Function at 0x2e01bbda
Capabilities:
Create process on windows

Disassembly:
push 0x310
mov eax, 0x2e0309d4
call fcn.2e02e6de
mov eax, dword [ebp + 8]
and dword [ebp - 0x2dc], 0
mov edi, dword [ebp + 0x10]
or dword [ebp - 0x2d0], 0xffffffff
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2d4], eax
xor eax, eax
test edi, edi
mov dword [ebp - 0x2b8], ebx
setne al
movzx ecx, ax
mov eax, dword [0x2e046aec]
mov dword [ebp - 0x2a8], ecx
mov esi, dword [eax + 0xca8]
mov ecx, esi
call dword [0x2e0332d8]
call esi
test ax, ax
je 0x2e01bd4d
mov eax, dword [0x2e046aec]
mov esi, dword [eax + 0xcac]
mov ecx, esi
call dword [0x2e0332d8]
call esi
test eax, eax
je 0x2e01bd4d
and dword [ebp - 0x2a4], 0
xor ebx, ebx
mov esi, dword [ebp - 0x2b8]
inc ebx
test esi, esi
je 0x2e01bcbd
and dword [ebp - 0x2a4], 0
cmp dword [esi + 4], 0
je 0x2e01bcbd
push str._blank
push dword [esi + 4]
call fcn.2e001137
pop ecx
pop ecx
test eax, eax
je 0x2e01bcb7
and dword [ebp - 0x2a4], 0
push str.bogusFrame
push dword [esi + 4]
call fcn.2e001137
pop ecx
pop ecx
test eax, eax
jne 0x2e01bcbd
mov dword [ebp - 0x2a4], ebx
push edi
call fcn.2e001137
pop ecx
test eax, eax
je 0x2e01be93
xor esi, esi
lea ecx, [ebp - 0x2c4]
push ebx
push esi
push eax
mov dword [ebp - 0x2c4], esi
mov dword [ebp - 0x2c0], esi
call fcn.2e001137
mov eax, dword [0x2e046aec]
mov dword [ebp - 4], esi
mov esi, dword [eax + 0xcac]
mov ecx, esi
call dword [0x2e0332d8]
call esi
mov ebx, eax
mov eax, dword [0x2e048f98]
push 0
push dword [ebp - 0x2a4]
mov esi, dword [eax + 0x54]
mov ecx, esi
push dword [ebp - 0x2c4]
mov edi, dword [ebx]
call dword [0x2e0332d8]
call esi
pop ecx
mov ecx, dword [edi + 0xc0]
push eax
call dword [0x2e0332d8]
mov ecx, ebx
call dword [edi + 0xc0]
lea ecx, [ebp - 0x2c4]
call fcn.2e001137
xor eax, eax
inc eax
jmp 0x2e01c540
test ebx, ebx
je 0x2e01bd8f
cmp dword [ebx + 4], 0
je 0x2e01bd8f
push str.bogusframe
push dword [ebx + 4]
call sub.VCRUNTIME140.dll_strstr
pop ecx
pop ecx
test eax, eax
je 0x2e01bd8f
push edi
call fcn.2e001137
pop ecx
test ax, ax
je 0x2e01bd45
push 5
push 0x2e033941
push 0
push edi
push 0x2e0344a8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x2e01bd45
test edi, edi
je 0x2e01c539
push 5
push str.file:
push edi
call fcn.2e001137
mov ecx, eax
add esp, 0xc
xor eax, eax
test ecx, ecx
sete al
movzx eax, ax
mov dword [ebp - 0x2bc], eax
test ecx, ecx
jne 0x2e01bdc1
xor esi, esi
jmp 0x2e01bdd9
push 7
push 0x2e0357e0
push edi
call fcn.2e001137
add esp, 0xc
neg eax
sbb eax, eax
inc eax
movzx esi, ax
push edi
call fcn.2e01bb54
cmp word [ebp - 0x2bc], 0
movzx eax, ax
pop ecx
mov dword [ebp - 0x2c8], eax
je 0x2e01be34
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
pop ecx
cmp eax, 0xa
jbe 0x2e01be34
push 8
push str.file:___
push edi
call fcn.2e001137
add esp, 0xc
test eax, eax
jne 0x2e01be34
mov al, byte [edi + 8]
cmp al, 0x61
jl 0x2e01be1e
cmp al, 0x7a
jle 0x2e01be24
sub al, 0x41
cmp al, 0x19
ja 0x2e01be34
cmp byte [edi + 9], 0x7c
jne 0x2e01be34
cmp byte [edi + 0xa], 0x2f
jne 0x2e01be34
mov byte [edi + 9], 0x3a
push edi
call fcn.2e001137
movzx eax, ax
mov dword [ebp - 0x2b4], eax
movzx eax, ax
mov dword [esp], str..fdf
push edi
mov dword [ebp - 0x2b0], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add eax, 0xfffffffc
pop ecx
add eax, edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
pop ecx
sete byte [ebp - 0x2a9]
pop ecx
test eax, eax
je 0x2e01bf49
cmp word [ebp - 0x2bc], 0
je 0x2e01bf18
push edi
call fcn.2e001137
mov esi, eax
pop ecx
test esi, esi
jne 0x2e01be9a
xor eax, eax
jmp 0x2e01c540
push 0x3c
pop edi
push edi
xor ebx, ebx
lea eax, [ebp - 0x31c]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x31c], edi
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x318], ebx
mov dword [ebp - 0x314], ebx
mov dword [ebp - 0x310], str.open
push eax
mov dword [ebp - 0x30c], esi
mov dword [ebp - 0x308], ebx
mov dword [ebp - 0x304], ebx
mov dword [ebp - 0x300], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
mov eax, dword [0x2e048f90]
push esi
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2e0332d8]
call esi
xor eax, eax
cmp edi, 0x20
pop ecx
setg al
jmp 0x2e01c540
test si, si
jne 0x2e01bf26
cmp word [ebp - 0x2c8], si
je 0x2e01bf49
push 5
push 0x2e033941
xor eax, eax
push eax
push edi
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov ax, cx
jmp 0x2e01c540
cmp dword [0x2e048ee8], 0
je 0x2e01bfa7
cmp word [ebp - 0x2b4], 0
jne 0x2e01bfa7
mov eax, dword [0x2e048ed8]
test eax, eax
je 0x2e01bf76
push edi
push eax
call fcn.2e001137
pop ecx
pop ecx
test eax, eax
je 0x2e01c34b
xor eax, eax
push eax
push eax
push 0x1a
push 3
pop ebx
push ebx
push 4
push eax
call fcn.2e01aaf9
add esp, 0x18
cmp ax, bx
jne 0x2e01c34b
call fcn.2e004f9c
xor eax, eax
inc eax
mov word [0x2e048ee0], ax
jmp 0x2e01c34b
xor eax, eax
push str.WWW_OpenURL
mov word [0x2e048ee0], ax
call fcn.2e001137
movzx eax, ax
mov dword [ebp - 0x2e0], eax
pop ecx
push edi
test ax, ax
jne 0x2e01bff3
call fcn.2e001137
pop ecx
test ax, ax
je 0x2e01bfe3
mov dword [ebp - 0x2a8], 1
jmp 0x2e01c511
xor esi, esi
push esi
call fcn.2e001137
pop ecx
test ax, ax
jne 0x2e01c011
jmp 0x2e01c03b
call fcn.2e001137
pop ecx
cmp eax, 0xec
ja 0x2e01c501
cmp word [ebp + 0x1c], 0
jne 0x2e01c501
xor esi, esi
call fcn.2e001137
mov ecx, eax
cmp ecx, 2
je 0x2e01c046
push esi
push esi
push 0x19
pop eax
push 0x1b
pop edx
test ecx, ecx
cmove eax, edx
movzx eax, ax
push eax
push 1
push 2
push esi
call fcn.2e01aaf9
add esp, 0x18
mov dword [ebp - 0x2a8], esi
jmp 0x2e01c511
call fcn.2e01caeb
mov eax, dword [0x2e048ed8]
test eax, eax
je 0x2e01c068
push eax
mov eax, dword [0x2e048f90]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2e0332d8]
call esi
pop ecx
push edi
call fcn.2e001137
xor esi, esi
mov dword [0x2e048ed8], eax
mov eax, dword [0x2e048ed4]
inc esi
pop ecx
cmp eax, 3
je 0x2e01c0f7
cmp eax, 5
je 0x2e01c0f7
cmp eax, 4
je 0x2e01c0f7
cmp eax, 8
je 0x2e01c0f7
cmp eax, 9
je 0x2e01c0f7
cmp eax, 0xa
je 0x2e01c0f7
mov ecx, dword [ebp - 0x2b0]
movzx edx, cx
mov dword [ebp - 0x2b4], edx
test cx, cx
jne 0x2e01c10e
call fcn.2e001137
push 0
mov dword [0x2e048ef0], eax
mov dword [0x2e048ef4], edx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
push 5
push eax
push 0x2e01c6d0
mov dword [ebp - 0x2c8], edx
call fcn.2e001137
mov dword [0x2e048ee8], eax
add esp, 0x10
mov eax, dword [ebp - 0x2b0]
movzx ecx, ax
mov eax, dword [0x2e048ed4]
mov dword [ebp - 0x2b4], ecx
jmp 0x2e01c115
push dword [ebp - 0x2d8]
call fcn.2e01ccd0
mov eax, dword [0x2e048ed4]
pop ecx
mov dword [ebp - 0x2b4], esi
and dword [0x2e048ee8], 0
test ebx, ebx
je 0x2e01c2ca
cmp dword [ebx + 4], 0
je 0x2e01c2ca
push str.WWW_ListWindows
push 0x2e048eb4
push dword [0x2e048eb0]
call fcn.2e001137
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x2e01c2c5
mov eax, dword [ebx]
push 0
push str.ABCD
push dword [eax]
call sub.USER32.dll_DdeCreateStringHandleA
xor ecx, ecx
mov esi, eax
push ecx
push 0x2710
push 0x20b0
xor eax, eax
inc eax
push eax
push esi
push dword [ebx + 0xc]
push ecx
push ecx
call sub.USER32.dll_DdeClientTransaction
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebx]
push esi
push dword [eax]
call sub.USER32.dll_DdeFreeStringHandle
mov eax, dword [ebp - 0x2a4]
test eax, eax
je 0x2e01c2ae
mov eax, dword [ebx]
push dword [eax]
call sub.USER32.dll_DdeGetLastError
push 0
push 0x102
lea eax, [ebp - 0x198]
push eax
push dword [ebp - 0x2a4]
call sub.USER32.dll_DdeGetData
mov eax, dword [ebx]
push dword [eax]
call sub.USER32.dll_DdeGetLastError
test eax, eax
jne 0x2e01c2a8
lea eax, [ebp - 0x198]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x2b0], eax
test eax, eax
je 0x2e01c2a8
mov esi, dword [ebp - 0x2b8]
push str.WWW_GetWindowInfo
push 0x2e048eb4
push dword [0x2e048eb0]
call fcn.2e001137
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x2e01c25b
mov ecx, 0x82
lea eax, [ebp - 0x94]
push ecx
push eax
push ecx
lea eax, [ebp - 0x21c]
push eax
push ecx
lea eax, [ebp - 0x2a0]
push eax
push dword [ebp - 0x2b0]
push 0x2e035840
push 0x2e034adc
push ebx
call fcn.2e001137
add esp, 0x28
test eax, eax
jne 0x2e01c25b
push dword [esi + 4]
lea eax, [ebp - 0x94]
push eax
call fcn.2e001137
pop ecx
pop ecx
test eax, eax
je 0x2e01c28c
push ebx
push dword [0x2e048eb0]
call fcn.2e001137
mov eax, dword [ebp - 0x2c8]
xor ebx, ebx
add eax, 4
mov dword [ebp - 0x2c8], eax
pop ecx
pop ecx
mov eax, dword [eax]
mov dword [ebp - 0x2b0], eax
test eax, eax
jne 0x2e01c1ee
jmp 0x2e01c2a8
mov eax, dword [ebp - 0x2b0]
push ebx
push dword [0x2e048eb0]
mov dword [ebp - 0x2d0], eax
call fcn.2e001137
pop ecx
pop ecx
xor ebx, ebx
mov eax, dword [ebp - 0x2a4]
push eax
call sub.USER32.dll_DdeFreeDataHandle
push ebx
push dword [0x2e048eb0]
call fcn.2e001137
pop ecx
xor esi, esi
pop ecx
inc esi
mov eax, dword [0x2e048ed4]
cmp eax, 3
jne 0x2e01c2e4
cmp word [ebp - 0x2e0], 0
jne 0x2e01c2e4
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
push str.WWW_OpenURL
push 0x2e048eb4
push dword [0x2e048eb0]
call fcn.2e001137
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x2e01c357
push dword [0x2e048eb0]
call fcn.2e001137
pop ecx
test ax, ax
jne 0x2e01c346
mov eax, dword [0x2e047be4]
push dword [0x2e048ee4]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x2e0332d8]
call esi
pop ecx
test ax, ax
jne 0x2e01c346
xor ecx, ecx
xor eax, eax
push ecx
push ecx
push 0x14
inc eax
push eax
push 2
push ecx
call fcn.2e01aaf9
add esp, 0x18
call fcn.2e01c689
and dword [ebp - 0x2a8], 0
jmp 0x2e01c511
mov eax, dword [0x2e048ed4]
cmp eax, 7
je 0x2e01c493
cmp eax, 6
je 0x2e01c493
cmp word [ebp - 0x2b4], 0
mov edx, 0x2e033941
mov eax, edx
mov ecx, str.AcroWWW
cmove eax, ecx
lea ecx, [ebp - 0x2dc]
push ecx
push eax
push eax
push edx
push dword [ebp - 0x2d4]
push 4
push dword [ebp - 0x2d0]
push edx
push edi
push 0x2e03584c
push str.ssllssss
push ebx
call fcn.2e001137
add esp, 0x30
sub eax, 0
je 0x2e01c45e
sub eax, 1
je 0x2e01c425
sub eax, 1
jne 0x2e01c4dc
push dword [0x2e048eb0]
call fcn.2e001137
pop ecx
test ax, ax
jne 0x2e01c40d
mov eax, dword [0x2e047be4]
push dword [0x2e048ee4]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x2e0332d8]
call esi
pop ecx
test ax, ax
jne 0x2e01c40d
xor ecx, ecx
xor eax, eax
push ecx
push ecx
push 0x14
inc eax
push eax
push 2
push ecx
call fcn.2e01aaf9
add esp, 0x18
push ebx
push dword [0x2e048eb0]
call fcn.2e001137
and dword [ebp - 0x2a8], 0
jmp 0x2e01c4da
push ebx
push dword [0x2e048eb0]
call fcn.2e001137
push esi
push dword [ebp - 0x2b8]
push dword [ebp - 0x2d4]
push edi
push dword [ebp - 0x2c0]
push dword [ebp - 0x2d8]
call fcn.2e01bbda
movzx eax, ax
add esp, 0x20
mov dword [ebp - 0x2a8], eax
jmp 0x2e01c4dc
push ebx
push dword [0x2e048eb0]
call fcn.2e001137
cmp dword [0x2e048ed4], 2
pop ecx
pop ecx
jne 0x2e01c4dc
cmp dword [ebp - 0x2dc], 0
jge 0x2e01c4dc
push 0
push 0
push 0x47
push esi
push 2
push 0
call fcn.2e01aaf9
add esp, 0x18
jmp 0x2e01c4dc
push edi
call fcn.2e001137
inc eax
push eax
push edi
push ebx
call fcn.2e001137
add esp, 0x10
test ax, ax
jne 0x2e01c4ce
push dword [0x2e048eb0]
call fcn.2e001137
pop ecx
test ax, ax
jne 0x2e01c40d
xor eax, eax
push eax
push eax
push 0x14
push esi
push 2
push eax
jmp 0x2e01c405
push ebx
push dword [0x2e048eb0]
call fcn.2e001137
pop ecx
pop ecx
mov eax, dword [0x2e048ed8]
test eax, eax
je 0x2e01c511
push eax
mov eax, dword [0x2e048f90]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2e0332d8]
call esi
and dword [0x2e048ed8], 0
jmp 0x2e01c510
push edi
call fcn.2e001137
movzx eax, ax
mov dword [ebp - 0x2a8], eax
pop ecx
cmp word [ebp - 0x2bc], 0
je 0x2e01c539
cmp byte [ebp - 0x2a9], 0
jne 0x2e01c539
mov ecx, dword [0x2e048f90]
push edi
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x2e0332d8]
call esi
pop ecx
mov ax, word [ebp - 0x2a8]
call fcn.2e02e6bc
ret