Function at 0x4029b8
Capabilities:
Create process on windows

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x11c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xec], ecx
mov edx, dword [eax + 4]
mov esi, dword [eax]
lea eax, [ebp - 0xe8]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x30], edx
lea ebx, [esi + edx]
cmp edx, 7
jbe 0x402a13
lea eax, [ebp - 0x30]
xor edi, edi
lea ecx, [ebp - 0xf0]
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00433eb0
push edx
push edx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xe8], edx
mov ecx, esi
mov esi, eax
cmp ecx, ebx
je 0x402a29
movsx di, byte [ecx]
add esi, 2
inc ecx
mov word [esi - 2], di
jmp 0x402a17
mov dword [ebp - 0xec], edx
mov word [eax + edx*2], 0
mov dword [esp], 0x43a6e4
call fcn.00417d10
mov dword [esp], 0x43a6d4
mov ebx, eax
call fcn.00417d10
cmp byte [ebx], 0
jne 0x402a72
xor edx, edx
mov esi, 0x43b3ca
mov ecx, 7
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
lea edx, [eax + 0xa]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x402ac3
lea ecx, [eax + 0xa]
mov bl, 0x94
mov edx, dword [eax + 4]
mov edi, dword [eax]
lea esi, [edx + 1]
cmp esi, edi
jne 0x402a8c
inc edx
jmp 0x402ab6
lea esi, [edx + 2]
cmp esi, edi
jne 0x402a98
add edx, 2
jmp 0x402ab6
cmp edx, edi
jne 0x402aa0
xor byte [ecx], bl
jmp 0x402abc
lea esi, [edx + 4]
cmp edi, esi
jne 0x402aac
add edx, 3
jmp 0x402ab6
lea esi, [edx + 5]
cmp edi, esi
jne 0x402abc
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x402a7d
inc ebx
inc ecx
cmp bl, 0xb0
jne 0x402a7d
mov byte [eax + 9], 1
add eax, 0xa
lea ecx, [ebp - 0x30]
mov dword [esp], eax
call fcn.00401606
push ebx
mov esi, dword [ebp - 0xec]
lea eax, [ebp - 0x58]
xor edi, edi
mov dword [ebp - 0x60], eax
mov ebx, dword [ebp - 0xf0]
add esi, esi
mov dword [ebp - 0x5c], edi
mov edx, esi
sar edx, 1
mov dword [ebp - 0x48], edx
cmp esi, 0x1e
jbe 0x402b1a
xor ecx, ecx
lea eax, [ebp - 0x48]
mov dword [esp + 4], ecx
lea ecx, [ebp - 0x60]
mov dword [esp], eax
call fcn.00430280
push edx
push edx
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], edx
add esi, ebx
cmp esi, ebx
je 0x402b2c
mov dx, word [ebx]
inc eax
add ebx, 2
mov byte [eax - 1], dl
jmp 0x402b1c
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x5c], eax
mov byte [edx + eax], 0
mov dword [esp], 0x43a6c4
call fcn.00417d10
mov dword [esp], 0x43a6b4
mov ebx, eax
call fcn.00417d10
cmp byte [ebx], 0
mov edx, eax
jne 0x402b78
xor eax, eax
mov esi, 0x43b40a
mov ecx, 0xea
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
lea eax, [edx + 0xa]
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x402bcf
lea ecx, [edx + 0xa]
mov esi, 0xffffff93
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x402b95
inc eax
jmp 0x402bc1
lea edi, [eax + 2]
cmp ebx, edi
jne 0x402ba1
add eax, 2
jmp 0x402bc1
cmp ebx, eax
jne 0x402bab
mov eax, esi
xor byte [ecx], al
jmp 0x402bc7
lea edi, [eax + 4]
cmp ebx, edi
jne 0x402bb7
add eax, 3
jmp 0x402bc1
lea edi, [eax + 5]
cmp ebx, edi
jne 0x402bc7
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x402b86
inc esi
inc ecx
mov eax, esi
cmp al, 0x7d
jne 0x402b86
mov byte [edx + 9], 1
add edx, 0xa
lea ecx, [ebp - 0x90]
mov dword [esp], edx
call fcn.00401606
push eax
mov dword [esp], 0x43a6a4
call fcn.00417d10
mov dword [esp], 0x43a694
mov ebx, eax
call fcn.00417d10
cmp byte [ebx], 0
mov edx, eax
jne 0x402c25
xor edi, edi
lea eax, [eax + 0xa]
mov esi, 0x43b50a
mov ecx, 0x23
mov dword [eax - 0xa], edi
mov dword [eax - 6], edi
mov dword [eax - 2], edi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x402c7c
lea ecx, [edx + 0xa]
mov esi, 0xffffff93
