Function at 0x40c854
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x54]
sub esp, 0xab0
mov eax, dword [ebp + 0x70]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
mov dword [ebp + 0x40], ecx
jne 0x40c871
lea eax, [ebp + 0x24]
mov ecx, dword [ebp + 0x7c]
cmp ecx, ebx
mov dword [ebp + 0x44], eax
mov dword [eax], ebx
je 0x40c888
push 1
push ebx
push 0xffffffffffffffff
push ebx
call fcn.00401592
mov edi, dword [ebp + 0x5c]
cmp edi, ebx
je 0x40cdbe
cmp byte [edi], 0
je 0x40cdbe
push edi
call fcn.00455c50
cmp eax, 0x4001
pop ecx
mov dword [ebp + 0x3c], eax
jb 0x40c8c6
cmp byte [ebp + 0x68], 0
je 0x40ce86
push 0x4585d8
push str.String_too_long.__The_current_thread_will_exit.
jmp 0x40ce7e
inc eax
mov dword [ebp + 0x28], eax
add eax, 3
and eax, 0xfffffffc
call fcn.004561f0
mov eax, dword [ebp + 0x64]
cmp eax, ebx
mov esi, esp
je 0x40c8e6
cmp byte [eax], 0
jne 0x40c8e6
mov dword [ebp + 0x64], ebx
mov eax, dword [ebp + 0x60]
cmp eax, ebx
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x4c], eax
jne 0x40c91c
push edi
push esi
mov dword [ebp + 0x4c], 0x4585d8
call fcn.00455a20
cmp byte [esi], 0x22
pop ecx
pop ecx
jne 0x40c994
lea edi, [esi + 1]
push 0x22
push edi
call fcn.00455d80
jmp 0x40c9a1
push str.find
push edi
call fcn.00441811
test eax, eax
pop ecx
pop ecx
je 0x40c98b
push str.explore
push edi
call fcn.00441811
test eax, eax
pop ecx
pop ecx
je 0x40c98b
push str.open
push edi
call fcn.00441811
test eax, eax
pop ecx
pop ecx
je 0x40c98b
push str.edit
push edi
call fcn.00441811
test eax, eax
pop ecx
pop ecx
je 0x40c98b
push 0x45b3a8
push edi
call fcn.00441811
test eax, eax
pop ecx
pop ecx
je 0x40c98b
push str.properties
push edi
call fcn.00441811
test eax, eax
pop ecx
pop ecx
je 0x40c98b
mov byte [ebp + 0x53], 0
jmp 0x40cb17
mov byte [ebp + 0x53], 1
jmp 0x40cb17
push 0x459be0
push esi
mov edi, esi
call fcn.00438f35
cmp eax, ebx
pop ecx
pop ecx
je 0x40c9af
mov byte [eax], 0
lea ebx, [eax + 1]
jmp 0x40c9b1
xor ebx, ebx
push str.find
push edi
call fcn.00441811
test eax, eax
pop ecx
pop ecx
je 0x40cb87
push str.explore
push edi
call fcn.00441811
test eax, eax
pop ecx
pop ecx
je 0x40cb87
push str.open
push edi
call fcn.00441811
test eax, eax
pop ecx
pop ecx
je 0x40cb87
push str.edit
push edi
call fcn.00441811
test eax, eax
pop ecx
pop ecx
je 0x40cb87
push 0x45b3a8
push edi
call fcn.00441811
test eax, eax
pop ecx
pop ecx
je 0x40cb87
push str.properties
push edi
call fcn.00441811
test eax, eax
pop ecx
pop ecx
je 0x40cb87
push dword [ebp + 0x5c]
mov byte [ebp + 0x53], 0
push esi
call fcn.00455a20
push str..exe
push esi
call fcn.00438b5b
add esp, 0x10
test eax, eax
jne 0x40caef
push str..exe_
push esi
call fcn.00438b5b
test eax, eax
pop ecx
pop ecx
jne 0x40caef
push str..bat
push esi
call fcn.00438b5b
test eax, eax
pop ecx
pop ecx
jne 0x40caef
push str..bat_
push esi
call fcn.00438b5b
test eax, eax
pop ecx
pop ecx
jne 0x40caef
push str..com
push esi
call fcn.00438b5b
test eax, eax
pop ecx
pop ecx
jne 0x40caef
push str..com_
push esi
call fcn.00438b5b
test eax, eax
pop ecx
pop ecx
jne 0x40caef
push str..cmd
push esi
call fcn.00438b5b
test eax, eax
pop ecx
pop ecx
jne 0x40caef
push str..cmd_
push esi
call fcn.00438b5b
test eax, eax
pop ecx
pop ecx
jne 0x40caef
push str..hta
push esi
call fcn.00438b5b
test eax, eax
