Function at 0x69863e
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
sub esp, 0x6c
mov eax, 0x6bcace
call fcn.006426c4
sub esp, 0x218
push ebx
lea eax, [ebp + 0x6f]
mov byte [ebp + 0x6f], 0
push eax
lea eax, [ebp + 0x1c]
mov ebx, ecx
push eax
call fcn.00697f79
and dword [ebp - 4], 0
cmp byte [ebp + 0x6f], 0
jne 0x698677
xor bl, bl
jmp 0x698bbe
push esi
push edi
push 0x44
pop esi
push esi
lea eax, [ebp - 0xb0]
push 0
push eax
call fcn.0065d010
xor eax, eax
mov dword [ebp - 0xb0], esi
lea edi, [ebp + 0xc]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov esi, eax
xor edi, edi
lea eax, [ebp - 0xc4]
push edi
mov dword [ebp + 0x50], eax
lea eax, [ebp + 0x50]
push eax
push 1
push str.S:_ML__NW___LW_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
mov eax, dword [ebp + 0x50]
push edi
push edi
push 6
mov dword [ebp + 4], eax
mov dword [ebp], 0xc
mov dword [ebp + 8], 1
call fcn.006972de
neg eax
lea ecx, [ebp - 0x224]
push 1
sbb edi, edi
lea eax, [ebp]
push 3
and edi, eax
call fcn.0049c34a
push dword [0x7aaf94]
mov ecx, 0x7aaf90
mov byte [ebp - 4], 1
push dword [0x7aaf90]
push 0x7edf08
call fcn.006960dc
push eax
mov eax, 0x73d290
push eax
push ebx
push eax
push esi
push eax
mov esi, 0x7aaf98
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.00494638
push eax
call fcn.00428b66
mov ecx, eax
call fcn.005a55f1
push eax
call fcn.00428b66
mov ecx, eax
call fcn.00696a98
push eax
call fcn.00428b66
mov ecx, eax
call fcn.004947ea
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x224]
call fcn.004bd392
mov byte [ebp - 4], 2
push 0x78
call fcn.00642424
pop ecx
mov dword [ebp + 0x4c], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x698793
push edi
push ebx
push 0x6979c7
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, eax
call fcn.00699874
jmp 0x698795
xor eax, eax
mov ecx, dword [ebx + 0x80]
mov byte [ebp - 4], 2
mov dword [ebx + 0x80], eax
test ecx, ecx
je 0x6987af
mov eax, dword [ecx]
push 1
call dword [eax]
push 1
push 3
lea ecx, [ebp - 0x174]
call fcn.0049c34a
push esi
mov eax, 0x6c3d10
mov byte [ebp - 4], 4
push eax
push 0x7aafb0
push eax
lea eax, [ebp - 0x6c]
push eax
push 0x6c4f14
lea eax, [ebp + 0x1c]
push eax
push 0x6c4f10
lea eax, [ebp - 0x164]
push eax
call fcn.00428b66
push eax
call fcn.00494638
push eax
call fcn.00428b66
push eax
call fcn.00494638
push eax
call fcn.00428b66
push eax
call fcn.00494638
push eax
call fcn.00428b66
push eax
call fcn.00494638
and dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], 0
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x174]
call fcn.004bd392
push 0
push 0
push 6
mov byte [ebp - 4], 6
call fcn.006972de
test eax, eax
je 0x6988fa
call fcn.00696c53
movzx esi, byte [0x7b0fcd]
lea ecx, [ebp + 0x54]
neg esi
push str.lowIntegrity_created
sbb esi, esi
and esi, eax
call fcn.0040f32f
test esi, esi
mov byte [ebp - 4], 7
push 1
setne al
movzx eax, al
push eax
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.004967fc
push 0xffffffffffffffff
xor edi, edi
mov byte [ebp - 4], 8
push edi
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040f409
push edi
push 1
lea ecx, [ebp + 0x34]
call fcn.0040f95f
push edi
push 1
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 6
call fcn.0040f95f
cmp dword [ebp - 0x10], 8
mov ecx, dword [ebp - 0x24]
jae 0x6988c3
lea ecx, [ebp - 0x24]
cmp dword [ebp + 0x30], 8
mov eax, dword [ebp + 0x1c]
jae 0x6988cf
lea eax, [ebp + 0x1c]
lea edx, [ebp + 0xc]
push edx
lea edx, [ebp - 0xb0]
push edx
xor edx, edx
push edx
push edx
push edx
push edx
push edx
push edx
push ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
test esi, esi
je 0x69892f
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x69892f
cmp dword [ebp - 0x10], 8
mov ecx, dword [ebp - 0x24]
jae 0x698906
lea ecx, [ebp - 0x24]
cmp dword [ebp + 0x30], 8
mov eax, dword [ebp + 0x1c]
jae 0x698912
