Function at 0x14008a02
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, ecx
call fcn.1400a4e2
xor ebx, ebx
test al, al
je 0x14008a4c
mov ecx, dword [esi + 0x124]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x8c]
mov ecx, dword [esi + 0x128]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x8c]
mov ecx, dword [esi + 0x12c]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x8c]
mov ecx, dword [esi + 0x130]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x8c]
mov eax, dword [esp + 0xc]
cmp eax, dword [esi + 0x50]
jne 0x14008d0f
push ebp
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push edi
mov edi, dword [esp + 0x1c]
cmp edi, 5
jne 0x14008a9c
mov ecx, dword [esi + 0x134]
mov byte [esi + 0x92], bl
call fcn.14019574
mov edi, dword [esi + 0x50]
call fcn.140199d7
call fcn.1400a4e2
test al, al
jne 0x14008b60
push 0xfffffffffffffffe
push esi
call fcn.14008781
mov edi, dword [esp + 0x1c]
cmp edi, 0x1c
jne 0x14008acc
call fcn.1400a4e2
test al, al
je 0x14008ab7
push 5
push esi
call fcn.14008781
jmp 0x14008b64
push dword [esi + 0x50]
xor al, al
call fcn.1401d226
mov ecx, dword [0x14045ca0]
mov eax, dword [ecx]
call dword [eax + 8]
cmp edi, 0xf
jne 0x14008ae9
push dword [0x14045bbc]
xor al, al
call fcn.1401d226
mov ecx, dword [0x140463ec]
mov eax, dword [ecx]
call dword [eax + 8]
cmp edi, 3
jne 0x14008b06
push 6
push dword [esi + 0x50]
call ebp
call fcn.1400a4e2
test al, al
jne 0x14008b64
push 0xfffffffffffffffe
push esi
call fcn.14008781
cmp edi, 0x1b
jne 0x14008b45
call fcn.1400a4e2
push 0xa
push ebx
test al, al
je 0x14008b2f
push str.http:__www.onlinesupportcenter.net
push str.iexplore
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x14008b64
push str.http:__www.supportnetcenter.com
push str.iexplore
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp edi, 0x1d
jne 0x14008b64
call fcn.1400a4e2
test al, al
jne 0x14008b64
mov ecx, dword [0x14045ca4]
mov eax, dword [ecx]
call dword [eax + 8]
jmp 0x14008b64
mov edi, dword [esp + 0x1c]
mov eax, edi
sub eax, 0x14
je 0x14008cab
dec eax
je 0x14008c80
dec eax
je 0x14008c41
dec eax
je 0x14008bed
dec eax
jne 0x14008d0d
mov eax, dword [esi + 0x120]
mov dword [esi + 0x114], 4
push ebx
push dword [eax + 0x50]
mov byte [eax + 0x92], bl
call ebp
mov eax, dword [esi + 0x124]
push ebx
push dword [eax + 0x50]
mov byte [eax + 0x92], bl
call ebp
mov eax, dword [esi + 0x128]
push ebx
push dword [eax + 0x50]
mov byte [eax + 0x92], bl
call ebp
mov eax, dword [esi + 0x12c]
push ebx
push dword [eax + 0x50]
mov byte [eax + 0x92], bl
call ebp
mov esi, dword [esi + 0x130]
mov byte [esi + 0x92], 1
push 1
jmp 0x14008d08
mov eax, dword [esi + 0x120]
mov dword [esi + 0x114], 3
push ebx
push dword [eax + 0x50]
mov byte [eax + 0x92], bl
call ebp
mov eax, dword [esi + 0x124]
push ebx
push dword [eax + 0x50]
mov byte [eax + 0x92], bl
call ebp
mov eax, dword [esi + 0x128]
push ebx
push dword [eax + 0x50]
mov byte [eax + 0x92], bl
call ebp
mov eax, dword [esi + 0x12c]
mov byte [eax + 0x92], 1
push 1
jmp 0x14008cf6
mov eax, dword [esi + 0x120]
mov dword [esi + 0x114], 2
push ebx
push dword [eax + 0x50]
mov byte [eax + 0x92], bl
call ebp
mov eax, dword [esi + 0x124]
push ebx
push dword [eax + 0x50]
mov byte [eax + 0x92], bl
call ebp
mov eax, dword [esi + 0x128]
mov byte [eax + 0x92], 1
push 1
jmp 0x14008ce4
mov eax, dword [esi + 0x120]
xor edi, edi
inc edi
mov dword [esi + 0x114], edi
push ebx
push dword [eax + 0x50]
mov byte [eax + 0x92], bl
call ebp
mov eax, dword [esi + 0x124]
mov byte [eax + 0x92], 1
push edi
jmp 0x14008cd2
mov eax, dword [esi + 0x120]
mov dword [esi + 0x114], ebx
push 1
push dword [eax + 0x50]
mov byte [eax + 0x92], 1
call ebp
mov eax, dword [esi + 0x124]
mov byte [eax + 0x92], bl
push ebx
push dword [eax + 0x50]
call ebp
mov eax, dword [esi + 0x128]
push ebx
mov byte [eax + 0x92], bl
push dword [eax + 0x50]
call ebp
mov eax, dword [esi + 0x12c]
mov byte [eax + 0x92], bl
push ebx
push dword [eax + 0x50]
call ebp
mov esi, dword [esi + 0x130]
push ebx
mov byte [esi + 0x92], bl
push dword [esi + 0x50]
call ebp
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
ret 0xc