Function at 0x2e01b8ea
Capabilities:
Create process on windows

Disassembly:
push 0x308
mov eax, 0x2e0304ab
call fcn.2e02e16c
mov eax, dword [ebp + 8]
and dword [ebp - 0x2d0], 0
mov edi, dword [ebp + 0x10]
or dword [ebp - 0x2c4], 0xffffffff
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2ac], eax
xor eax, eax
test edi, edi
setne al
movzx ebx, ax
mov eax, dword [0x2e045aec]
mov dword [ebp - 0x2a4], ebx
mov esi, dword [eax + 0xca8]
mov ecx, esi
call dword [0x2e0322cc]
call esi
test ax, ax
je 0x2e01ba5d
mov eax, dword [0x2e045aec]
mov esi, dword [eax + 0xcac]
mov ecx, esi
call dword [0x2e0322cc]
call esi
test eax, eax
je 0x2e01ba5d
and dword [ebp - 0x2a4], 0
xor ebx, ebx
mov esi, dword [ebp - 0x2ac]
inc ebx
test esi, esi
je 0x2e01b9cd
and dword [ebp - 0x2a4], 0
cmp dword [esi + 4], 0
je 0x2e01b9cd
push str._blank
push dword [esi + 4]
call fcn.2e014e48
pop ecx
pop ecx
test eax, eax
je 0x2e01b9c7
and dword [ebp - 0x2a4], 0
push str.bogusFrame
push dword [esi + 4]
call fcn.2e014e48
pop ecx
pop ecx
test eax, eax
jne 0x2e01b9cd
mov dword [ebp - 0x2a4], ebx
push edi
call fcn.2e014e48
pop ecx
test eax, eax
je 0x2e01bb65
xor esi, esi
lea ecx, [ebp - 0x2c0]
push ebx
push esi
push eax
mov dword [ebp - 0x2c0], esi
mov dword [ebp - 0x2bc], esi
call fcn.2e014e48
mov eax, dword [0x2e045aec]
mov dword [ebp - 4], esi
mov esi, dword [eax + 0xcac]
mov ecx, esi
call dword [0x2e0322cc]
call esi
mov ebx, eax
mov eax, dword [0x2e047f80]
push 0
push dword [ebp - 0x2a4]
mov esi, dword [eax + 0x54]
mov ecx, esi
push dword [ebp - 0x2c0]
mov edi, dword [ebx]
call dword [0x2e0322cc]
call esi
pop ecx
mov ecx, dword [edi + 0xc0]
push eax
call dword [0x2e0322cc]
mov ecx, ebx
call dword [edi + 0xc0]
lea ecx, [ebp - 0x2c0]
call fcn.2e014e48
xor eax, eax
inc eax
jmp 0x2e01bc4e
mov eax, dword [ebp - 0x2ac]
test eax, eax
je 0x2e01baa5
cmp dword [eax + 4], 0
je 0x2e01baa5
push str.bogusframe
push dword [eax + 4]
call sub.VCRUNTIME140.dll_strstr
pop ecx
pop ecx
test eax, eax
je 0x2e01baa5
push edi
call fcn.2e014e48
pop ecx
test ax, ax
je 0x2e01ba55
push 5
push 0x2e032941
push 0
push edi
push 0x2e03346c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x2e01ba55
test edi, edi
je 0x2e01bc4b
push 5
push str.file:
push edi
call fcn.2e014e48
mov ecx, eax
add esp, 0xc
xor eax, eax
test ecx, ecx
sete al
movzx ebx, ax
test ecx, ecx
jne 0x2e01bad1
xor esi, esi
jmp 0x2e01bae9
push 7
push 0x2e03479c
push edi
call fcn.2e014e48
add esp, 0xc
neg eax
sbb eax, eax
inc eax
movzx esi, ax
push edi
call fcn.2e01b864
movzx eax, ax
mov dword [ebp - 0x2b0], eax
pop ecx
test bx, bx
je 0x2e01bb3f
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
pop ecx
cmp eax, 0xa
jbe 0x2e01bb3f
push 8
push str.file:___
push edi
call fcn.2e014e48
