Function at 0x468950
Capabilities:
Create process on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5427a9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38c
push ebx
mov ebx, dword [0x5ab980]
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], ebx
mov edx, dword [esp + 0x3b0]
xor ebp, ebp
mov dword [esp + 0x3a4], ebp
mov eax, dword [edx]
mov ecx, dword [edx + 8]
lea edi, [edx + 8]
cmp eax, 1
mov dword [esp + 0x20], ecx
je 0x46952b
cmp eax, 0xe
je 0x46952b
cmp eax, 0xc
jne 0x468b76
lea ecx, [esp + 0x78]
call fcn.0046a9b0
lea ecx, [esp + 0x24]
mov byte [esp + 0x3a4], 1
call fcn.00466340
mov eax, dword [0x5ab980]
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x24]
mov ebx, 3
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x3ac], bl
call fcn.0046a0a0
mov edi, eax
cmp edi, ebp
jg 0x468a44
mov eax, dword [esp + 0x20]
mov ecx, esi
push eax
push str.MESSAGE_exp_cannot_resolve__s
call fcn.00468260
lea ecx, [esp + 0x14]
mov byte [esp + 0x3a4], 2
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x3a4], 1
call fcn.004663b0
lea ecx, [esp + 0x180]
mov byte [esp + 0x3a4], 0
call fcn.005128e4
jmp 0x4695a5
mov eax, dword [esp + 0x28]
cmp eax, ebx
ja case.default.0x468a50
jmp dword [eax*4 + 0x4695fc]
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x3c]
cdq
push edx
push eax
push ecx
call fcn.00423670
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x3a8], 4
call fcn.00512a1d
mov byte [esp + 0x3a4], bl
lea ecx, [esp + 0x3c]
jmp 0x468afa
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
push edx
call fcn.00512a1d
jmp case.default.0x468a50
lea eax, [esp + 0x34]
lea ecx, [esp + 0x44]
push eax
push ecx
call fcn.00423160
add esp, 8
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x3a8], 5
call fcn.00512a1d
mov byte [esp + 0x3a4], bl
lea ecx, [esp + 0x44]
jmp 0x468afa
lea edx, [esp + 0x34]
lea eax, [esp + 0x18]
push edx
push eax
call fcn.00423090
add esp, 8
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x3a8], 6
call fcn.00512a1d
mov byte [esp + 0x3a4], bl
lea ecx, [esp + 0x18]
call fcn.005128e4
cmp dword [0x5b0abc], 1
jl 0x468b40
push 0x5b0738
lea ecx, [esp + 0x1c]
call fcn.00512952
lea ecx, [esp + 0x14]
push ebp
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x3b0], 7
call fcn.00469640
lea ecx, [esp + 0x18]
mov byte [esp + 0x3a4], bl
call fcn.005128e4
lea ecx, [esp + 0x14]
mov byte [esp + 0x3a4], 2
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x3a4], 1
call fcn.004663b0
mov byte [esp + 0x3a4], 0
lea ecx, [esp + 0x180]
jmp 0x469526
cmp eax, 0xb
jne 0x468cf4
lea ecx, [esp + 0x184]
call fcn.0046a9b0
lea ecx, [esp + 0x78]
mov byte [esp + 0x3a4], 8
call fcn.0046a9b0
mov bl, 9
lea ecx, [esp + 0x24]
mov byte [esp + 0x3a4], bl
call fcn.00466340
lea eax, [esp + 0x184]
lea ecx, [esp + 0x20]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x3ac], 0xa
call fcn.0046a430
mov edi, eax
cmp edi, ebp
jg 0x468c19
push str.SET_varexp_statement_missing_var
mov ecx, esi
call fcn.00468410
lea ecx, [esp + 0x24]
mov byte [esp + 0x3a4], bl
call fcn.004663b0
lea ecx, [esp + 0x180]
mov byte [esp + 0x3a4], 8
call fcn.005128e4
lea ecx, [esp + 0x28c]
mov byte [esp + 0x3a4], 0
call fcn.005128e4
jmp 0x4695a5
cmp dword [esp + 0x188], ebp
je 0x468c29
push str.SET_varexp_statement_var_may_not_be_an_expression.
jmp 0x468bd5
movsx edx, byte [esp + 0x18c]
push edx
call fcn.004fa0d2
add esp, 4
test eax, eax
jne 0x468c45
push str.SET_varexp_statement_var_must_start_with_a_letter.
jmp 0x468bd5
lea eax, [esp + 0x4c]
push 0x59d6e8
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, esi
call fcn.0046a7a0
mov edi, eax
cmp edi, ebp
jg 0x468c6b
push str.SET_varexp_statement_missing_
jmp 0x468bd5
mov eax, dword [esp + 0x20]
cmp byte [eax], 0
jne 0x468c7e
push str.SET_varexp_statement_missing_exp
jmp 0x468bd5
lea edx, [esp + 0x24]
mov ecx, esi
push edx
push eax
call fcn.0046a0a0
mov edi, eax
cmp edi, ebp
jg 0x468ca7
mov eax, dword [esp + 0x20]
mov ecx, esi
push eax
push str.SET_varexp_statement_cannot_resolve__s
call fcn.00468260
jmp 0x468bdc
lea ecx, [esp + 0x24]
lea edx, [esp + 0x18c]
push ecx
push edx
lea ecx, [esi + 8]
call fcn.00467ab0
lea ecx, [esp + 0x24]
mov byte [esp + 0x3a4], bl
call fcn.004663b0
lea ecx, [esp + 0x180]
mov byte [esp + 0x3a4], 8
call fcn.005128e4
mov byte [esp + 0x3a4], 0
lea ecx, [esp + 0x28c]
jmp 0x469526
cmp eax, 4
jne 0x468db1
cmp dword [ecx - 8], ebp
jne 0x468d0c
push str.Load_statement_missing_filename
jmp 0x4695c2
lea ecx, [esp + 0x4c]
call fcn.00516fef
mov eax, dword [edi]
push ebp
push 0x20
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x3b0], 0xb
call fcn.005171a1
test eax, eax
je 0x468d73
lea eax, [esp + 0x4c]
mov ecx, esi
push eax
call fcn.004685d0
lea ecx, [esp + 0x4c]
mov esi, eax
call fcn.005173bc
lea ecx, [esp + 0x4c]
mov byte [esp + 0x3a4], 0
call fcn.005170e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x3a4], 0xffffffff
call fcn.005128e4
mov eax, esi
jmp 0x4695df
mov edi, dword [edi]
mov ecx, esi
push edi
push str.load__s_failed
call fcn.00468260
lea ecx, [esp + 0x4c]
mov byte [esp + 0x3a4], 0
call fcn.005170e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x3a4], 0xffffffff
call fcn.005128e4
mov eax, 0xfffffff5
jmp 0x4695df
cmp eax, 5
jne 0x469019
cmp dword [ecx - 8], ebp
jne 0x468dc9
push str.Execute_statement_missing_filename
jmp 0x4695c2
push edi
lea ecx, [esp + 0x1c]
call fcn.00512659
mov ecx, dword [0x5ab980]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x3a4], 0xd
call fcn.00466340
push str._DQUOTE_
push 0x59785c
lea ecx, [esp + 0x20]
mov byte [esp + 0x3ac], 0xe
call fcn.0050e00f
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x24]
lea ecx, [esp + 0x44]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x4c], edx
call fcn.00469cc0
cmp eax, ebp
jle 0x468fda
cmp dword [esp + 0x28], 1
jne 0x468fda
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
push edx
call fcn.00512a1d
push 0x5982cc
push str._DQUOTE_
lea ecx, [esp + 0x1c]
call fcn.0050e00f
mov eax, dword [esp + 0x14]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jbe 0x468ea8
push 1
push ebp
push ebp
push 1
mov ecx, esi
call fcn.00468080
lea ecx, [esp + 0x24]
mov byte [esp + 0x3a4], 0xd
call fcn.004663b0
lea ecx, [esp + 0x14]
mov byte [esp + 0x3a4], 0xc
call fcn.005128e4
mov byte [esp + 0x3a4], 0
lea ecx, [esp + 0x18]
jmp 0x469526
mov ecx, dword [0x5ab980]
mov dword [esp + 0x1c], ecx
mov bl, 0xf
cmp eax, 0xb
mov byte [esp + 0x3a4], bl
ja case.0x468ec8.4
xor edx, edx
mov dl, byte [eax + 0x469620]
jmp dword [edx*4 + 0x46960c]
mov eax, dword [esp + 0x14]
mov edi, 0xe
push eax
push str.Execute__s_failed:_The_system_is_out_of_memory_or_resources.
