Function at 0x4073b0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x65c
mov eax, dword [0x483390]
xor eax, esp
mov dword [esp + 0x658], eax
mov eax, dword [esp + 0x664]
push ebx
push ebp
mov ebp, dword [esp + 0x668]
xor ebx, ebx
push 0x207
lea ecx, [esp + 0x151]
push ebx
push ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x158], bl
call fcn.00446e10
add esp, 0xc
mov eax, 0x208
lea ecx, [esp + 0x14c]
call fcn.00406570
test eax, eax
jne 0x407428
pop ebp
mov eax, 0x80004005
pop ebx
mov ecx, dword [esp + 0x658]
xor ecx, esp
call fcn.004426a0
add esp, 0x65c
ret
lea eax, [esp + 0x14c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x407432
sub eax, edx
je 0x40740c
mov cl, byte [esp + eax + 0x14b]
lea eax, [esp + eax + 0x14b]
cmp cl, 0x5c
je 0x407455
cmp cl, 0x2f
jne 0x407457
mov byte [eax], bl
push 0x207
lea edx, [esp + 0x45d]
push ebx
push edx
call fcn.00446e10
mov eax, 0x22
mov word [esp + 0x464], ax
lea eax, [esp + 0x158]
add esp, 0xc
mov ecx, eax
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x407483
push esi
push edi
lea edi, [esp + 0x460]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x407498
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x460]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4074b6
mov ecx, dword [str._rsstub.exe_]
mov edx, dword [0x473b94]
mov dword [eax], ecx
mov ecx, dword [0x473b98]
mov dword [eax + 4], edx
mov dl, byte [0x473b9c]
mov dword [eax + 8], ecx
push 0x104
mov byte [eax + 0xc], dl
lea eax, [esp + 0x360]
push ebx
push eax
call fcn.00446e10
add esp, 0xc
push 0x104
lea ecx, [esp + 0x360]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, ebp
mov eax, 0x473127
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407532
cmp dl, bl
je 0x40752e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407532
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x407512
xor eax, eax
jmp 0x407537
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4075ca
mov eax, dword [0x473ba4]
mov edx, dword [str._highrun__binpath__]
mov ecx, dword [0x473ba8]
mov dword [esp + 0x54], eax
mov eax, dword [0x473bb0]
mov dword [esp + 0x50], edx
mov edx, dword [0x473bac]
mov dword [esp + 0x60], eax
lea eax, [esp + 0x35c]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x58], ecx
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x407578
lea edi, [esp + 0x50]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x407586
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x50]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4075a3
mov ecx, dword [str.___logon]
mov edx, dword [0x473bb8]
mov dword [eax], ecx
mov cl, byte [0x473bbc]
mov dword [eax + 4], edx
mov byte [eax + 8], cl
jmp 0x40768e
mov eax, dword [0x473bc4]
mov edx, dword [str._run__logon__binpath]
mov ecx, dword [0x473bc8]
mov dword [esp + 0x54], eax
mov eax, dword [0x473bd0]
mov dword [esp + 0x50], edx
mov edx, dword [0x473bcc]
mov dword [esp + 0x58], ecx
mov cx, word [0x473bd4]
mov dword [esp + 0x60], eax
mov eax, ebp
mov dword [esp + 0x5c], edx
mov word [esp + 0x64], cx
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x407610
lea edi, [esp + 0x50]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x407620
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x50]
rep movsb byte es:[edi], byte [esi]
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x407640
mov edx, dword [str.__argument]
mov ecx, dword [0x473bdc]
mov dword [eax], edx
mov edx, dword [0x473be0]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov eax, dword [esp + 0x10]
mov ecx, eax
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x407668
lea edi, [esp + 0x50]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x407678
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x50]
push eax
push str.RunBySrv
push str._s_param_s
push 0x80
call fcn.00431310
push 0x3c
lea ecx, [esp + 0x28]
push ebx
push ecx
call fcn.00446e10
add esp, 0x1c
lea ecx, [esp + 0x14]
lea edx, [esp + 0x460]
lea eax, [esp + 0x50]
push ecx
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], str.open
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop edi
pop esi
cmp eax, 1
jne 0x407702
mov ebx, eax
mov ecx, dword [esp + 0x660]
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.004426a0
add esp, 0x65c
ret