add esp, 0xc
test eax, eax
jne 0x2e01bb3f
mov al, byte [edi + 8]
cmp al, 0x61
jl 0x2e01bb29
cmp al, 0x7a
jle 0x2e01bb2f
sub al, 0x41
cmp al, 0x19
ja 0x2e01bb3f
cmp byte [edi + 9], 0x7c
jne 0x2e01bb3f
cmp byte [edi + 0xa], 0x2f
jne 0x2e01bb3f
mov byte [edi + 9], 0x3a
push edi
call fcn.2e014e48
movzx eax, ax
mov dword [ebp - 0x2b8], eax
pop ecx
test bx, bx
je 0x2e01bbe7
push edi
call fcn.2e014e48
mov esi, eax
pop ecx
test esi, esi
jne 0x2e01bb6c
xor eax, eax
jmp 0x2e01bc4e
push 0x3c
pop edi
push edi
xor ebx, ebx
lea eax, [ebp - 0x314]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x314], edi
lea eax, [ebp - 0x314]
mov dword [ebp - 0x310], ebx
mov dword [ebp - 0x30c], ebx
mov dword [ebp - 0x308], str.open
push eax
mov dword [ebp - 0x304], esi
mov dword [ebp - 0x300], ebx
mov dword [ebp - 0x2fc], ebx
mov dword [ebp - 0x2f8], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
mov eax, dword [0x2e047f78]
push esi
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2e0322cc]
call esi
xor eax, eax
cmp edi, 0x20
pop ecx
setg al
jmp 0x2e01bc4e
test si, si
jne 0x2e01c19b
cmp word [ebp - 0x2b0], si
jne 0x2e01c19b
cmp dword [0x2e047ee8], 0
je 0x2e01bc54
test ax, ax
jne 0x2e01bc54
mov eax, dword [0x2e047ed8]
test eax, eax
je 0x2e01bc21
push edi
push eax
call fcn.2e014e48
pop ecx
pop ecx
test eax, eax
je 0x2e01bc49
xor eax, eax
push eax
push eax
push 0x1a
push 3
pop ebx
push ebx
push 4
push eax
call fcn.2e01a82f
add esp, 0x18
cmp ax, bx
jne 0x2e01bc49
call fcn.2e004fbc
xor eax, eax
inc eax
mov word [0x2e047ee0], ax
xor ebx, ebx
mov ax, bx
call fcn.2e02e14a
ret
xor eax, eax
push str.WWW_OpenURL
mov word [0x2e047ee0], ax
call fcn.2e014e48
movzx ebx, ax
mov dword [ebp - 0x2b0], ebx
pop ecx
push edi
test bx, bx
jne 0x2e01bc95
call fcn.2e014e48
pop ecx
test ax, ax
je 0x2e01bc86
xor ebx, ebx
inc ebx
jmp 0x2e01bc4b
push 0
call fcn.2e014e48
pop ecx
test ax, ax
jne 0x2e01bcb1
jmp 0x2e01bc49
call fcn.2e014e48
pop ecx
cmp eax, 0xec
ja 0x2e01c18c
cmp word [ebp + 0x1c], 0
jne 0x2e01c18c
call fcn.2e014e48
mov ecx, eax
cmp ecx, 2
je 0x2e01bce3
push 0
push 0
push 0x19
pop eax
push 0x1b
pop edx
test ecx, ecx
cmove eax, edx
movzx eax, ax
push eax
push 1
push 2
push 0
call fcn.2e01a82f
add esp, 0x18
jmp 0x2e01bc49
call fcn.2e01c76b
mov eax, dword [0x2e047ed8]
test eax, eax
je 0x2e01bd05
push eax
mov eax, dword [0x2e047f78]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2e0322cc]
call esi
pop ecx
push edi
call fcn.2e014e48
xor esi, esi
mov dword [0x2e047ed8], eax
mov eax, dword [0x2e047ed4]
inc esi
pop ecx
cmp eax, 3
je 0x2e01bd37
cmp eax, 5
je 0x2e01bd37
cmp eax, 4
je 0x2e01bd37
cmp eax, 8
je 0x2e01bd37
cmp eax, 9
je 0x2e01bd37
cmp eax, 0xa
jne 0x2e01bd4e
push dword [ebp - 0x2cc]
call fcn.2e01c950