pop ecx
pop ecx
jne 0x40caef
push str..hta_
push esi
call fcn.00438b5b
test eax, eax
pop ecx
pop ecx
je 0x40cb17
add eax, 4
cmp byte [eax], 0x22
mov dword [ebp + 0x48], esi
mov dword [ebp + 0x4c], eax
jne 0x40cb01
inc eax
mov dword [ebp + 0x4c], eax
cmp byte [eax], 0
je 0x40cb17
mov byte [eax], 0
inc eax
push 0xffffffffffffffff
push eax
mov dword [ebp + 0x4c], eax
call fcn.00409baa
pop ecx
pop ecx
mov ebx, dword [ebp + 0x40]
push 0x7f
xor eax, eax
cmp byte [ebp + 0x78], 0
mov byte [ebp - 0x25c], 0
pop ecx
lea edi, [ebp - 0x25b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [ebp + 0x52], 0
stosb byte es:[edi], al
je 0x40cba3
mov eax, dword [ebx + 0x4d0]
test eax, eax
je 0x40cba3
xor ecx, ecx
cmp word [eax], cx
jne 0x40cb62
mov eax, dword [ebx + 0x4d4]
cmp word [eax], cx
jne 0x40cb62
mov eax, dword [ebx + 0x4d8]
cmp word [eax], cx
je 0x40cba3
cmp byte [ebp + 0x53], 0
mov byte [ebp + 0x7b], 1
je 0x40cbb1
cmp byte [ebp + 0x68], 0
je 0x40ce86
push 0x4585d8
push str.System_verbs_unsupported_with_RunAs.__The_current_thread_will_exit.
mov ecx, ebx
jmp 0x40ce81
test ebx, ebx
mov byte [ebp + 0x53], 1
mov dword [ebp + 0x48], edi
je 0x40cb97
mov dword [ebp + 0x4c], ebx
jmp 0x40cb17
mov dword [ebp + 0x4c], 0x4585d8
jmp 0x40cb17
cmp byte [ebp + 0x53], 0
mov byte [ebp + 0x7b], 0
jne 0x40cd02
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0x6c]
inc eax
test ecx, ecx
mov dword [ebp - 0x20], 0x44
mov dword [ebp + 0xc], eax
je 0x40cbd9
cmp byte [ecx], 0
je 0x40cbd9
push ecx
call fcn.004145b2
pop ecx
and dword [ebp + 0x2c], 0
mov word [ebp + 0x10], ax
xor eax, eax
lea edi, [ebp + 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 0x60]
test edi, edi
je 0x40cc24
cmp byte [edi], 0
je 0x40cc24
push edi
call fcn.00455c50
pop ecx
mov ecx, dword [ebp + 0x3c]
lea eax, [eax + ecx + 0xa]
add eax, 3
and eax, 0xfffffffc
call fcn.004561f0
mov esi, esp
push edi
push dword [ebp + 0x5c]
push str._s__s
push esi
call fcn.00409d3b
add esp, 0x10
jmp 0x40cc3f
mov eax, dword [ebp + 0x28]
add eax, 3
and eax, 0xfffffffc
call fcn.004561f0
mov esi, esp
push dword [ebp + 0x5c]
push esi
call fcn.00455a20
pop ecx
pop ecx
cmp byte [ebp + 0x7b], 0
je 0x40cc77
lea eax, [ebp - 0x25c]
push eax
push dword [ebp + 0x44]
lea eax, [ebp + 0x52]
push eax
lea eax, [ebp + 0x2c]
push eax
push dword [ebp + 0x7c]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0x74]
push dword [ebp + 0x68]
push dword [ebp + 0x64]
push esi
call fcn.0040ce8d
test eax, eax
jne 0x40ccd7
jmp 0x40ce86
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x64]
xor edi, edi
push edi
push edi
push edi
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40ccc0
cmp dword [ebp + 0x30], edi
mov byte [ebp + 0x52], 1
je 0x40cca7
push dword [ebp + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x44]
mov eax, dword [ebp + 0x2c]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x7c]
cmp ecx, edi
je 0x40ccd7
push dword [ebp + 0x34]
call fcn.004018f8
jmp 0x40ccd7
push dword [ebp + 0x74]
lea eax, [ebp - 0x25c]
push 0x200
push eax
call fcn.0043804a
add esp, 0xc
cmp byte [ebp + 0x52], 0
jne 0x40cd9b
cmp byte [ebp + 0x7b], 0
je 0x40cd02
cmp byte [ebp + 0x68], 0
je 0x40ce86
lea eax, [ebp - 0x25c]
push eax
push str.Launch_Error__possibly_related_to_RunAs_.__The_current_thread_will_exit.
