcx, [rsp + 0x70]
lea r8d, [r15 + 0x68]
xor edx, edx
mov rbp, r9
mov dword [rsp + 0x50], r15d
call fcn.00408340
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
movzx eax, byte [r13 + 6]
or ax, word [rsp + 0xb0]
je 0x4049af
mov word [rsp + 0xb0], 5
jmp 0x4049c5
movzx eax, byte [r13 + 8]
neg al
sbb cx, cx
and cx, 6
mov word [rsp + 0xb0], cx
or dword [rsp + 0xac], 1
add rbx, 0x3e80
mov qword [rsp + 0x10138], rdi
xor eax, eax
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
add rcx, 0x13
cmp rcx, 0xfa0
jae 0x404a4a
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str.Attempting_to_run:__]
mov qword [rdi - 2], rax
mov rax, qword [0x004178f0]
mov qword [rdi + 6], rax
mov rax, qword [0x004178f8]
mov qword [rdi + 0xe], rax
mov rax, qword [0x00417900]
mov qword [rdi + 0x16], rax
mov rax, qword [0x00417908]
mov qword [rdi + 0x1e], rax
movzx eax, word [0x00417910]
mov word [rdi + 0x26], ax
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r12
repne scasw ax, word [rdi]
mov rdi, rbx
not rcx
lea rdx, [rcx - 1]
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
add rdx, rcx
cmp rdx, 0xfa0
jae 0x404aa3
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
xor ecx, ecx
nop
movzx eax, word [r12 + rcx]
add rcx, 2
test ax, ax
mov word [rdi + rcx - 4], ax
jne 0x404a90
cmp byte [r13 + 7], r15b
mov qword [rsp + 0x10140], rsi
jne 0x404af2
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
add rcx, 0x28
cmp rcx, 0xfa0
jae 0x404b31
mov rdi, rbx
mov rcx, 0xffffffffffffffff
lea rsi, str._.__Blocking_until_child_thread_returns._n
repne scasw ax, word [rdi]
mov ecx, 0x2a
sub rdi, 2
rep movsw word [rdi], word [rsi]
jmp 0x404b31
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
add rcx, 0x2c
cmp rcx, 0xfa0
jae 0x404b31
mov rdi, rbx
mov rcx, 0xffffffffffffffff
lea rsi, str._.__Not_blocking_until_child_thread_returns._n
repne scasw ax, word [rdi]
mov ecx, 0x2e
sub rdi, 2
rep movsw word [rdi], word [rsi]
test rbp, rbp
je 0x404c12
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
add rcx, 0x27
cmp rcx, 0xfa0
jae 0x404b79
mov rdi, rbx
mov rcx, 0xffffffffffffffff
lea rsi, str.Using_the_following_working_directory:__
repne scasw ax, word [rdi]
mov ecx, 0x29
sub rdi, 2
rep movsw word [rdi], word [rsi]
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
mov rdi, rbx
not rcx
lea rdx, [rcx - 1]
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
add rdx, rcx
cmp rdx, 0xfa0
jae 0x404bd2
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
xor ecx, ecx
nop
movzx eax, word [rcx + rbp]
add rcx, 2
test ax, ax
mov word [rdi + rcx - 4], ax
jne 0x404bc0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
add rcx, 1
cmp rcx, 0xfa0
jae 0x404c12
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x004177c4]
mov dword [rdi - 2], eax
movzx eax, word [0x004177c8]
mov word [rdi + 2], ax
cmp byte [r13 + 1], r15b
je 0x404c51
lea r8, str.Debug_Information
xor r9d, r9d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [0x004175e4]
mov rcx, rbx
sub rcx, rdx
nop
nop
movzx eax, word [rdx]
add rdx, 2
test ax, ax
mov word [rcx + rdx - 2], ax
jne 0x404c40
lea rax, [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rdx, r12
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r15
xor ecx, ecx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r12, qword [rsp + 0x10130]
test eax, eax
jne 0x404d01
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
add rcx, 0x10
cmp rcx, 0xfa0
jae 0x404cfa
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str.Execution_Failed_]
mov qword [rdi - 2], rax
mov rax, qword [0x004177a8]
mov qword [rdi + 6], rax
mov rax, qword [0x004177b0]
mov qword [rdi + 0xe], rax
mov rax, qword [0x004177b8]
mov qword [rdi + 0x16], rax
mov eax, dword [0x004177c0]
mov dword [rdi + 0x1e], eax
xor eax, eax
jmp 0x404ed4
cmp byte [r13 + 7], r15b
jne 0x404ecf
mov edx, dword [0x0042a000]
test edx, edx
jne 0x404d1c
mov edx, 0xffffffff
jmp 0x404d22
imul edx, edx, 0x3e8
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x0042a000], r15d
je 0x404e56
mov rax, qword [str.TASKKILL.exe__F__T__PID]
lea rcx, [rsp + 0x110]
xor edx, edx
mov qword [rcx], rax
mov rax, qword [0x00417770]
mov r8d, 0xffcc
mov qword [rcx + 8], rax
mov rax, qword [0x00417778]
mov qword [rcx + 0x10], rax
mov rax, qword [0x00417780]
mov qword [rcx + 0x18], rax
mov rax, qword [0x00417788]
mov qword [rcx + 0x20], rax
mov rax, qword [0x00417790]
mov qword [rcx + 0x28], rax
movzx eax, word [0x00417798]
mov word [rcx + 0x30], ax
lea rcx, [rsp + 0x142]
call fcn.00408340
xor eax, eax
mov word [rsp + 0xf8], r15w
mov qword [rsp + 0xfa], rax
mov qword [rsp + 0x102], rax
mov word [rsp + 0x10a], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0xf8]
mov r8d, 0xa
mov ecx, eax
call fcn.00408210
lea rdi, [rsp + 0x110]
mov rcx, 0xffffffffffffffff
mov rsi, rax
xor eax, eax
repne scasw ax, word [rdi]
xor edx, edx
nop
nop
movzx ecx, word [rsi + rdx]
add rdx, 2
test cx, cx
mov word [rdi + rdx - 4], cx
jne 0x404e00
lea rax, [rsp + 0xe0]
lea rdx, [rsp + 0x110]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r15
xor ecx, ecx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
add rcx, 0x12
cmp rcx, 0xfa0
jae 0x404ec9
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str.Execution_complete.]
mov qword [rdi - 2], rax
mov rax, qword [0x00417748]
mov qword [rdi + 6], rax
mov rax, qword [0x00417750]
mov qword [rdi + 0xe], rax
mov rax, qword [0x00417758]
mov qword [rdi + 0x16], rax
mov rax, qword [0x00417760]
mov qword [rdi + 0x1e], rax
mov eax, dword [rsp + 0x50]
jmp 0x404ed4
mov eax, 1
mov r15, qword [rsp + 0x10120]
mov r13, qword [rsp + 0x10128]
mov rdi, qword [rsp + 0x10138]
mov rsi, qword [rsp + 0x10140]
mov rbp, qword [rsp + 0x10148]
mov rbx, qword [rsp + 0x10150]
mov rcx, qword [rsp + 0x10110]
xor rcx, rsp
call fcn.00408310
add rsp, 0x10158
ret