jmp 0x468f2e
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push str.Execute__s_failed:_The_file_is_invalid.
push eax
mov edi, 0xb
call fcn.0050e6c7
add esp, 0xc
jmp 0x468f82
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push str.Execute__s_failed:_The_specified_file_was_not_found.
push edx
mov edi, 2
call fcn.0050e6c7
add esp, 0xc
jmp 0x468f82
mov eax, dword [esp + 0x14]
mov edi, 3
push eax
push str.Execute__s_failed:_The_specified_path_was_not_found.
lea ecx, [esp + 0x24]
push ecx
call fcn.0050e6c7
add esp, 0xc
jmp 0x468f82
mov edi, 0x3eb
lea edx, [esp + 0x3c]
push edi
push edx
call fcn.004226f0
add esp, 8
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x24]
push str.Execute__s_failed:__s
push edx
mov byte [esp + 0x3b4], 0x10
call fcn.0050e6c7
add esp, 0x10
lea ecx, [esp + 0x3c]
mov byte [esp + 0x3a4], bl
call fcn.005128e4
mov eax, dword [esp + 0x1c]
push 1
push eax
push edi
push 0xfffffc19
mov ecx, esi
call fcn.00468080
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3a4], 0xe
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x3a4], 0xd
call fcn.004663b0
lea ecx, [esp + 0x14]
mov byte [esp + 0x3a4], 0xc
call fcn.005128e4
mov byte [esp + 0x3a4], 0
lea ecx, [esp + 0x18]
jmp 0x469526
push str.EXECUTE_Command.__Command_incorrectly_specified.
mov ecx, esi
call fcn.00468410
lea ecx, [esp + 0x24]
mov byte [esp + 0x3a4], 0xd
call fcn.004663b0
lea ecx, [esp + 0x14]
mov byte [esp + 0x3a4], 0xc
call fcn.005128e4
mov byte [esp + 0x3a4], 0
lea ecx, [esp + 0x18]
jmp 0x469579
cmp eax, 0xa
jne 0x46903b
mov ax, word [esi + 4]
cmp ax, bp
jne 0x469031
push str.Extra_ENDWHEN_found
jmp 0x4695c2
dec eax
mov word [esi + 4], ax
jmp 0x46952b
cmp eax, 9
jne 0x4690ef
mov ax, word [esi + 4]
cmp ax, bp
jne 0x469057
push str.Extra_ELSE_found
jmp 0x4695c2
mov ebx, dword [esp + 0x3ac]
lea ecx, [esp + 0x10]
push ecx
push ebx
mov ecx, esi
lea ebp, [eax - 1]
call fcn.004ea550
mov edi, eax
test edi, edi
jle 0x4690de
lea edx, [esp + 0x5c]
push 0x59d698
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x54]
push eax
push ecx
mov ecx, esi
call fcn.00469740
mov edx, dword [eax]
mov dword [esp + 0x3c], edx
mov eax, dword [eax + 4]
sub eax, 8
je 0x4690a8
sub eax, 2
jne 0x4690ac
dec word [esi + 4]
jmp 0x4690ac
inc word [esi + 4]
cmp word [esi + 4], bp
jle 0x4690d6
lea eax, [esp + 0x10]
mov ecx, esi
push eax
push ebx
call fcn.004ea550
mov edi, eax
test edi, edi
jg 0x469074
push str.Could_not_find_matching_ENDWHEN
mov ecx, esi
call fcn.00468410
jmp 0x46957e
test edi, edi
jg 0x46952b
push str.Could_not_find_matching_ENDWHEN
mov ecx, esi
call fcn.00468410
jmp 0x46957e
cmp eax, 8
jne 0x4692ee
mov dword [esp + 0x1c], ebx
push edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x3a8], 0x11
call fcn.00512a1d
mov edx, dword [esp + 0x1c]
inc word [esi + 4]
lea ecx, [esp + 0x4c]
push ecx
push edx
mov ecx, esi