jmp 0x40cb80
xor eax, eax
push 0xe
pop ecx
lea edi, [ebp - 0x14]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x64]
mov dword [ebp], eax
mov eax, dword [ebp + 0x6c]
test eax, eax
mov dword [ebp - 0x18], 0x3c
mov dword [ebp - 0x14], 0x440
je 0x40cd38
cmp byte [eax], 0
je 0x40cd38
push eax
call fcn.004145b2
pop ecx
mov dword [ebp + 4], eax
jmp 0x40cd3f
mov dword [ebp + 4], 1
cmp byte [ebp + 0x53], 0
mov esi, dword [ebp + 0x48]
je 0x40cd6c
push str.properties
push esi
mov dword [ebp - 0xc], esi
call fcn.00441811
test eax, eax
pop ecx
pop ecx
jne 0x40cd60
or dword [ebp - 0x14], 0xc
mov eax, dword [ebp + 0x4c]
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
jmp 0x40cd81
mov eax, dword [ebp + 0x4c]
mov cl, byte [eax]
and dword [ebp - 0xc], 0
neg cl
mov dword [ebp - 8], esi
sbb ecx, ecx
and ecx, eax
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40cdd1
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x44]
mov dword [ecx], eax
mov byte [ebp + 0x52], 1
cmp byte [ebp + 0x74], 0
je 0x40cda8
and dword [0x465168], 0
cmp dword [ebp + 0x70], 0
jne 0x40cdbe
mov eax, dword [ebp + 0x44]
mov eax, dword [eax]
test eax, eax
je 0x40cdbe
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
lea esp, [ebp - 0xa68]
pop edi
pop esi
pop ebx
add ebp, 0x54
leave
ret 0x24
push dword [ebp + 0x74]
lea eax, [ebp - 0x25c]
push 0x200
push eax
call fcn.0043804a
add esp, 0xc
cmp byte [ebp + 0x52], 0
jne 0x40cd9b
cmp byte [ebp + 0x68], 0
je 0x40ce86
cmp byte [ebp + 0x53], 0
je 0x40ce17
push esi
push str._nVerb:___s_
lea eax, [ebp - 0x5c]
push 0x80
push eax
call fcn.00409c5f
add esp, 0x10
jmp 0x40ce1b
mov byte [ebp - 0x5c], 0
push dword [ebp + 0x4c]
call fcn.00455c50
mov esi, 0x190
cmp eax, esi
mov edi, 0x45a098
pop ecx
mov ebx, edi
ja 0x40ce39
mov ebx, 0x4585d8
push dword [ebp + 0x48]
call fcn.00455c50
cmp eax, esi
pop ecx
ja 0x40ce4b
mov edi, 0x4585d8
push ebx
push dword [ebp + 0x4c]
lea eax, [ebp - 0x5c]
push eax
push edi
push dword [ebp + 0x48]
lea eax, [ebp - 0xa5c]
push str.Failed_attempt_to_launch_program_or_document:_nAction:____0.400s_s__s_nParams:____0.400s_s__n_nThe_current_thread_will_exit.
push 0x800
push eax
call fcn.00409c5f
add esp, 0x20
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0xa5c]
push eax
mov ecx, dword [ebp + 0x40]
call fcn.0044a7cd
xor eax, eax
jmp 0x40cdc1