Function at 0x415310
Capabilities:
Create process on windows
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52e955
mov eax, dword fs:[0]
push eax
sub esp, 0x5c0
mov eax, dword [0x58cfe0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x31c]
push eax
push str..bat
call fcn.0048ef50
add esp, 8
test eax, eax
je 0x4155f4
push 0x25c
lea eax, [ebp - 0x5bc]
push 0
push eax
call fcn.00509680
add esp, 0xc
mov dword [ebp - 0x5bc], 0x547d50
lea ecx, [ebp - 0x3ac]
push 0
call fcn.004a30c0
push 0
lea ecx, [ebp - 0x3a0]
mov dword [ebp - 0x3a0], 0x546fe8
call fcn.00497c10
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x5bc]
push 0
call fcn.0048b450
mov dword [ebp - 4], 1
xor edi, edi
push edi
push edi
lea eax, [ebp - 0x31c]
push eax
lea ecx, [ebp - 0x5bc]
call fcn.0048bdd0
test eax, eax
je 0x4155b7
push edi
push 0xffffffffffffffff
push str._t_echo_off_r_n
lea ecx, [ebp - 0x5bc]
call fcn.0048ced0
test eax, eax
je 0x4155b7
push edi
push 0xffffffffffffffff
push str.:LOOP_r_n
lea ecx, [ebp - 0x5bc]
call fcn.0048ced0
test eax, eax
je 0x4155b7
push edi
push edi
push esi
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.004822c0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x5bc]
push str._tif_not_exist___s__goto_DONE_r_n
push eax
call fcn.0048c8d0
add esp, 0x20
test eax, eax
je 0x4155b7
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x5bc]
push str._tdel___s__r_n
push eax
call fcn.0048c8d0
add esp, 0xc
test eax, eax
je 0x4155b7
push edi
push 0xffffffffffffffff
push str._tgoto_LOOP_r_n
lea ecx, [ebp - 0x5bc]
call fcn.0048ced0
test eax, eax
je 0x4155b7
push edi
push 0xffffffffffffffff
push str.:DONE_r_n
lea ecx, [ebp - 0x5bc]
call fcn.0048ced0
test eax, eax
je 0x4155b7
push edi
push edi
lea eax, [ebp - 0x5b8]
push eax
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.004822c0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x5bc]
push str._tdel___s__r_n
push eax
call fcn.0048c8d0
add esp, 0x20
test eax, eax
je 0x4155b7
lea ecx, [ebp - 0x5bc]
call fcn.0048b5c0
push 0x44
lea eax, [ebp - 0x360]
push edi
push eax
call fcn.00509680
xor eax, eax
mov dword [ebp - 0x360], 0x44
add esp, 0xc
mov dword [ebp - 0x334], 1
mov word [ebp - 0x330], ax
cmp dword [0x58f684], eax
je 0x41553a
xor ecx, ecx
movzx eax, word [ebp + ecx - 0x5b8]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x31e], ax
test ax, ax
jne 0x415520
jmp 0x415555
lea eax, [ebp - 0x5b8]
push eax
lea eax, [ebp - 0x31c]
push str.command.com__c__s
push eax
call fcn.00405510
add esp, 0xc
lea eax, [ebp - 0x5cc]
push eax
lea eax, [ebp - 0x360]
push eax
push 0
push 0
push 0x44
push 0
push 0
push 0
lea eax, [ebp - 0x31c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4155b7
push 0xfffffffffffffff1
push dword [ebp - 0x5c8]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [ebp - 0x5cc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x5c8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x5c8]
call esi
mov edi, 1
lea ecx, [ebp - 0x5bc]
call fcn.0048b5c0
test edi, edi
jne 0x4155db
lea eax, [ebp - 0x31c]
push 1
push eax
call fcn.00415fb0
add esp, 8
xor esi, esi
jmp 0x4155e0
mov esi, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5bc]
call fcn.0048b4f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00507257
mov esp, ebp
pop ebp
ret