Function at 0x409040
Capabilities:
Create process on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x469f57
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov ebp, 1
lea ecx, [esp + 0x84]
mov dword [esp + 0x78], ebp
call fcn.004598d1
push 0x48edd8
lea ecx, [esp + 0x1c]
call fcn.0045b618
push 0x48edd8
lea ecx, [esp + 0x14]
mov byte [esp + 0x7c], 2
call fcn.0045b618
push 0x48edd8
lea ecx, [esp + 0x18]
mov byte [esp + 0x7c], 3
call fcn.0045b618
push 0x20
lea ecx, [esp + 0x88]
mov byte [esp + 0x7c], 4
call fcn.0045bacb
test eax, eax
jle 0x40924c
mov al, byte [0x48ee1c]
test al, 1
jne 0x409116
mov bl, al
push str..exe
or bl, 1
mov ecx, 0x48ee10
mov byte [0x48ee1c], bl
call fcn.0045b618
push str..com
mov ecx, 0x48ee14
call fcn.0045b618
push str..bat
mov ecx, 0x48ee18
call fcn.0045b618
push 0x4096e0
call fcn.0043e2d4
add esp, 4
mov eax, dword [esp + 0x84]
mov dword [esp + 0x20], 0
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x409237
mov esi, 0x48ee10
mov ecx, dword [esi]
push 0x4887dc
lea edx, [esp + 0x2c]
push esi
mov edi, dword [ecx - 8]
push edx
call fcn.0045b83f
mov ebp, dword [eax]
mov ecx, dword [esp + 0x20]
lea eax, [edi + 1]
lea edx, [esp + 0x24]
push eax
push ecx
push edx
lea ecx, [esp + 0x90]
mov byte [esp + 0x84], 5
call fcn.00459339
mov eax, dword [eax]
push ebp
push eax
call fcn.0043e755
add esp, 8
lea ecx, [esp + 0x24]
test eax, eax
sete bl
call fcn.0045b5aa
lea ecx, [esp + 0x28]
mov byte [esp + 0x78], 4
call fcn.0045b5aa
test bl, bl
jne 0x4091a7
add esi, 4
cmp esi, 0x48ee1c
jl 0x409135
jmp 0x40920c
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x2c]
add edi, eax
push edi
push ecx
lea ecx, [esp + 0x8c]
call fcn.0045944b
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x7c], 6
call fcn.0045b6e3
lea ecx, [esp + 0x2c]
mov byte [esp + 0x78], 4
call fcn.0045b5aa
inc edi
lea edx, [esp + 0x30]
push edi
push edx
lea ecx, [esp + 0x8c]
call fcn.00459316
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x7c], 7
call fcn.0045b6e3
lea ecx, [esp + 0x30]
mov byte [esp + 0x78], 4
call fcn.0045b5aa
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x409232
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0x20]
inc eax
mov edx, dword [ecx - 8]
mov dword [esp + 0x20], eax
cmp eax, edx
jl 0x409130
mov ebp, 1
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 8]
test eax, eax
jne 0x40925d
lea eax, [esp + 0x84]
push eax
jmp 0x409254
lea ecx, [esp + 0x84]
push ecx
lea ecx, [esp + 0x14]
call fcn.0045b6e3
push 0x5c
lea ecx, [esp + 0x14]
call fcn.004594c3
test eax, eax
jl 0x4092c9
lea esi, [eax + 1]
lea edx, [esp + 0x30]
push esi
push edx
lea ecx, [esp + 0x18]
call fcn.0045944b
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x7c], 8
call fcn.0045b6e3
lea ecx, [esp + 0x30]
mov byte [esp + 0x78], 4
call fcn.0045b5aa
lea eax, [esp + 0x30]
push esi
push eax
lea ecx, [esp + 0x18]
call fcn.00459316
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x7c], 9
call fcn.0045b6e3
lea ecx, [esp + 0x30]
mov byte [esp + 0x78], 4
call fcn.0045b5aa
jmp 0x4092d7
push 0x48edd8
lea ecx, [esp + 0x18]
call fcn.0045b733
lea ecx, [esp + 0x30]
push 4
push ecx
lea ecx, [esp + 0x18]
mov esi, ebp
call fcn.004593cf
mov eax, dword [eax]
push str..reg
push eax
call fcn.0043e755
add esp, 8
lea ecx, [esp + 0x30]
test eax, eax
sete bl
call fcn.0045b5aa
test bl, bl
je 0x409385
lea edx, [esp + 0x14]
lea eax, [esp + 0x2c]
push edx
push 0x488ae0
push eax
xor esi, esi
call fcn.0045b8b3
lea ecx, [esp + 0x10]
lea edx, [esp + 0x30]
push ecx
mov bl, 0xa
push eax
push edx
mov byte [esp + 0x84], bl
call fcn.0045b7d9
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x7c], 0xb
call fcn.0045b6e3
lea ecx, [esp + 0x30]
mov byte [esp + 0x78], bl
call fcn.0045b5aa
lea ecx, [esp + 0x2c]
mov byte [esp + 0x78], 4
call fcn.0045b5aa
push 0x48edd8
lea ecx, [esp + 0x18]
call fcn.0045b733
push str.regedit.exe
lea ecx, [esp + 0x14]
call fcn.0045b733
jmp 0x4094d4
lea eax, [esp + 0x2c]
push 4
push eax
lea ecx, [esp + 0x18]
call fcn.004593cf
mov eax, dword [eax]
push str..ocx
push eax
mov byte [esp + 0x80], 0xc
call fcn.0043e755
add esp, 8
test eax, eax
je 0x4093e3
lea ecx, [esp + 0x30]
push 4
push ecx
lea ecx, [esp + 0x18]
call fcn.004593cf
mov eax, dword [eax]
push str..dll
push eax
call fcn.0043e755
add esp, 8
lea ecx, [esp + 0x30]
test eax, eax
sete bl
call fcn.0045b5aa
test bl, bl
je 0x4093e5
mov bl, 1
lea ecx, [esp + 0x2c]
mov byte [esp + 0x78], 4
call fcn.0045b5aa
test bl, bl
je 0x4094d4
lea edx, [esp + 0x14]
lea eax, [esp + 0x30]
push edx
push str._u__s
push eax
xor esi, esi
call fcn.0045b8b3
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
push eax
push edx
mov byte [esp + 0x84], 0xd
call fcn.0045b7d9
lea ecx, [esp + 0x30]
mov byte [esp + 0x78], 0xf
call fcn.0045b5aa
mov eax, dword [esp + 0x20]
push esi
push 0x48edd8
push eax
push str.regsvr32.exe
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x28]
push ecx
push 0x488ae0
push edx
call fcn.0045b8b3
lea ecx, [esp + 0x10]
lea edx, [esp + 0x2c]
push ecx
mov bl, 0x10
push eax
push edx
mov byte [esp + 0x84], bl
call fcn.0045b7d9
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x7c], 0x11
call fcn.0045b6e3
lea ecx, [esp + 0x2c]
mov byte [esp + 0x78], bl
call fcn.0045b5aa
lea ecx, [esp + 0x28]
mov byte [esp + 0x78], 0xf
call fcn.0045b5aa
push 0x48edd8
lea ecx, [esp + 0x18]
call fcn.0045b733
push str.regsvr32.exe
lea ecx, [esp + 0x14]
call fcn.0045b733
lea ecx, [esp + 0x20]
mov byte [esp + 0x78], 4
call fcn.0045b5aa
mov edx, dword [esp + 0x18]
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x44], str.open
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x54], esi
mov dword [esp + 0x3c], 0x440
mov dword [esp + 0x38], 0x3c
mov dword [esp + 0x40], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x4095ab
mov ecx, dword [esp + 0x88]
test ecx, ecx
je 0x4095ab
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x488a98
mov esi, dword [esp + 0x84]
mov ecx, esi
call fcn.0045b618
mov dword [esp + 0x1c], ebp
lea ecx, [esp + 0x14]
mov byte [esp + 0x78], 3
call fcn.0045b5aa
lea ecx, [esp + 0x10]
mov byte [esp + 0x78], 2
call fcn.0045b5aa
lea ecx, [esp + 0x18]
mov byte [esp + 0x78], 1
call fcn.0045b5aa
lea ecx, [esp + 0x84]
mov byte [esp + 0x78], 0
call fcn.0045b5aa
mov ecx, dword [esp + 0x70]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x6c
ret
cmp dword [esp + 0x54], 0x20
ja case.0x40962c.1159
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
ja 0x409616
je 0x40960c
add eax, 0xfffffffe
cmp eax, 6
ja case.0x40962c.1159
jmp dword [eax*4 + 0x40965c]
mov esi, dword [esp + 0x80]
push 0x488a88
mov ecx, esi
call fcn.0045b618
mov dword [esp + 0x1c], ebp
jmp 0x40955b
push 0x488a78
jmp 0x409549
push 0x488a64
jmp 0x409549
push 0x488a48
jmp 0x409549
push 0x488a38
jmp 0x409549
add eax, 0xfffffb7d
cmp eax, 0x44
ja case.0x40962c.1159
xor ecx, ecx
mov cl, byte [eax + 0x40968c]
jmp dword [ecx*4 + 0x409678]
push 0x488a1c
jmp 0x409549
push 0x4889f8
jmp 0x409549
push 0x4889d4
jmp 0x409549
push 0x48898c
jmp 0x409549