call fcn.00469bb0
mov edi, eax
cmp edi, ebp
jg 0x46913f
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3a4], 0
call fcn.005128e4
jmp 0x4695a5
cmp dword [esp + 0x4c], ebp
je 0x469156
mov byte [esp + 0x3a4], 0
lea ecx, [esp + 0x1c]
jmp 0x469526
mov ebx, dword [esp + 0x3ac]
mov di, word [esi + 4]
lea eax, [esp + 0x10]
mov ecx, esi
push eax
push ebx
dec di
call fcn.004ea550
cmp eax, ebp
jle 0x4691d6
lea ecx, [esp + 0x5c]
push 0x59d698
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x4c]
push edx
push eax
mov ecx, esi
call fcn.00469740
mov ecx, dword [eax]
mov dword [esp + 0x3c], ecx
mov eax, dword [eax + 4]
sub eax, 8
je 0x4691c1
dec eax
je 0x4691af
dec eax
jne 0x4691c5
dec word [esi + 4]
cmp word [esi + 4], di
je 0x4691f3
jmp 0x4691c5
movsx eax, word [esi + 4]
movsx edx, di
inc edx
cmp eax, edx
je 0x469271
jmp 0x4691c5
inc word [esi + 4]
lea ecx, [esp + 0x10]
push ecx
push ebx
mov ecx, esi
call fcn.004ea550
cmp eax, ebp
jg 0x469174
push str.Could_not_find_matching_ELSE_or_ENDWHEN
mov ecx, esi
call fcn.00468410
mov byte [esp + 0x3a4], 0
lea ecx, [esp + 0x1c]
jmp 0x469579
cmp dword [0x5b0abc], 1
jle 0x469260
push str.ENDWHEN
lea ecx, [esp + 0x18]
call fcn.00512952
movsx edi, word [esi + 4]
mov bl, 0x14
push 0x5b0738
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3a8], bl
call fcn.00512952
lea edx, [esp + 0x14]
push edi
lea eax, [esp + 0x1c]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x3b0], 0x15
call fcn.00469640
lea ecx, [esp + 0x18]
mov byte [esp + 0x3a4], bl
call fcn.005128e4
lea ecx, [esp + 0x14]
mov byte [esp + 0x3a4], 0x11
call fcn.005128e4
mov byte [esp + 0x3a4], 0
lea ecx, [esp + 0x1c]
jmp 0x469526
cmp dword [0x5b0abc], 1
jle 0x4692dd
push str.ELSE
lea ecx, [esp + 0x48]
call fcn.00512952
mov bl, 0x12
push 0x5b0738
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3a8], bl
call fcn.00512952
movsx ecx, di
lea edx, [esp + 0x44]
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x3b0], 0x13
call fcn.00469640
lea ecx, [esp + 0x18]
mov byte [esp + 0x3a4], bl
call fcn.005128e4
lea ecx, [esp + 0x44]
mov byte [esp + 0x3a4], 0x11
call fcn.005128e4
mov byte [esp + 0x3a4], 0
lea ecx, [esp + 0x1c]
jmp 0x469526
cmp eax, 6
jne 0x469407
lea ecx, [esp + 0x24]
call fcn.00466340
mov bl, 0x16
lea ecx, [esp + 0x78]
mov byte [esp + 0x3a4], bl
call fcn.0046a9b0
lea ecx, [esp + 0x78]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x3ac], 0x17
call fcn.0046a430
mov edi, eax
cmp edi, ebp
jg 0x469366
push str.CONTEXT_exp_statement_missing_exp
mov ecx, esi
call fcn.00468410
lea ecx, [esp + 0x180]
mov byte [esp + 0x3a4], bl
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x3a4], 0
call fcn.004663b0
jmp 0x4695a5
lea eax, [esp + 0x24]
lea ecx, [esp + 0x78]
push eax
push esi
call fcn.0046aa10
mov edi, eax
cmp edi, ebp
jg 0x46938e
mov ecx, dword [esp + 0x20]
push ecx
