Function at 0x401200
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xb7c
push ebx
push esi
push edi
mov ecx, 0xd
mov esi, str.rundll32_printui.dll_PrintUIEntry__dl__n__3G_FAX___q
lea edi, [esp + 0x284]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x33
xor eax, eax
lea edi, [esp + 0x2b9]
mov edx, dword [0x42b14c]
rep stosd dword es:[edi], eax
mov ecx, dword [0x42b148]
mov dword [esp + 0x188], edx
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.install.bat]
mov dword [esp + 0x184], ecx
mov dword [esp + 0x180], eax
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x18c]
mov edx, dword [0x42b13c]
rep stosd dword es:[edi], eax
mov eax, dword [str.install_xp.bat]
mov ecx, dword [0x42b138]
mov dword [esp + 0x7c], eax
mov ax, word [0x42b140]
mov dword [esp + 0x80], ecx
mov cl, byte [0x42b142]
mov word [esp + 0x88], ax
mov byte [esp + 0x8a], cl
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x8b]
mov dword [esp + 0x84], edx
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
call fcn.004014d0
cmp eax, 5
mov dword [esp + 0x20], eax
jge 0x4012d2
pop edi
pop esi
mov eax, 2
pop ebx
add esp, 0xb7c
ret
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x38]
xor edx, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], edx
mov word [esp + 0x68], ax
mov dword [esp + 0x10], edx
lea eax, [esp + 0xc]
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], edx
push eax
push ecx
push edx
push edx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateProcessA]
push edx
push edx
push edx
mov dword [esp + 0x34], edx
push edx
lea edx, [esp + 0x2a4]
mov edi, 1
push edx
push 0
mov dword [esp + 0x60], 0x44
mov dword [esp + 0x8c], edi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x401351
mov eax, dword [esp + 0xc]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0xc]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
mov ecx, dword [str.SCOM]
xor eax, eax
mov edx, dword [0x42b12c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x388], ecx
mov dword [esp + 0x2c], eax
mov ax, word [0x42b130]
mov dword [esp + 0x2c], edi
mov word [esp + 0x390], ax
mov ecx, 0xfd
xor eax, eax
lea edi, [esp + 0x392]
mov dword [esp + 0x38c], edx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
lea edx, [esp + 0x1c]
push ecx
push edx
push str._XcvMonitor_Local_Port
stosw word es:[edi], ax
call sub.WINSPOOL.DRV_OpenPrinterA
lea eax, [esp + 0x34]
lea ecx, [esp + 0x30]
push eax
push ecx
lea edx, [esp + 0x790]
push 0
lea eax, [esp + 0x394]
push edx
push eax
call fcn.004094fe
add esp, 4
lea ecx, [eax + eax + 2]
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x398]
push ecx
push edx
push str.AddPort
push eax
call sub.WINSPOOL.DRV_XcvDataW
mov ecx, dword [esp + 0x1c]
push ecx
call sub.WINSPOOL.DRV_ClosePrinter
xor edx, edx
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x38]
mov dword [esp + 0xc], edx
rep stosd dword es:[edi], eax
mov word [esp + 0x68], ax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], edx
cmp eax, 8
mov dword [esp + 0x14], edx
mov dword [esp + 0x38], 0x44
mov dword [esp + 0x64], 1
mov dword [esp + 0x18], edx
jl 0x401473
lea eax, [esp + 0xc]
lea ecx, [esp + 0x38]
push eax
push ecx
push edx
push edx
push edx
push edx
push edx
push edx
lea edx, [esp + 0x1a0]
push edx
push 0
call ebx
test eax, eax
je 0x4014c0
mov eax, dword [esp + 0xc]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0xc]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
lea eax, [esp + 0xc]
lea ecx, [esp + 0x38]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x98]
push 0
push edx
push 0
call ebx
test eax, eax
je 0x4014c0
mov eax, dword [esp + 0xc]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0xc]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xb7c
ret
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0xb7c
ret