Function at 0x403810
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41a40b
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x4213d4]
xor eax, esp
mov dword [esp + 0x98], eax
push ebx
push esi
push edi
mov eax, dword [0x4213d4]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
call fcn.00402120
test al, al
je 0x403860
xor eax, eax
jmp 0x403b08
lea eax, [esp + 0x30]
push 1
mov ecx, eax
xor edi, edi
push ecx
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], 0xc
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov edx, dword [esp + 0x28]
push edi
push edi
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push str.DDUninstallSystemLocked
push edi
push edi
lea eax, [esp + 0x30]
push eax
call esi
mov dword [0x423664], eax
cmp eax, edi
je 0x403af4
push str.DDUninstallSystemUnlocked
push edi
push edi
lea ecx, [esp + 0x30]
push ecx
call esi
mov dword [0x423668], eax
cmp eax, edi
je 0x403ae4
xor edx, edx
push 0x12
mov eax, str.AVTray.exe__unlock
lea esi, [esp + 0x90]
mov dword [esp + 0xa4], 7
mov dword [esp + 0xa0], edi
mov word [esp + 0x90], dx
call fcn.00405150
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
mov esi, 8
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x8c]
cmp dword [esp + 0xa0], esi
jae 0x40393c
lea eax, [esp + 0x8c]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x48]
push edx
push edi
push edi
push 0x10
push edi
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40395d
xor al, al
jmp 0x403973
mov eax, dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
mov ecx, dword [esp + 0x14]
push ecx
call ebx
mov al, 1
test al, al
sete bl
cmp dword [esp + 0xa0], esi
jb 0x403991
mov edx, dword [esp + 0x8c]
push edx
call fcn.00409f88
add esp, 4
test bl, bl
jne 0x403ae4
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
push 1
lea esi, [esp + 0x14]
mov dword [esp + 0xbc], edi
call fcn.00406410
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x4039c7
mov ecx, dword [0x423664]
mov dword [eax], ecx
mov esi, dword [esp + 0x10]
add eax, 4
mov dword [esp + 0x14], eax
cmp eax, 0x423668
jbe 0x403a53
cmp esi, 0x423668
ja 0x403a53
mov edx, dword [esp + 0x18]
mov edi, 0x423668
sub edi, esi
sar edi, 2
cmp eax, edx
jne 0x403a43
mov ecx, eax
sub ecx, esi
sar ecx, 2
cmp ecx, 0x3ffffffe
jbe 0x403a0c
push str.vector_T__too_long
call fcn.00409180
sub edx, esi
inc ecx
sar edx, 2
cmp ecx, edx
jbe 0x403a43
mov eax, edx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, eax
jae 0x403a29
xor eax, eax
jmp 0x403a2b
add eax, edx
cmp eax, ecx
jae 0x403a31
mov eax, ecx
push eax
lea esi, [esp + 0x14]
call fcn.00406410
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test eax, eax
je 0x403a4c
mov edx, dword [esi + edi*4]
mov dword [eax], edx
add eax, 4
xor edi, edi
jmp 0x403aba
mov edx, dword [esp + 0x18]
cmp eax, edx
jne 0x403aab
mov ecx, eax
sub ecx, esi
sar ecx, 2
cmp ecx, 0x3ffffffe
jbe 0x403a74
push str.vector_T__too_long
call fcn.00409180
sub edx, esi
inc ecx
sar edx, 2
cmp ecx, edx
jbe 0x403aab
mov eax, edx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, eax
jae 0x403a91
xor eax, eax
jmp 0x403a93
add eax, edx
cmp eax, ecx
jae 0x403a99
mov eax, ecx
push eax
lea esi, [esp + 0x14]
call fcn.00406410
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp eax, edi
je 0x403ab7
mov ecx, dword [0x423668]
mov dword [eax], ecx
add eax, 4
push 0xffffffffffffffff
push edi
sub eax, esi
push esi
sar eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0xffffffff
je 0x403ad7
cmp eax, edi
je 0x403ad7
mov dword [esp + 0x20], edi
cmp esi, edi
je 0x403ae4
push esi
call fcn.00409f88
add esp, 4
mov eax, dword [0x423664]
cmp eax, edi
je 0x403af4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x423668]
cmp eax, edi
je 0x403b04
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.004097da
mov esp, ebp
pop ebp
ret