push str.CONTEXT_exp_statement__could_not_evaluate_exp:__s
mov ecx, esi
call fcn.00468260
jmp 0x46933d
cmp dword [esp + 0x28], 1
je 0x4693cf
mov edx, dword [esp + 0x20]
mov ecx, esi
push edx
push str.CONTEXT_exp_statement__exp_did_not_evaluate_to_a_string:__s
call fcn.00468260
lea ecx, [esp + 0x180]
mov byte [esp + 0x3a4], bl
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x3a4], 0
call fcn.004663b0
jmp 0x46957e
lea eax, [esp + 0x2c]
mov ecx, 0x5b0a14
push eax
call fcn.00512a1d
lea ecx, [esp + 0x180]
mov byte [esp + 0x3a4], bl
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x3a4], 0
call fcn.004663b0
jmp 0x46952b
cmp eax, 7
jne 0x46941b
mov ecx, 0x5b0a14
call fcn.0051286f
jmp 0x46952b
cmp eax, 0xd
jne 0x469597
lea ecx, [esp + 0x290]
call fcn.0046a9b0
mov bl, 0x18
lea ecx, [esp + 0x60]
mov byte [esp + 0x3a4], bl
call fcn.00466340
lea ecx, [esp + 0x290]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x3ac], 0x19
call fcn.0046a430
cmp eax, ebp
jg 0x469473
push str.ECHO_exp_is_missing_exp
mov ecx, esi
call fcn.00468410
jmp 0x46955a
lea eax, [esp + 0x60]
lea ecx, [esp + 0x290]
push eax
push esi
call fcn.0046aa10
cmp eax, ebp
jg 0x469498
mov ecx, dword [esp + 0x20]
push ecx
push str.ECHO_exp_could_not_resolve__s
jmp 0x469553
cmp dword [esp + 0x64], ebp
jne 0x469549
mov eax, dword [esp + 0x70]
cmp eax, ebp
jne 0x4694b2
mov dword [0x5b0abc], ebp
jmp 0x469507
cmp eax, 1
je 0x4694c0
cmp eax, 2
jne 0x469549
mov ecx, dword [0x5b0abc]
mov dword [0x5b0abc], eax
cmp ecx, ebp
jne 0x469507
push 0x5b0738
lea ecx, [esp + 0x40]
call fcn.00512952
lea edx, [esi + 0x44]
push ebp
lea eax, [esp + 0x40]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x3b0], 0x1a
call fcn.00469640
lea ecx, [esp + 0x3c]
mov byte [esp + 0x3a4], 0x19
call fcn.005128e4
lea ecx, [esp + 0x60]
mov byte [esp + 0x3a4], bl
call fcn.004663b0
mov byte [esp + 0x3a4], 0
lea ecx, [esp + 0x398]
call fcn.005128e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x3a4], 0xffffffff
call fcn.005128e4
mov eax, 1
jmp 0x4695df
mov ecx, dword [esp + 0x20]
push ecx
push str.ECHO_exp_must_be:_0_Off_1_Messages_2_Messages_and_Trace
mov ecx, esi
call fcn.00468260
lea ecx, [esp + 0x60]
mov byte [esp + 0x3a4], bl
call fcn.004663b0
mov byte [esp + 0x3a4], 0
lea ecx, [esp + 0x398]
call fcn.005128e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x3a4], 0xffffffff
call fcn.005128e4
or eax, 0xffffffff
jmp 0x4695df
mov eax, dword [esi]
push edx
mov ecx, esi
call dword [eax + 4]
mov edi, eax
cmp edi, ebp
jle 0x4695bd
lea ecx, [esp + 0x10]
mov dword [esp + 0x3a4], 0xffffffff
call fcn.005128e4
mov eax, edi
jmp 0x4695df
push str.Statement_not_understood.
mov ecx, esi
call fcn.00468410
lea ecx, [esp + 0x10]
mov dword [esp + 0x3a4], 0xffffffff
call fcn.005128e4
xor eax, eax
mov ecx, dword [esp + 0x39c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x398
ret 8