mov eax, dword [0x2e047ed4]
pop ecx
mov dword [ebp - 0x2b8], esi
cmp word [ebp - 0x2b8], 0
jne 0x2e01bd92
call fcn.2e014e48
push 0
mov dword [0x2e047ef0], eax
mov dword [0x2e047ef4], edx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
push 5
push eax
push 0x2e01c350
mov dword [ebp - 0x2d4], edx
call fcn.2e014e48
mov dword [0x2e047ee8], eax
add esp, 0x10
mov eax, dword [0x2e047ed4]
jmp 0x2e01bd99
and dword [0x2e047ee8], 0
mov ecx, dword [ebp - 0x2ac]
test ecx, ecx
je 0x2e01bf5a
cmp dword [ecx + 4], 0
je 0x2e01bf5a
push str.WWW_ListWindows
push 0x2e047eb4
push dword [0x2e047eb0]
call fcn.2e014e48
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x2e01bf4f
mov eax, dword [ebx]
push 0
push str.ABCD
push dword [eax]
call sub.USER32.dll_DdeCreateStringHandleA
xor ecx, ecx
mov esi, eax
push ecx
push 0x2710
push 0x20b0
xor eax, eax
inc eax
push eax
push esi
push dword [ebx + 0xc]
push ecx
push ecx
call sub.USER32.dll_DdeClientTransaction
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebx]
push esi
push dword [eax]
call sub.USER32.dll_DdeFreeStringHandle
mov eax, dword [ebp - 0x2a8]
test eax, eax
je 0x2e01bf38
mov eax, dword [ebx]
push dword [eax]
call sub.USER32.dll_DdeGetLastError
push 0
push 0x102
lea eax, [ebp - 0x198]
push eax
push dword [ebp - 0x2a8]
call sub.USER32.dll_DdeGetData
mov eax, dword [ebx]
push dword [eax]
call sub.USER32.dll_DdeGetLastError
test eax, eax
jne 0x2e01bf32
lea eax, [ebp - 0x198]
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x2b4], eax
test eax, eax
je 0x2e01bf32
mov esi, dword [ebp - 0x2ac]
push str.WWW_GetWindowInfo
push 0x2e047eb4
push dword [0x2e047eb0]
call fcn.2e014e48
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x2e01bee5
mov ecx, 0x82
lea eax, [ebp - 0x94]
push ecx
push eax
push ecx
lea eax, [ebp - 0x21c]
push eax
push ecx
lea eax, [ebp - 0x2a0]
push eax
push dword [ebp - 0x2b4]
push 0x2e0347f4
push 0x2e033a94
push ebx
call fcn.2e014e48
add esp, 0x28
test eax, eax
jne 0x2e01bee5
push dword [esi + 4]
lea eax, [ebp - 0x94]
push eax
call fcn.2e014e48
pop ecx
pop ecx
test eax, eax
je 0x2e01bf16
push ebx
push dword [0x2e047eb0]
call fcn.2e014e48
mov eax, dword [ebp - 0x2d4]
xor ebx, ebx
add eax, 4
mov dword [ebp - 0x2d4], eax
pop ecx
pop ecx
mov eax, dword [eax]
mov dword [ebp - 0x2b4], eax
test eax, eax
jne 0x2e01be78
jmp 0x2e01bf32
mov eax, dword [ebp - 0x2b4]
push ebx
push dword [0x2e047eb0]
mov dword [ebp - 0x2c4], eax
call fcn.2e014e48
pop ecx
pop ecx
xor ebx, ebx
mov eax, dword [ebp - 0x2a8]
push eax
call sub.USER32.dll_DdeFreeDataHandle
push ebx
push dword [0x2e047eb0]
call fcn.2e014e48
pop ecx
xor esi, esi
pop ecx
inc esi
mov ebx, dword [ebp - 0x2b0]
mov eax, dword [0x2e047ed4]
cmp eax, 3
jne 0x2e01bf6f
test bx, bx
jne 0x2e01bf6f
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
push str.WWW_OpenURL
push 0x2e047eb4
push dword [0x2e047eb0]
call fcn.2e014e48
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x2e01bfdb
push dword [0x2e047eb0]
call fcn.2e014e48
pop ecx
test ax, ax
jne 0x2e01bfd1
mov eax, dword [0x2e046be4]
push dword [0x2e047ee4]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x2e0322cc]
call esi
pop ecx
test ax, ax
jne 0x2e01bfd1
xor ecx, ecx
xor eax, eax
push ecx
push ecx
push 0x14
inc eax
push eax
push 2
push ecx
call fcn.2e01a82f
add esp, 0x18
call fcn.2e01c2fb
jmp 0x2e01bc49
mov eax, dword [0x2e047ed4]
cmp eax, 7
je 0x2e01c0fe
cmp eax, 6
je 0x2e01c0fe
cmp word [ebp - 0x2b8], 0
mov edx, 0x2e032941
mov eax, edx
mov ecx, str.AcroWWW
cmove eax, ecx
lea ecx, [ebp - 0x2d0]
push ecx
push eax
push eax
push edx
push dword [ebp - 0x2c8]
push 4
push dword [ebp - 0x2c4]
push edx
push edi
push 0x2e034800
push str.ssllssss
push ebx
call fcn.2e014e48
add esp, 0x30
sub eax, 0
je 0x2e01c0c9
sub eax, 1
je 0x2e01c093
sub eax, 1
jne 0x2e01c159
push dword [0x2e047eb0]
call fcn.2e014e48
pop ecx
test ax, ax
jne 0x2e01c139
mov eax, dword [0x2e046be4]
push dword [0x2e047ee4]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x2e0322cc]
call esi
pop ecx
test ax, ax
jne 0x2e01c139
push 0
push 0
xor eax, eax
push 0x14
inc eax
push eax
jmp 0x2e01c12d
push ebx
push dword [0x2e047eb0]
call fcn.2e014e48
push esi
push dword [ebp - 0x2ac]
push dword [ebp - 0x2c8]
push edi
push dword [ebp - 0x2bc]
push dword [ebp - 0x2cc]
call fcn.2e01b8ea
add esp, 0x20
movzx ebx, ax
jmp 0x2e01c15f
push ebx
push dword [0x2e047eb0]
call fcn.2e014e48
cmp dword [0x2e047ed4], 2
pop ecx
pop ecx
jne 0x2e01c159
cmp dword [ebp - 0x2d0], 0
jge 0x2e01c159
push 0
push 0
push 0x47
push esi
push 2
push 0
call fcn.2e01a82f
add esp, 0x18
jmp 0x2e01c159
push edi
call fcn.2e014e48
inc eax
push eax
push edi
push ebx
call fcn.2e014e48
add esp, 0x10
test ax, ax
jne 0x2e01c14b
push dword [0x2e047eb0]
call fcn.2e014e48
pop ecx
test ax, ax
jne 0x2e01c139
push 0
push 0
push 0x14
push esi
push 2
push 0
call fcn.2e01a82f
add esp, 0x18
push ebx
push dword [0x2e047eb0]
call fcn.2e014e48
pop ecx
pop ecx
xor ebx, ebx
jmp 0x2e01c15f
push ebx
push dword [0x2e047eb0]
call fcn.2e014e48
pop ecx
pop ecx
mov ebx, dword [ebp - 0x2a4]
mov eax, dword [0x2e047ed8]
test eax, eax
je 0x2e01bc4b
push eax
mov eax, dword [0x2e047f78]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2e0322cc]
call esi
and dword [0x2e047ed8], 0
pop ecx
jmp 0x2e01bc4b
push edi
call fcn.2e014e48
pop ecx
movzx ebx, ax
jmp 0x2e01bc4b
push 5
push 0x2e032941
xor eax, eax
push eax
push edi
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov ax, cx
jmp 0x2e01bc4e