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x402c42
inc eax
jmp 0x402c6e
lea edi, [eax + 2]
cmp ebx, edi
jne 0x402c4e
add eax, 2
jmp 0x402c6e
cmp ebx, eax
jne 0x402c58
mov eax, esi
xor byte [ecx], al
jmp 0x402c74
lea edi, [eax + 4]
cmp ebx, edi
jne 0x402c64
add eax, 3
jmp 0x402c6e
lea edi, [eax + 5]
cmp ebx, edi
jne 0x402c74
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x402c33
inc esi
inc ecx
mov eax, esi
cmp al, 0xb6
jne 0x402c33
mov byte [edx + 9], 1
add edx, 0xa
lea ebx, [ebp - 0xc0]
mov dword [esp], edx
mov ecx, ebx
call fcn.00401606
push esi
mov eax, dword [ebp + 8]
mov ecx, ebx
mov dword [esp], eax
call fcn.0042ed00
push edx
lea ecx, [ebp - 0xa8]
lea esi, [ebp - 0x78]
mov dword [esp], eax
call fcn.00430590
lea eax, [ebp - 0x90]
push ecx
mov dword [esp + 8], eax
lea eax, [ebp - 0xa8]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00435648
lea edi, [ebp - 0x48]
lea eax, [ebp - 0x60]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.00435648
lea eax, [ebp - 0xd8]
lea edx, [ebp - 0x30]
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.00435648
mov ecx, edi
call fcn.0042da30
mov ecx, esi
call fcn.0042da30
lea ecx, [ebp - 0xa8]
call fcn.0042da30
mov ecx, ebx
call fcn.0042da30
lea ecx, [ebp - 0x90]
call fcn.0042da30
lea ecx, [ebp - 0x60]
call fcn.0042da30
lea ecx, [ebp - 0x30]
call fcn.0042da30
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x100], eax
mov dword [esp], 0x43a724
call fcn.00417d10
mov dword [esp], 0x43a714
mov ebx, eax
call fcn.00417d10
cmp byte [ebx], 0
mov edx, eax
jne 0x402d86
xor edi, edi
lea eax, [eax + 0xa]
mov esi, 0x43b396
mov ecx, 0xf
mov dword [eax - 0xa], edi
mov dword [eax - 6], edi
mov dword [eax - 2], edi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x402ddd
lea ecx, [edx + 0xa]
mov esi, 0xffffff95
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x402da3
inc eax
jmp 0x402dcf
lea edi, [eax + 2]
cmp ebx, edi
jne 0x402daf
add eax, 2
jmp 0x402dcf
cmp ebx, eax
jne 0x402db9
mov eax, esi
xor byte [ecx], al
jmp 0x402dd5
lea edi, [eax + 4]
cmp ebx, edi
jne 0x402dc5
add eax, 3
jmp 0x402dcf
lea edi, [eax + 5]
cmp ebx, edi
jne 0x402dd5
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x402d94
inc esi
inc ecx
mov eax, esi
cmp al, 0xa4
jne 0x402d94
lea eax, [edx + 0xa]
mov byte [edx + 9], 1
mov dword [ebp - 0xfc], eax
mov dword [esp], 0x43a704
call fcn.00417d10
mov dword [esp], 0x43a6f4
mov ebx, eax
call fcn.00417d10
cmp byte [ebx], 0
mov edx, eax
lea ecx, [eax + 0xa]
jne 0x402e28
xor esi, esi
mov dword [eax + 8], esi
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 0xa], 0xf6f8e0e6
mov word [ecx + 4], 0x99eb
mov byte [ebx], 1
cmp byte [edx + 9], 0
mov esi, 0xffffff94
jne 0x402e7c
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x402e42
inc eax
jmp 0x402e6e
lea edi, [eax + 2]
cmp ebx, edi
jne 0x402e4e
add eax, 2
jmp 0x402e6e
cmp ebx, eax
jne 0x402e58
mov eax, esi
xor byte [ecx], al
jmp 0x402e74
lea edi, [eax + 4]
cmp ebx, edi
jne 0x402e64
add eax, 3
jmp 0x402e6e
lea edi, [eax + 5]
cmp ebx, edi
jne 0x402e74
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x402e33
inc esi
inc ecx
mov eax, esi
cmp al, 0x9a
jne 0x402e33
xor eax, eax
mov byte [edx + 9], 1
add edx, 0xa
lea esi, [ebp - 0xd8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x100]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xfc]
mov dword [esp + 4], edx
xor edx, edx
mov dword [esp + 8], eax
mov dword [esp], edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
sub esp, 0x18
mov ecx, esi
call fcn.0042da30
lea ecx, [ebp - 0xf0]
call fcn.004318a0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret