Function at 0x401d40
Capabilities:
Create process on windows
Create process suspended
Resume thread
Set current directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x774
push ebx
push esi
push edi
mov al, byte [0x402fdc]
mov byte [ebp - 0x4b8], al
mov ecx, 0x63
xor eax, eax
lea edi, [ebp - 0x4b7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x402fdc]
mov byte [ebp - 0x194], cl
mov ecx, 0x63
xor eax, eax
lea edi, [ebp - 0x193]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0x402fdc]
mov byte [ebp - 0x328], dl
mov ecx, 0x63
xor eax, eax
lea edi, [ebp - 0x327]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x402fdc]
mov byte [ebp - 0x538], al
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x537]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x186
lea ecx, [ebp - 0x4b8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [ebp - 0x4b8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
lea edx, [ebp + ecx - 0x4b8]
mov dword [ebp - 0x668], edx
mov eax, dword [ebp - 0x668]
lea ecx, [ebp - 0x4b8]
cmp eax, ecx
jb 0x401e24
mov edx, dword [ebp - 0x668]
movsx eax, byte [edx]
cmp eax, 0x5c
je 0x401e24
mov ecx, dword [ebp - 0x668]
sub ecx, 1
mov dword [ebp - 0x668], ecx
jmp 0x401df5
mov edx, dword [ebp - 0x668]
add edx, 1
mov dword [ebp - 0x668], edx
mov edi, dword [ebp - 0x668]
lea edx, [ebp - 0x538]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x538]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
lea ecx, [ebp + ecx - 0x538]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov byte [edx - 3], 0x64
mov eax, dword [ebp - 4]
mov byte [eax - 2], 0x6c
mov ecx, dword [ebp - 4]
mov byte [ecx - 1], 0x6c
mov edx, dword [ebp - 0x668]
mov byte [edx], 0
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x4b8]
push ecx
call fcn.00401cc0
add esp, 8
and eax, 0xff
test eax, eax
je 0x401f18
lea edi, [ebp - 0x4b8]
lea edx, [ebp - 0x194]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x538]
lea edx, [ebp - 0x194]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x401f98
mov edi, 0x401358
lea edx, [ebp - 0x768]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x538]
lea edx, [ebp - 0x768]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x40010
push 0x40134c
lea eax, [ebp - 0x768]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x40236c
mov dword [ebp - 0x198], 0x401100
mov ecx, dword [ebp - 0x198]
movsx edx, byte [ecx]
test edx, edx
je 0x40203a
mov eax, dword [ebp - 0x198]
push eax
lea ecx, [ebp - 0x4b8]
push ecx
call fcn.00401cc0
add esp, 8
and eax, 0xff
test eax, eax
je 0x402026
lea edi, [ebp - 0x4b8]
lea edx, [ebp - 0x328]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x198]
lea edx, [ebp - 0x328]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x40203a
mov ecx, dword [ebp - 0x198]
add ecx, 0x28
mov dword [ebp - 0x198], ecx
jmp 0x401fa2
movsx edx, byte [ebp - 0x328]
test edx, edx
jne 0x402066
push 0x40010
push 0x40134c
push 0x401328
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x40236c
mov ecx, 0x11
xor eax, eax
mov edi, 0x402f88
rep stosd dword es:[edi], eax
xor eax, eax
mov dword [0x402f70], eax
mov dword [0x402f74], eax
mov dword [0x402f78], eax
mov dword [0x402f7c], eax
mov dword [0x402f88], 0x44
mov edi, 0x40130c
lea edx, [ebp - 0x664]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x10]
lea edx, [ebp - 0x664]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x401304
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4021a5
lea edi, [ebp - 0x4b8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
lea ecx, [ebp + ecx - 0x4ba]
mov dword [ebp - 0x76c], ecx
mov edx, dword [ebp - 0x76c]
lea eax, [ebp - 0x4b8]
cmp edx, eax
jb 0x402159
mov ecx, dword [ebp - 0x76c]
movsx edx, byte [ecx]
cmp edx, 0x5c
je 0x402159
mov eax, dword [ebp - 0x76c]
sub eax, 1
mov dword [ebp - 0x76c], eax
jmp 0x40212a
mov ecx, dword [ebp - 0x76c]
sub ecx, 1
mov dword [ebp - 0x76c], ecx
mov edx, dword [ebp - 0x76c]
lea eax, [ebp - 0x4b8]
cmp edx, eax
jb 0x402197
mov ecx, dword [ebp - 0x76c]
movsx edx, byte [ecx]
cmp edx, 0x5c
je 0x402197
mov eax, dword [ebp - 0x76c]
sub eax, 1
mov dword [ebp - 0x76c], eax
jmp 0x402168
mov ecx, dword [ebp - 0x76c]
mov byte [ecx], 0
jmp 0x40223f
push 0x401300
lea edx, [ebp - 0x328]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x402217
lea edi, [ebp - 0x4b8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
lea eax, [ebp + ecx - 0x4ba]
mov dword [ebp - 0x770], eax
mov ecx, dword [ebp - 0x770]
lea edx, [ebp - 0x4b8]
cmp ecx, edx
jb 0x40220c
mov eax, dword [ebp - 0x770]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x40220c
mov edx, dword [ebp - 0x770]
sub edx, 1
mov dword [ebp - 0x770], edx
jmp 0x4021dd
mov eax, dword [ebp - 0x770]
mov byte [eax], 0
jmp 0x40223f
lea edi, [ebp - 0x4b8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
lea ecx, [ebp + ecx - 0x4b9]
mov dword [ebp - 0x774], ecx
mov edx, dword [ebp - 0x774]
mov byte [edx], 0
lea eax, [ebp - 0x4b8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x4012f8
lea ecx, [ebp - 0x328]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x40228f
mov edi, 0x4012f8
lea edx, [ebp - 0x328]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4022b7
mov edi, 0x4012ec
lea edx, [ebp - 0x328]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x402f70
push 0x402f88
push 0
push 0
push 4
push 0
push 0
push 0
lea ecx, [ebp - 0x664]
push ecx
lea edx, [ebp - 0x328]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x402301
push 0x40010
push 0x40134c
push 0x4012c8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0xffffffff
jmp 0x40236c
push 0x402f70
lea eax, [ebp - 0x194]
push eax
call fcn.00401410
add esp, 8
test eax, eax
jne 0x402344
push 0x40010
push 0x40134c
push 0x4012b4
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
mov ecx, dword [0x402f70]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
or eax, 0xffffffff
jmp 0x40236c
mov edx, dword [0x402f74]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x402f70]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x402f74]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10