Function at 0x413170
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1a14
call fcn.00414210
mov ecx, dword [ebp + 8]
test ecx, ecx
push ebx
push esi
push edi
mov dword [esp + 0x10], 0
jl 0x413780
cmp ecx, 0x64
jge 0x413780
imul ecx, ecx, 0xa10
lea ebx, [ecx + 0x428eb0]
mov eax, ebx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4131b0
sub eax, esi
test eax, eax
mov dword [esp + 0x14], eax
jle 0x41376d
mov ecx, dword [ecx + 0x428ca0]
cmp ecx, 0x65
jne 0x413222
lea eax, [esp + 0x220]
push eax
lea ecx, [esp + 0x20]
push str.Dyn_Open_URL:__.470s_n
push ecx
call fcn.004142bd
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x28], 1
call fcn.0040c060
add esp, 0x10
push 1
push 0
push 0
lea eax, [esp + 0x22c]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 0x66
cmp ecx, edi
je 0x413468
cmp ecx, 0x67
je 0x413468
cmp ecx, 0x68
jne 0x413275
xor eax, eax
nop
mov cl, byte [esp + eax + 0x220]
mov byte [esp + eax + 0x1220], cl
inc eax
test cl, cl
jne 0x413240
push 0x800
lea ecx, [esp + 0x1224]
push ecx
push 6
call fcn.004083d0
mov eax, dword [esp + 0x1c]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 0x69
jne 0x41329b
push ecx
lea edx, [esp + 0x224]
push str.Dyn_ExecFile_As_User__
push edx
call fcn.00412eb0
mov eax, dword [esp + 0x1c]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 0x6a
jne 0x4132bb
push 4
lea eax, [ebp + 8]
push eax
push 0xa
call fcn.004083d0
mov eax, dword [esp + 0x1c]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 0x6b
je 0x4132d8
cmp ecx, 0x6c
je 0x4132d8
mov dword [esp + 0x10], 0xfffffffd
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x7c
mov ecx, 0x200
lea edi, [esp + 0xa24]
push ebx
rep stosd dword es:[edi], eax
call fcn.00414460
mov esi, eax
add esp, 8
test esi, esi
je 0x41341d
mov eax, dword [ebp + 8]
imul eax, eax, 0xa10
mov ecx, esi
sub ecx, eax
sub ecx, 0x428eb0
push ecx
lea edx, [eax + 0x428eb0]
push edx
lea eax, [esp + 0xa28]
push eax
call fcn.00416440
push 0x7c
inc esi
push esi
call fcn.00414460
mov esi, eax
add esp, 0x14
test esi, esi
je 0x41338b
inc esi
push 0x7c
push esi
call fcn.00414460
add esp, 8
test eax, eax
je 0x41338b
lea edi, [esp + 0xa20]
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x413350
mov ebx, dword [ebp + 8]
mov cx, word [0x4232b0]
mov edx, ebx
imul edx, edx, 0xa10
mov word [edi], cx
mov ecx, dword [edx + 0x428ca8]
test ecx, ecx
jne 0x4133e5
sub eax, esi
push eax
lea eax, [esp + 0xa24]
push esi
push eax
call fcn.00416090
add esp, 0xc
mov ebx, dword [ebp + 8]
imul ebx, ebx, 0xa10
cmp dword [ebx + 0x428ca0], 0x6b
jne 0x413446
xor eax, eax
jmp 0x4133b0
mov cl, byte [esp + eax + 0xa20]
mov byte [esp + eax + 0x1220], cl
inc eax
test cl, cl
jne 0x4133b0
push 0x800
lea edx, [esp + 0x1224]
push edx
push 6
call fcn.004083d0
mov eax, dword [esp + 0x1c]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc eax
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4133e8
lea edi, [esp + 0xa20]
sub eax, edx
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x413400
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41338e
mov ebx, dword [ebp + 8]
mov ecx, ebx
imul ecx, ecx, 0xa10
lea eax, [ecx + 0x428eb0]
lea edx, [esp + 0xa20]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x413437
jmp 0x41338e
push 0x69
lea eax, [esp + 0xa24]
push str.Dyn_ExecFile_As_User__
push eax
call fcn.00412eb0
mov eax, dword [esp + 0x1c]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0040e410
mov ebx, eax
cmp ebx, 7
je 0x4135bb
cmp ebx, 6
je 0x4135bb
cmp ebx, 5
je 0x4135bb
cmp ebx, 4
je 0x4135bb
lea eax, [esp + 0x220]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4134a0
sub eax, edx
add eax, 0x50
push eax
call fcn.00414902
mov esi, eax
add esp, 4
test esi, esi
je 0x4134d3
lea ecx, [esp + 0x220]
push ecx
push str.__SYSTEMROOT___system32cmd.exe__C__s
push esi
call fcn.004142bd
add esp, 0xc
jmp 0x41354c
mov edx, dword [ebp + 8]
imul edx, edx, 0xa10
cmp dword [edx + 0x428ca0], edi
jne 0x4134f0
push str.ERROR:_Dyn_ExecShellCmd_As_Sys
lea eax, [esp + 0x20]
push eax
jmp 0x4134fa
push str.ERROR:_Dyn_ExecShellCmd_As_User
lea ecx, [esp + 0x20]
push ecx
call fcn.004142bd
lea eax, [esp + 0x24]
add esp, 8
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413510
sub eax, edx
lea edx, [esp + 0x220]
push edx
lea eax, [esp + eax + 0x20]
push str.:_memory_allocation_failure_formatting_cmd.exe_to_run__.400s_n
push eax
call fcn.004142bd
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x28], 1
call fcn.0040c060
add esp, 0x10
lea esi, [esp + 0x220]
mov edx, dword [ebp + 8]
imul edx, edx, 0xa10
cmp dword [edx + 0x428ca0], edi
jne 0x413588
lea edx, [esp + 0x1220]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x413568
push 0x800
lea eax, [esp + 0x1224]
push eax
push 5
call fcn.004083d0
jmp 0x413595
push 0x67
push str.Dyn_ExecShellCmd_As_User__
push esi
call fcn.00412eb0
lea ecx, [esp + 0x22c]
add esp, 0xc
cmp esi, ecx
je 0x413775
push esi
call fcn.004143d6
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x220]
push 0x22
push edx
xor edi, edi
call fcn.00414460
add esp, 8
test eax, eax
je 0x4135e4
inc edi
inc eax
push 0x22
push eax
call fcn.00414460
add esp, 8
test eax, eax
jne 0x4135d3
cmp edi, 3
lea esi, [esp + 0x220]
jle 0x4136be
push ebx
call fcn.0040e540
add esp, 4
test eax, eax
jne 0x4136be
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413610
sub eax, edx
lea edi, [eax + 0x50]
push edi
call fcn.00414902
mov esi, eax
add esp, 4
test esi, esi
je 0x413643
lea eax, [esp + 0x220]
push eax
push str.__s_
push esi
call fcn.004142bd
add esp, 0xc
jmp 0x4136c2
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0xa10
cmp dword [ecx + 0x428ca0], 0x66
jne 0x413661
push str.ERROR:_Dyn_ExecShellCmd_As_Sys
lea edx, [esp + 0x20]
push edx
jmp 0x41366b
push str.ERROR:_Dyn_ExecShellCmd_As_User
lea eax, [esp + 0x20]
push eax
call fcn.004142bd
lea eax, [esp + 0x24]
add esp, 8
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413680
lea ecx, [esp + 0x220]
push ecx
sub eax, edx
lea edx, [esp + eax + 0x20]
push str.:_memory_allocation_failure_while_processing__.400s_n
push edx
call fcn.004142bd
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 1
call fcn.0040c060
add esp, 0x10
lea esi, [esp + 0x220]
jmp 0x4136c2
mov edi, dword [esp + 0x14]
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0xa10
cmp dword [ecx + 0x428ca0], 0x66
lea edx, [esp + 0x1c]
push esi
jne 0x413727
push str.Dyn_ExecShellCmd_As_Sys:__.470s_n
push edx
call fcn.004142bd
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 1
call fcn.0040c060
lea edx, [esp + 0x1230]
add esp, 0x10
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x413704
push 0x800
lea ecx, [esp + 0x1224]
push ecx
push 5
call fcn.004083d0
add esp, 0xc
jmp 0x41374e
push str.Dyn_ExecShellCmd_As_User:__.470s_n
push edx
call fcn.004142bd
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 1
call fcn.0040c060
push edi
push esi
call fcn.0040dde0
add esp, 0x18
lea ecx, [esp + 0x220]
cmp esi, ecx
je 0x413775
push esi
call fcn.004143d6
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x10], 0xfffffffe
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret