Function at 0x410430
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4f3f6c
mov eax, dword fs:[0]
push eax
sub esp, 0x3f4
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x3f0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x408]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x418]
xor ebx, ebx
mov esi, ecx
cmp word [ebp], bx
je 0x41081f
call fcn.00415530
cmp byte [eax + 0x96a], bl
je 0x41081f
cmp byte [0x54d2fa], bl
jne 0x41081f
call fcn.00415530
cmp byte [eax + 0x128], bl
je 0x4104af
add eax, 0x18
jmp 0x4104b2
mov eax, dword [eax + 0x14]
lea edi, [eax + 4]
cmp edi, ebx
je 0x410823
cmp word [edi], bx
je 0x410823
lea ecx, [esp + 0x2dc]
call fcn.00410c10
mov eax, edi
lea edx, [esp + 0x2dc]
mov dword [esp + 0x410], ebx
call fcn.00410e40
push ebx
push ebx
push ebx
push ebx
push ebx
push str.SGTool.exe
lea ecx, [esp + 0xa8]
call fcn.00415c40
lea eax, [esp + 0x9c]
cmp byte [esp + 0x1ac], bl
jne 0x410514
mov eax, dword [esp + 0x98]
cmp word [eax + 4], 0x2e
jne 0x410531
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x2e0]
call fcn.00417080
jmp 0x410545
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x2e0]
call fcn.00416320
mov dword [esp + 0x90], vtable.t_str.0
cmp byte [esp + 0x1ac], bl
jne 0x410574
mov eax, dword [esp + 0x98]
lea edx, [esp + 0x9c]
cmp eax, edx
je 0x410574
push eax
call fcn.004d1d15
add esp, 4
mov dword [esp + 0x410], 1
mov dword [esp + 0x18], vtable.t_errorList.0
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], vtable.t_errorList::t_mem.0
lea edi, [esp + 0x18]
mov byte [esp + 0x410], 2
call fcn.0041be80
test al, al
jne 0x4105d6
push 0x52a298
mov ecx, esi
call fcn.00401490
lea ecx, [esp + 0x18]
call fcn.0041be40
lea ecx, [esp + 0x2dc]
call fcn.004161d0
jmp 0x41083e
mov eax, dword [esp + 0x41c]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov edi, ebp
call fcn.0041bfa0
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebp, eax
cmp ebp, ebx
jne 0x410602
push 0x52a2b4
jmp 0x4105b5
push 6
push ebp
call fcn.00418e70
push 6
push ebp
call fcn.00418ec0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 0x10
push ebx
push 1
push 0x10000000
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], ebx
call edi
push eax
push ebp
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x41064e
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x52a2c8
jmp 0x4105b5
push 0x40
lea eax, [esp + 0x4c]
push ebx
push eax
mov dword [esp + 0x50], 0x44
call fcn.004d6770
xor eax, eax
add esp, 0xc
lea ecx, [esp + 0x1b4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call fcn.00410c10
push 0x527250
push 0x52a3bc
lea edx, [esp + 0x1bc]
mov byte [esp + 0x418], 3
call fcn.004114a0
add esp, 8
lea ecx, [esp + 0x2dc]
call fcn.004162a0
push eax
push 0x52a3bc
lea edx, [esp + 0x1bc]
call fcn.004114a0
push 0x527250
push 0x52a3bc
lea edx, [esp + 0x1c4]
call fcn.004114a0
push str.___appiderrorreport
push 0x52a3bc
lea edx, [esp + 0x1cc]
call fcn.004114a0
push str.__list
push 0x52a3bc
lea edx, [esp + 0x1d4]
call fcn.004114a0
push str.__hevent
push 0x52a3bc
lea edx, [esp + 0x1dc]
call fcn.004114a0
mov ecx, dword [esp + 0x3c]
push ecx
push 0x52a3b4
lea edx, [esp + 0x1e4]
call fcn.004114a0
add esp, 0x30
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x48]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
mov ecx, 0x104
lea eax, [esp + 0x1d4]
call fcn.00411180
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4107bd
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call edi
mov ecx, dword [esp + 0x14]
push ecx
call edi
lea edi, [esp + 0x1b4]
call fcn.004111b0
lea ecx, [esp + 0x2dc]
call fcn.004162a0
push eax
push str._T_vz1Y_
mov ebx, esi
call fcn.00410870
mov ecx, eax
call fcn.004109f0
mov ecx, eax
call fcn.004109f0
push 0x52a298
mov ecx, esi
call fcn.00401490
mov ecx, edi
call fcn.004161d0
jmp 0x4105bc
lea edi, [esp + 0x1b4]
call fcn.004111b0
mov edx, dword [esp + 0x2c]
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x44]
push eax
push 2
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], ebp
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ecx, dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x30]
push edx
call esi
push ebp
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
mov ecx, edi
call fcn.004161d0
lea ecx, [esp + 0x18]
call fcn.0041be40
lea ecx, [esp + 0x2dc]
call fcn.004161d0
mov al, 1
jmp 0x410840
mov ecx, esi
call fcn.0040fa50
push 0x52a26c
push 0x52a3bc
mov edx, eax
call fcn.004114a0
add esp, 8
xor al, al
mov ecx, dword [esp + 0x408]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3f0]
xor ecx, esp
call fcn.004d158d
add esp, 0x400
ret