Function at 0x4240db
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x509d60
mov eax, dword fs:[0]
push eax
sub esp, 0x4c4
mov eax, dword [0x5e4ce0]
xor eax, esp
mov dword [esp + 0x4bc], eax
push ebx
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x4d0]
mov dword fs:[0], eax
push 0x46
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
mov edi, str.COfferEXE::RunOfferInstaller
push edi
call fcn.004014b0
and dword [esp + 0x4e0], 0
or dword [esp + 0x4e0], 0xffffffff
call fcn.0040665a
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call dword [eax + 0x9c]
mov dword [esp + 0x4d8], 1
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004037f2
mov byte [esp + 0x4dc], 2
mov byte [esp + 0x4dc], 1
call fcn.00406f75
test eax, eax
pop ecx
jne 0x424249
push 0x4e
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edi
call fcn.004014b0
mov byte [esp + 0x4e0], 3
push str.File_not_found:
lea ecx, [esp + 0x1c]
call fcn.004014b0
mov byte [esp + 0x4e0], 4
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
lea edx, [esp + 0x20]
push edx
push eax
push ecx
call fcn.0040350d
mov byte [esp + 0x4f0], 5
add esp, 8
mov ecx, esp
mov dword [esp + 0x30], esp
push str.nofile
call fcn.004014b0
mov byte [esp + 0x4e8], 6
mov eax, dword [esi]
push 2
mov byte [esp + 0x4ec], 7
mov ecx, esi
call dword [eax + 0x78]
mov byte [esp + 0x4d8], 1
lea ecx, [esp + 0x10]
call fcn.004010f8
xor edi, edi
or dword [esp + 0x4d8], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.004010f8
mov eax, edi
mov ecx, dword [esp + 0x4d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x4bc]
xor ecx, esp
call fcn.004d99c4
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
push 0x100
mov ecx, esi
call dword [eax + 8]
test eax, eax
je 0x42440d
lea eax, [esp + 0x84]
push eax
call fcn.004398db
mov byte [esp + 0x4d8], 8
lea ecx, [esp + 0x10]
call fcn.004037c8
mov byte [esp + 0x4d8], 9
push 0x5b1630
lea ecx, [esp + 0x14]
call fcn.004013dd
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004037f2
mov byte [esp + 0x4dc], 0xa
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.DMCampaignId
call fcn.004014b0
mov byte [esp + 0x4e0], 0xb
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
mov ebx, str.SoftwareFreezeYourScreen
push ebx
call fcn.004014b0
mov byte [esp + 0x4e4], 0xc
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
mov edi, str.hkcu
push edi
call fcn.004014b0
mov byte [esp + 0x4e8], 0xd
mov byte [esp + 0x4e8], 9
call fcn.0043a56c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x3c]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push ecx
add eax, 0xb0
push eax
call fcn.0040f6ca
mov byte [esp + 0x4dc], 0xe
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.LMVersionId
call fcn.004014b0
mov byte [esp + 0x4e0], 0xf
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push ebx
call fcn.004014b0
mov byte [esp + 0x4e4], 0x10
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push edi
call fcn.004014b0
mov byte [esp + 0x4e8], 0x11
mov byte [esp + 0x4e8], 9
call fcn.0043a56c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x3c]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push ecx
add eax, 0xe4
push eax
call fcn.0043060c
mov byte [esp + 0x4dc], 0x12
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.UserSessionId
call fcn.004014b0
mov byte [esp + 0x4e0], 0x13
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push ebx
call fcn.004014b0
mov byte [esp + 0x4e4], 0x14
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push edi
call fcn.004014b0
mov byte [esp + 0x4e8], 0x15
mov byte [esp + 0x4e8], 9
call fcn.0043a56c
mov byte [esp + 0x4d8], 8
lea ecx, [esp + 0x10]
call fcn.004010f8
mov byte [esp + 0x4d8], 1
lea ecx, [esp + 0x84]
call fcn.00439964
mov eax, dword [esi]
push 0x20
mov ecx, esi
call dword [eax + 8]
test eax, eax
je 0x424420
push esi
call fcn.00424780
lea eax, [esp + 0x24]
push eax
mov ecx, esi
call fcn.00424c04
mov byte [esp + 0x4d8], 0x16
lea edi, [esp + 0x14]
call fcn.00403491
push eax
mov ecx, edi
call fcn.004038a3
push 4
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call fcn.004114d4
mov byte [esp + 0x4d8], 0x17
push str..dll
mov ecx, eax
call fcn.004036be
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
mov byte [esp + 0x4d8], 0x16
lea ecx, [esp + 0x10]
call fcn.004010f8
test bl, bl
push dword [esp + 0x24]
lea eax, [esp + 0xc8]
push dword [esp + 0x18]
je 0x42449a
push str.rundll32.exe___s___s
jmp 0x42449f
push str.__s___s
push eax
call fcn.0042503b
add esp, 0x10
push 0x44
pop ebx
push ebx
xor edi, edi
lea eax, [esp + 0x40]
push edi
push eax
call fcn.004db150
mov eax, dword [esi]
add esp, 0xc
push 0x20
mov ecx, esi
mov dword [esp + 0x40], ebx
call dword [eax + 8]
test eax, eax
jne 0x4244da
mov dword [esp + 0x68], 1
mov word [esp + 0x6c], di
push 0x10
lea eax, [esp + 0x30]
push edi
push eax
call fcn.004db150
add esp, 0xc
lea eax, [esp + 0xc4]
push eax
lea ecx, [esp + 0x1c]
call fcn.004014b0
mov byte [esp + 0x4d8], 0x18
lea ecx, [esp + 0x10]
push str.__Creating_process:__
push ecx
mov ecx, eax
call fcn.004035c8
mov byte [esp + 0x4e0], 0x19
add esp, 4
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5af248
push eax
push ecx
call fcn.00403564
add esp, 0xc
mov byte [esp + 0x4dc], 0x1a
mov eax, dword [esi]
mov byte [esp + 0x4dc], 0x19
mov ecx, esi
call dword [eax + 0x90]
mov byte [esp + 0x4d8], 0x18
lea ecx, [esp + 0x10]
call fcn.004010f8
mov byte [esp + 0x4d8], 0x16
lea ecx, [esp + 0x18]
call fcn.004010f8
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x40]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [esp + 0xe4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4245eb
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.__CreateProcess_started_successfully.
call fcn.004014b0
mov byte [esp + 0x4dc], 0x1b
mov eax, dword [esi]
mov byte [esp + 0x4dc], 0x16
mov ecx, esi
call dword [eax + 0x90]
mov eax, dword [esp + 0x2c]
push dword [esp + 0x30]
mov dword [esi + 0x1f0], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0x4d8], 1
lea ecx, [esp + 0x24]
call fcn.004010f8
xor edi, edi
inc edi
jmp 0x424213
push 0x8b
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.COfferEXE::RunOfferInstaller
call fcn.004014b0
mov byte [esp + 0x4e0], 0x1c
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.CreateProcess_failed.
call fcn.004014b0
mov byte [esp + 0x4e4], 0x1d
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.createprocess
call fcn.004014b0
mov byte [esp + 0x4e8], 0x1e
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov byte [esp + 0x4ec], 0x16
mov ecx, esi
call dword [ebx + 0x78]
mov byte [esp + 0x4d8], 1
lea ecx, [esp + 0x24]
call fcn.004010f8
jmp 0x424213