Function at 0x7c02b067
Capabilities:
Create process on windows

Disassembly:
push 0xa4
push 0x7c040e78
call fcn.7c00101f
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
cmp dword [ebp + 8], ebx
je 0x7c02b43b
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x7c02b43b
mov al, byte [esi]
cmp al, 0x77
je 0x7c02b0a2
cmp al, 0x72
jne 0x7c02b43b
mov al, byte [esi + 1]
cmp al, 0x74
jne 0x7c02b0b0
mov ecx, 0x4000
jmp 0x7c02b0b9
cmp al, 0x62
jne 0x7c02b0b9
mov ecx, 0x8000
or ecx, 0x80
push ecx
push 0x400
lea eax, [ebp - 0x28]
push eax
call sym.MSVCR70.dll__pipe
add esp, 0xc
cmp eax, 0xffffffff
je 0x7c02b43b
xor edi, edi
cmp byte [esi], 0x77
jne 0x7c02b0ed
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
inc edi
mov dword [ebp - 0x34], edi
jmp 0x7c02b0fa
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ebx
inc edi
push 9
call fcn.7c011a09
pop ecx
test eax, eax
jne 0x7c02b11f
push dword [ebp - 0x28]
call sym.MSVCR70.dll__close
push dword [ebp - 0x24]
call sym.MSVCR70.dll__close
pop ecx
pop ecx
xor eax, eax
jmp 0x7c02b43e
push 9
call fcn.7c011a09
pop ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], edi
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
mov dword [ebp - 0x40], eax
mov esi, dword [ebp - 0x30]
lea esi, [ebp + esi*4 - 0x28]
mov eax, dword [esi]
push 2
push edi
push ebx
lea ecx, [ebp - 0x44]
push ecx
push dword [ebp - 0x40]
mov ecx, eax
sar ecx, 5
and eax, 0x1f
lea eax, [eax + eax*8]
mov ecx, dword [ecx*4 + sym.MSVCR70.dll___pioinfo]
push dword [ecx + eax*4]
push dword [ebp - 0x40]
call dword [sym.imp.kernel32.dll_DuplicateHandle]
test eax, eax
je 0x7c02b406
push dword [esi]
call sym.MSVCR70.dll__close
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x3c], ebx
push dword [ebp + 0xc]
mov eax, dword [ebp - 0x34]
push dword [ebp + eax*4 - 0x28]
call sym.MSVCR70.dll__fdopen
add esp, 0xc
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x7c02b406
xor edi, edi
call fcn.7c02b014
mov dword [ebp - 0x48], eax
cmp eax, ebx
je 0x7c02b3f3
push str.COMSPEC
call sym.MSVCR70.dll_getenv
pop ecx
mov dword [ebp - 0x4c], eax
cmp eax, ebx
jne 0x7c02b1ec
call sym.MSVCR70.dll__errno
cmp dword [eax], 2
je 0x7c02b1d6
call sym.MSVCR70.dll__errno
cmp dword [eax], 0xd
jne 0x7c02b1ec
test byte [0x7c0491d9], 0x80
mov eax, str.command.com
jne 0x7c02b1e9
mov eax, str.cmd.exe
mov dword [ebp - 0x4c], eax
push 0x44
pop esi
push esi
push ebx
lea eax, [ebp - 0x90]
push eax
call sym.MSVCR70.dll_memset
add esp, 0xc
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x64], 0x100
mov eax, dword [sym.MSVCR70.dll___pioinfo]
cmp dword [ebp - 0x2c], ebx
mov ecx, dword [ebp - 0x44]
je 0x7c02b21c
mov ecx, dword [eax]
mov dword [ebp - 0x58], ecx
cmp dword [ebp - 0x2c], 1
mov ecx, dword [ebp - 0x44]
je 0x7c02b22b
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x54], ecx
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x50], eax
push dword [ebp - 0x4c]
call sym.MSVCR70.dll_strlen
mov edi, eax
push dword [ebp + 8]
call sym.MSVCR70.dll_strlen
