Function at 0x40bc40
Capabilities:
Create process on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x40c967
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x78]
push edi
push esi
lea eax, [esp + 0x1c]
push str.ExecuteNestedApp:
push eax
call fcn.004038e0
push str.__params:
push eax
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x8c], 0
call fcn.00402d20
mov edi, dword [esp + 0x98]
push edi
push eax
lea edx, [esp + 0x30]
push edx
mov byte [esp + 0x98], 1
call fcn.00402d60
add esp, 0x24
mov ebx, eax
mov byte [esp + 0x74], 2
call fcn.00408a00
mov ecx, ebx
mov ebp, eax
call dword [sym.imp.FineObj.dll_public:_wchar_t_const____thiscall_FObj::CUnicodeString::Ptr_void_const]
push eax
push 0x40eb64
push ebp
call fcn.00408870
push 0x40eb5c
push 0x40eb64
push ebp
call fcn.00408870
add esp, 0x18
lea ecx, [esp + 0x10]
mov byte [esp + 0x74], 1
call dword [sym.imp.FineObj.dll_public:_void___thiscall_FObj::CUnicodeString::destructor_void_]
lea ecx, [esp + 0x14]
mov byte [esp + 0x74], 0
call dword [sym.imp.FineObj.dll_public:_void___thiscall_FObj::CUnicodeString::destructor_void_]
lea ecx, [esp + 0x18]
mov dword [esp + 0x74], 0xffffffff
call dword [sym.imp.FineObj.dll_public:_void___thiscall_FObj::CUnicodeString::destructor_void_]
push 0x3c
lea eax, [esp + 0x34]
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
cmp byte [esp + 0x88], 0
mov dword [esp + 0x30], 0x3c
mov dword [esp + 0x34], 0x8400
je 0x40bd41
mov dword [esp + 0x34], 0x8440
mov ecx, esi
call dword [sym.imp.FineObj.dll_public:_wchar_t_const____thiscall_FObj::CUnicodeString::Ptr_void_const]
mov ecx, edi
mov dword [esp + 0x40], eax
call dword [sym.imp.FineObj.dll_public:_wchar_t_const____thiscall_FObj::CUnicodeString::Ptr_void_const]
movzx ecx, byte [esp + 0x84]
neg ecx
sbb ecx, ecx
lea edx, [esp + 0x30]
and ecx, 0xa
push edx
mov dword [esp + 0x48], eax
mov dword [esp + 0x50], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebp, dword [sym.imp.FineObj.dll_bool___cdecl_FObj::GenerateInternalError_enum_FObj::TInternalErrorType__wchar_t_const___wchar_t_const___wchar_t_const___long_int__unsigned_long_int_]
test eax, eax
jne 0x40bdd0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0xe
je 0x40bdc6
cmp ebx, 8
je 0x40bdc6
test ebx, ebx
jne 0x40bda1
call dword [sym.imp.Awl.dll_public:_static_bool___cdecl_AWL::CResourceZeroCodeLock::IsEnabled_void_]
test al, al
jne 0x40bdc6
push ebx
push 0x36
push 0x40e96c
push str.::ShellExecuteEx_shellExecute____0
push str.ExecuteNestedApp
push 1
call ebp
add esp, 0x18
test al, al
je 0x40bdd0
call dword [sym.imp.FineObj.dll_void___cdecl_FObj::FineBreakPoint_void_]
jmp 0x40bdd0
push ebx
call dword [sym.imp.Awl.dll_void___cdecl_AWL::HandleOutOfResources_unsigned_long_int_]
add esp, 4
cmp byte [esp + 0x88], 0
je 0x40c099
cmp dword [esp + 0x68], 0
jne 0x40bdff
push 0
push 0x39
push 0x40e96c
push 0x40f0a8
push 0x40f0a8
push 0
call ebp
add esp, 0x18
mov eax, dword [esp + 0x68]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x68]
lea ecx, [esp + 0x88]
push ecx
push edx
mov dword [esp + 0x90], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40be88
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0xe
je 0x40be7e
cmp ebx, 8
je 0x40be7e
test ebx, ebx
jne 0x40be59
call dword [sym.imp.Awl.dll_public:_static_bool___cdecl_AWL::CResourceZeroCodeLock::IsEnabled_void_]
test al, al
jne 0x40be7e
push ebx
push 0x3d
push 0x40e96c
push str.::CloseHandle_shellExecute.hProcess_
push str.ExecuteNestedApp
push 1
call ebp
add esp, 0x18
test al, al
je 0x40be88
call dword [sym.imp.FineObj.dll_void___cdecl_FObj::FineBreakPoint_void_]
jmp 0x40be88
push ebx
call dword [sym.imp.Awl.dll_void___cdecl_AWL::HandleOutOfResources_unsigned_long_int_]
add esp, 4
mov eax, dword [esp + 0x88]
cmp eax, 0x103
jne 0x40beb7
push 0
push 0x3e
push 0x40e96c
push 0x40f0a8
push 0x40f0a8
push 0
call ebp
mov eax, dword [esp + 0xa0]
add esp, 0x18
test eax, eax
jne 0x40bf63
push esi
lea ecx, [esp + 0x18]
push str.ExecuteNestedApp:_SUCCESS_:
push ecx
