Function at 0x4236e0
Capabilities:
Create process on windows

Disassembly:
push 0xa4
push 0x43f230
call fcn.004276c0
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x2c], ebx
xor eax, eax
mov dword [ebp - 0x28], ebx
mov word [ebp - 0x20], bx
mov byte [ebp - 0x1e], bl
mov dword [ebp - 0x44], ebx
cmp dword [ebp + 8], ebx
setne al
cmp eax, ebx
jne 0x423726
call fcn.00426e0a
mov dword [eax], 0x16
call fcn.00426db8
xor eax, eax
jmp 0x423b99
mov eax, dword [ebp + 0xc]
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
je 0x42370f
mov dl, 0x20
jmp 0x423739
inc eax
cmp byte [eax], dl
je 0x423738
mov cl, byte [eax]
cmp cl, 0x77
je 0x423749
cmp cl, 0x72
jne 0x42370f
mov byte [ebp - 0x20], cl
inc eax
cmp byte [eax], dl
je 0x42374c
mov al, byte [eax]
cmp al, bl
je 0x42375f
cmp al, 0x74
je 0x42375f
cmp al, 0x62
jne 0x42370f
mov byte [ebp - 0x1f], al
cmp al, 0x74
jne 0x42376d
mov esi, 0x4000
jmp 0x423776
cmp al, 0x62
jne 0x423776
mov esi, 0x8000
or esi, 0x80
lea eax, [ebp - 0x4c]
push esi
push 0x400
push eax
call fcn.0042d39b
sub esp, 0xfffffff4
cmp eax, 0xffffffff
je 0x423b96
xor esi, esi
inc esi
cmp byte [ebp - 0x20], 0x77
jne 0x4237ab
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], esi
jmp 0x4237b4
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], ebx
push 9
call fcn.004275ad
pop ecx
or eax, eax
jne 0x4237d7
push dword [ebp - 0x4c]
call fcn.00429bf4
push dword [ebp - 0x48]
call fcn.00429bf4
pop eax
pop ecx
jmp 0x42371f
push 9
call fcn.0042766f
pop ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x58], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [ebp - 0x30]
lea edx, [ebp - 0x40]
lea edi, [ebp + edi*4 - 0x4c]
mov ecx, dword [edi]
push 2
push esi
push ebx
push edx
mov edx, ecx
sar edx, 5
and ecx, 0x1f
push eax
shl ecx, 6
mov edx, dword [edx*4 + 0x444b80]
push dword [edx + ecx]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x423b64
push dword [edi]
call fcn.00429bf4
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x58], ebx
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x34]
push dword [ebp + eax*4 - 0x4c]
call fcn.0042d225
sub esp, 0xfffffff4
mov dword [ebp - 0x2c], eax
cmp eax, ebx
je 0x423b64
xor edi, edi
call fcn.00423682
mov dword [ebp - 0x50], eax
cmp eax, ebx
je 0x423b51
push str.COMSPEC
push ebx
lea eax, [ebp - 0x28]
push eax
call fcn.00420d98
sub esp, 0xfffffff4
cmp eax, ebx
je 0x42388b
cmp eax, 0x16
jne 0x423887
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00426d66
cmp eax, ebx
jne 0x423895
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x42389c
mov dword [ebp - 0x24], str.cmd.exe
lea eax, [ebp - 0xb4]
push 0x44
pop esi
push esi
push ebx
push eax
call fcn.00429890
add esp, 0xc
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0x88], 0x100
mov eax, dword [0x444b80]
cmp dword [ebp - 0x1c], ebx
mov edi, dword [ebp - 0x40]
je 0x4238cf
mov edi, dword [eax]
mov dword [ebp - 0x7c], edi
cmp dword [ebp - 0x1c], 1
mov ecx, dword [ebp - 0x40]
je 0x4238de
mov ecx, dword [eax + 0x40]
mov dword [ebp - 0x78], ecx
mov eax, dword [eax + 0x80]
mov dword [ebp - 0x74], eax
push dword [ebp - 0x24]
call fcn.00423d80
push dword [ebp + 8]
mov edi, eax
call fcn.00423d80
add edi, eax
mov esi, str.__c
push esi
call fcn.00423d80
lea edi, [eax + edi + 1]
push 1
push edi
call fcn.00425c31
mov dword [ebp - 0x1c], eax
add esp, 0x14
cmp eax, ebx
je 0x423b51
push dword [ebp - 0x24]
push edi
push eax
call fcn.00427456
add esp, 0xc
cmp eax, ebx
jne 0x42387d
push esi
push edi
push dword [ebp - 0x1c]
call fcn.0042d1b8
sub esp, 0xfffffff4
cmp eax, ebx
jne 0x42387d
push dword [ebp + 8]
push edi
push dword [ebp - 0x1c]
call fcn.0042d1b8
sub esp, 0xfffffff4
cmp eax, ebx
jne 0x42387d
call fcn.00426e0a
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
push ebx
push dword [ebp - 0x24]
call fcn.0042d139
or eax, eax
pop esi
pop ecx
jne 0x4239a3
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0xb4]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp - 0x1c]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x44], eax
jmp 0x423aff
mov dword [ebp + 8], ebx
push 1
mov edi, 0x104
push edi
call fcn.00425c31
pop ecx
pop ecx
mov esi, eax
mov dword [ebp - 0x5c], esi
cmp esi, ebx
jne 0x4239e6
push ebx
call fcn.004214f1
push dword [ebp - 0x1c]
call fcn.004214f1
push dword [ebp - 0x28]
call fcn.004214f1
add esp, 0xc
call fcn.00426e0a
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
jmp 0x423b51
push str.PATH
push ebx
lea eax, [ebp + 8]
push eax
call fcn.00420d98
sub esp, 0xfffffff4
cmp eax, ebx
je 0x423a2c
cmp eax, 0x16
je 0x42387d
cmp eax, ebx
je 0x423a2c
push dword [ebp + 8]
call fcn.004214f1
push esi
call fcn.004214f1
push dword [ebp - 0x1c]
call fcn.004214f1
push dword [ebp - 0x28]
call fcn.004214f1
add esp, 0x10
jmp 0x4239d7
mov eax, dword [ebp + 8]
push 0x103
push esi
push eax
call fcn.0042d0a4
mov dword [ebp - 0x60], eax
sub esp, 0xfffffff4
cmp eax, ebx
je 0x423aef
cmp byte [esi], bl
je 0x423aef
push esi
call fcn.00423d80
pop ecx
lea eax, [eax + esi - 1]
mov dword [ebp - 0x3c], eax
mov al, byte [eax]
cmp al, 0x5c
jne 0x423b40
push 0x5c
push esi
call fcn.0042d08d
pop ecx
pop ecx
cmp dword [ebp - 0x3c], eax
je 0x423a8f
push 0x43e18c
push edi
push esi
call fcn.0042d1b8
add esp, 0xc
cmp eax, ebx
jne 0x42387d
push dword [ebp - 0x24]
call fcn.00423d80
push esi
mov dword [ebp - 0x3c], eax
call fcn.00423d80
pop ecx
mov esi, dword [ebp - 0x5c]
pop ecx
mov ecx, dword [ebp - 0x3c]
add ecx, eax
cmp ecx, edi
jae 0x423aef
push dword [ebp - 0x24]
push edi
push esi
call fcn.0042d1b8
sub esp, 0xfffffff4
push ebx
cmp eax, ebx
jne 0x42387e
push esi
call fcn.0042d139
test eax, eax
pop ecx
pop ecx
jne 0x423b47
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0xb4]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x44], eax
push dword [ebp + 8]
call fcn.004214f1
push esi
call fcn.004214f1
pop ecx
pop ecx
push dword [ebp - 0x1c]
call fcn.004214f1
push dword [ebp - 0x28]
call fcn.004214f1
pop esi
pop ecx
push dword [ebp - 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x6c]
call esi
call fcn.00426e0a
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x44], ebx
je 0x423b4f
mov ecx, dword [ebp - 0x70]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
jmp 0x423b8a
cmp al, 0x2f
jmp 0x423a76
mov eax, dword [ebp - 0x60]
jmp 0x423a2f
mov dword [eax], ebx
push dword [ebp - 0x2c]
call fcn.004226f5
pop ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x58], ebx
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x58], ebx
je 0x423b77
push dword [ebp + eax*4 - 0x4c]
call fcn.00429bf4
pop ecx
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x58], ebx
je 0x423b8a
push dword [ebp + eax*4 - 0x4c]
call fcn.00429bf4
pop ecx
mov dword [ebp - 4], 0xfffffffe
call fcn.00423b9f
mov eax, dword [ebp - 0x2c]
call fcn.00427705
ret