add edi, eax
mov esi, 0x7c040e6c
push esi
call sym.MSVCR70.dll_strlen
lea eax, [edi + eax + 1]
push eax
call sym.MSVCR70.dll_malloc
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x94], edi
cmp edi, ebx
je 0x7c02b3f3
push dword [ebp - 0x4c]
push edi
call sym.MSVCR70.dll__mbscpy
push esi
push edi
call sym.MSVCR70.dll__mbscat
push dword [ebp + 8]
push edi
call sym.MSVCR70.dll__mbscat
push ebx
push dword [ebp - 0x4c]
call sym.MSVCR70.dll__access
add esp, 0x20
cmp eax, 0xffffffff
je 0x7c02b2c1
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x90]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push edi
push dword [ebp - 0x4c]
call dword [sym.imp.kernel32.dll_CreateProcessA]
mov dword [ebp - 0x20], eax
jmp 0x7c02b3c0
push str.PATH
call sym.MSVCR70.dll_getenv
mov dword [ebp - 0xa8], eax
mov dword [esp], 0x104
call sym.MSVCR70.dll_malloc
pop ecx
mov esi, eax
mov dword [ebp - 0xac], esi
cmp esi, ebx
jne 0x7c02b2f6
push edi
call sym.MSVCR70.dll_free
pop ecx
jmp 0x7c02b3f3
push 0x103
push esi
push dword [ebp - 0xa8]
call fcn.7c011a09
add esp, 0xc
mov dword [ebp - 0xa8], eax
cmp eax, ebx
je 0x7c02b3b3
cmp byte [esi], bl
je 0x7c02b3b3
push esi
call sym.MSVCR70.dll_strlen
pop ecx
lea edi, [eax + esi - 1]
mov dword [ebp - 0xb0], edi
mov al, byte [edi]
cmp al, 0x5c
jne 0x7c02b345
push 0x5c
push esi
call fcn.7c011a09
pop ecx
pop ecx
cmp edi, eax
jmp 0x7c02b347
cmp al, 0x2f
je 0x7c02b356
push 0x7c040810
push esi
call sym.MSVCR70.dll__mbscat
pop ecx
pop ecx
push dword [ebp - 0x4c]
call sym.MSVCR70.dll_strlen
mov edi, eax
push esi
call sym.MSVCR70.dll_strlen
pop ecx
pop ecx
add edi, eax
cmp edi, 0x104
jae 0x7c02b3b3
push dword [ebp - 0x4c]
push esi
call sym.MSVCR70.dll__mbscat
push ebx
push esi
call sym.MSVCR70.dll__access
add esp, 0x10
cmp eax, 0xffffffff
je 0x7c02b2f6
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x90]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp - 0x94]
push esi
call dword [sym.imp.kernel32.dll_CreateProcessA]
mov dword [ebp - 0x20], eax
push esi
call sym.MSVCR70.dll_free
pop ecx
mov edi, dword [ebp - 0x94]
push edi
call sym.MSVCR70.dll_free
pop ecx
push dword [ebp - 0x44]
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [ebp - 0x20], ebx
je 0x7c02b3ee
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0xb4], ecx
mov eax, dword [ebp - 0x48]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
jmp 0x7c02b432
mov eax, dword [ebp - 0x48]
mov dword [eax], ebx
push dword [ebp - 0x1c]
call sym.MSVCR70.dll_fclose
pop ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x3c], ebx
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x30]
shl eax, 2
cmp dword [ebp + eax - 0x3c], ebx
je 0x7c02b41c
push dword [ebp + eax - 0x28]
call sym.MSVCR70.dll__close
pop ecx
mov eax, dword [ebp - 0x34]
shl eax, 2
cmp dword [ebp + eax - 0x3c], ebx
je 0x7c02b432
push dword [ebp + eax - 0x28]
call sym.MSVCR70.dll__close
pop ecx
or dword [ebp - 4], 0xffffffff
call fcn.7c02b444
mov eax, dword [ebp - 0x1c]
call fcn.7c00105a
ret