call fcn.004038e0
push str.__params:
push eax
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x8c], 3
call fcn.00402d20
push edi
push eax
lea eax, [esp + 0xa4]
mov bl, 4
push eax
mov byte [esp + 0x98], bl
call fcn.00402d60
add esp, 0x24
mov edi, eax
mov byte [esp + 0x74], 5
call fcn.00408a00
mov ecx, edi
mov esi, eax
call dword [sym.imp.FineObj.dll_public:_wchar_t_const____thiscall_FObj::CUnicodeString::Ptr_void_const]
push eax
push 0x40eb64
push esi
call fcn.00408870
push 0x40eb5c
push 0x40eb64
push esi
call fcn.00408870
add esp, 0x18
lea ecx, [esp + 0x84]
mov byte [esp + 0x74], bl
call dword [sym.imp.FineObj.dll_public:_void___thiscall_FObj::CUnicodeString::destructor_void_]
lea ecx, [esp + 0x18]
mov byte [esp + 0x74], 3
call dword [sym.imp.FineObj.dll_public:_void___thiscall_FObj::CUnicodeString::destructor_void_]
lea ecx, [esp + 0x14]
jmp 0x40c071
push 0xa
push eax
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.FineObj.dll_class_FObj::CUnicodeString___cdecl_FObj::UnicodeStr_unsigned_long_int__int_]
push eax
lea edx, [esp + 0x2c]
push str.ExecuteNestedApp:_FAIL_:
push edx
mov dword [esp + 0x8c], 6
call fcn.004038e0
push 0x40f7d0
push eax
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x98], 7
call fcn.00402d20
push esi
push eax
lea ecx, [esp + 0x40]
push ecx
mov byte [esp + 0xa4], 8
call fcn.00402d60
push str.__params:
push eax
lea edx, [esp + 0x50]
mov bl, 9
push edx
mov byte [esp + 0xb0], bl
call fcn.00402d20
push edi
push eax
lea eax, [esp + 0xc8]
push eax
mov byte [esp + 0xbc], 0xa
call fcn.00402d60
add esp, 0x48
mov edi, eax
mov byte [esp + 0x74], 0xb
call fcn.00408a00
mov ecx, edi
mov esi, eax
call dword [sym.imp.FineObj.dll_public:_wchar_t_const____thiscall_FObj::CUnicodeString::Ptr_void_const]
push eax
push 0x40eb64
push esi
call fcn.00408870
push 0x40eb5c
push 0x40eb64
push esi
call fcn.00408870
add esp, 0x18
lea ecx, [esp + 0x84]
mov byte [esp + 0x74], 0xa
call dword [sym.imp.FineObj.dll_public:_void___thiscall_FObj::CUnicodeString::destructor_void_]
lea ecx, [esp + 0x18]
mov byte [esp + 0x74], bl
call dword [sym.imp.FineObj.dll_public:_void___thiscall_FObj::CUnicodeString::destructor_void_]
lea ecx, [esp + 0x14]
mov byte [esp + 0x74], 8
call dword [sym.imp.FineObj.dll_public:_void___thiscall_FObj::CUnicodeString::destructor_void_]
lea ecx, [esp + 0x10]
mov byte [esp + 0x74], 7
call dword [sym.imp.FineObj.dll_public:_void___thiscall_FObj::CUnicodeString::destructor_void_]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x74], 6
call dword [sym.imp.FineObj.dll_public:_void___thiscall_FObj::CUnicodeString::destructor_void_]
lea ecx, [esp + 0x20]
mov dword [esp + 0x74], 0xffffffff
call dword [sym.imp.FineObj.dll_public:_void___thiscall_FObj::CUnicodeString::destructor_void_]
mov eax, dword [esp + 0x88]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret
push esi
lea ecx, [esp + 0x30]
push str.ExecuteNestedApp:_SUCCESSNOWAIT_:
push ecx
call fcn.004038e0
push str.__params:
push eax
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x8c], 0xc
call fcn.00402d20
push edi
push eax
lea eax, [esp + 0x44]
mov bl, 0xd
push eax
mov byte [esp + 0x98], bl
call fcn.00402d60
add esp, 0x24
mov edi, eax
mov byte [esp + 0x74], 0xe
call fcn.00408a00
mov ecx, edi
mov esi, eax
call dword [sym.imp.FineObj.dll_public:_wchar_t_const____thiscall_FObj::CUnicodeString::Ptr_void_const]
push eax
push 0x40eb64
push esi
call fcn.00408870
push 0x40eb5c
push 0x40eb64
push esi
call fcn.00408870
add esp, 0x18
lea ecx, [esp + 0x24]
mov byte [esp + 0x74], bl
call dword [sym.imp.FineObj.dll_public:_void___thiscall_FObj::CUnicodeString::destructor_void_]
lea ecx, [esp + 0x28]
mov byte [esp + 0x74], 0xc
call dword [sym.imp.FineObj.dll_public:_void___thiscall_FObj::CUnicodeString::destructor_void_]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x74], 0xffffffff
call dword [sym.imp.FineObj.dll_public:_void___thiscall_FObj::CUnicodeString::destructor_void_]
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x68
ret