lea eax, [ebp + 0x1c]
lea edx, [ebp + 0xc]
push edx
lea edx, [ebp - 0xb0]
push edx
xor edx, edx
push edx
push edx
push edx
push edx
push edx
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov edi, eax
test edi, edi
jne 0x698a0f
cmp dword [ebp + 0x30], 8
mov eax, dword [ebp + 0x1c]
jae 0x698943
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push str.exe_exist
lea ecx, [ebp + 0x54]
mov esi, eax
call fcn.0040f32f
push 1
push esi
lea eax, [ebp + 0x54]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.0046cc6c
push 0xffffffffffffffff
xor ebx, ebx
mov byte [ebp - 4], 0xa
push ebx
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040f409
push ebx
push 1
lea ecx, [ebp + 0x34]
call fcn.0040f95f
push ebx
push 1
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 6
call fcn.0040f95f
push str.message
lea ecx, [ebp + 0x54]
call fcn.0040f32f
push ebx
push str.Unable_to_create_remote_ie_process
lea eax, [ebp + 0x54]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.0046adc6
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0xc
call fcn.0040f409
push ebx
push 1
lea ecx, [ebp + 0x34]
call fcn.0040f95f
push ebx
push 1
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 6
call fcn.0040f95f
push str.remote_ieprocess
lea ecx, [ebp + 0x54]
call fcn.0040f32f
push ebx
push ebx
push ebx
lea eax, [ebp + 0x54]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x2c
call fcn.00489021
jmp 0x698b78
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0x18]
push ecx
lea ecx, [ebx + 0x28]
mov dword [ebx + 8], eax
call fcn.0069946a
mov ecx, dword [ebx + 0x80]
test ecx, ecx
je 0x698a49
push 0x7530
call fcn.00699abe
test al, al
je 0x698a49
mov bl, 1
jmp 0x698b83
and dword [ebp + 0x64], 0
mov dword [ebp + 0x68], 0xf
mov byte [ebp + 0x54], 0
cmp dword [ebx + 0x80], 0
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 0xe
jne 0x698a94
push str.pipe_error
call fcn.0040f32f
xor ebx, ebx
mov byte [ebp - 4], 0xf
push ebx
push str.No_pipeServer_available
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0046adc6
mov byte [ebp - 4], 0x10
jmp 0x698b24
push str.timeout_error
call fcn.0040f32f
push 1
push str.timeout_on_waiting_for_remote_ie_process_to_connect
lea eax, [ebp + 0x34]
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0046adc6
push 0xffffffffffffffff
xor ebx, ebx
mov byte [ebp - 4], 0x12
push ebx
push eax
lea ecx, [ebp + 0x54]
call fcn.0040f409
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.0040f95f
push ebx
push 1
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 0xe
call fcn.0040f95f
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
je 0x698b4a
push str.ie_alive
lea ecx, [ebp + 0x34]
call fcn.0040f32f
cmp dword [ebp + 0x4c], 0x103
push ebx
sete al
mov byte [ebp - 4], 0x13
movzx eax, al
push eax
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.004967fc
mov byte [ebp - 4], 0x14
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x54]
call fcn.0040f409
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.0040f95f
push ebx
push 1
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 0xe
call fcn.0040f95f
push str.remote_ieprocess
lea ecx, [ebp + 0x34]
call fcn.0040f32f
push ebx
push ebx
push ebx
lea eax, [ebp + 0x34]
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp + 0x54]
push eax
push 0x2c
call fcn.00489021
push ebx
push 1
lea ecx, [ebp + 0x34]
call fcn.0040f95f
push ebx
push 1
lea ecx, [ebp + 0x54]
call fcn.0040f95f
xor esi, esi
lea ecx, [ebp - 0x24]
push esi
push 1
call fcn.004285f6
push esi
push 1
lea ecx, [ebp - 0x3c]
call fcn.0040f95f
lea ecx, [ebp - 0x174]
call fcn.0049f5b3
push esi
push 1
lea ecx, [ebp - 0x6c]
call fcn.004285f6
lea ecx, [ebp - 0x224]
call fcn.0049f5b3
pop edi
pop esi
push 0
push 1
lea ecx, [ebp + 0x1c]
call fcn.004285f6
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
lea esp, [ebp + 0x70]
pop ebp
ret