Function at 0xe9d2f0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0xf2a760
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0xf916ec]
xor eax, esp
mov dword [esp + 0x7c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0xf916ec]
xor eax, esp
push eax
lea eax, [esp + 0x94]
mov dword fs:[0], eax
xor ebp, ebp
mov esi, edx
cmp ecx, ebp
je 0xe9d3c5
mov eax, dword [ecx]
mov edx, dword [eax + 0x60]
call edx
mov ebx, 0xf
mov edi, eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebp
mov byte [esp + 0x20], 0
mov dword [esp + 0x9c], ebp
call fcn.00e044f0
mov edi, dword [edi]
test al, al
jne 0xe9d3cc
test byte [edi], 0x20
jne 0xe9d36a
xor al, al
je 0xe9d37c
test byte [edi + 4], 0x20
jne 0xe9d427
xor cl, cl
jne 0xe9d427
push esi
push str.No_permission_to_open_a_local_file:__s
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], 2
mov dword [esp + 0x20], str.p:p_agentshpam2.eem_recipes201152726_base_branchesinputtools_win_release_branchgoogleclientimegoopy_third_partygoogle_gadgets_for_linuxggadgetwin32utilities.cc
mov dword [esp + 0x24], 0x2f
call fcn.00e01eb0
add esp, 8
mov dword [esp + 0x9c], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0xe9d3c5
mov edx, dword [esp + 0x20]
push edx
call fcn.00eb8a36
add esp, 4
xor al, al
jmp 0xe9d590
mov eax, dword [edi]
test al, 0x28
je 0xe9d3d8
test byte [edi + 4], 0x28
jne 0xe9d427
push str.No_permission_to_open_URL_n
lea esi, [esp + 0x18]
mov dword [esp + 0x18], 2
mov dword [esp + 0x1c], str.p:p_agentshpam2.eem_recipes201152726_base_branchesinputtools_win_release_branchgoogleclientimegoopy_third_partygoogle_gadgets_for_linuxggadgetwin32utilities.cc
mov dword [esp + 0x20], 0x34
call fcn.00e01eb0
add esp, 4
mov dword [esp + 0x9c], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0xe9d3c5
mov eax, dword [esp + 0x20]
push eax
call fcn.00eb8a36
add esp, 4
xor al, al
jmp 0xe9d590
call fcn.00e04570
mov ebp, 0x10
test al, al
je 0xe9d4bd
add esi, 7
push esi
lea ecx, [esp + 0x78]
call fcn.00d76550
lea ecx, [esp + 0x58]
push ecx
lea ecx, [esp + 0x78]
mov byte [esp + 0xa0], 1
call fcn.00e04310
add esp, 4
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xa0], 2
call fcn.00d77740
mov byte [esp + 0x9c], 1
cmp dword [esp + 0x6c], ebp
jb 0xe9d48c
mov edx, dword [esp + 0x58]
push edx
call fcn.00eb8a36
add esp, 4
mov byte [esp + 0x9c], 0
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x68], 0
mov byte [esp + 0x58], 0
cmp dword [esp + 0x88], ebp
jb 0xe9d4d6
mov eax, dword [esp + 0x74]
push eax
call fcn.00eb8a36
add esp, 4
jmp 0xe9d4d6
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xe9d4c2
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x28]
call fcn.00d78800
mov edi, 7
xor ecx, ecx
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], cx
mov byte [esp + 0x9c], 3
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x34], ebp
jae 0xe9d504
lea ecx, [esp + 0x20]
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x3c]
push edx
call fcn.00de47c0
mov eax, dword [esp + 0x40]
mov esi, 8
add esp, 4
cmp dword [esp + 0x50], esi
jae 0xe9d528
lea eax, [esp + 0x3c]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta bl
mov byte [esp + 0x9c], 0
cmp dword [esp + 0x50], esi
jb 0xe9d55d
mov eax, dword [esp + 0x3c]
push eax
call fcn.00eb8a36
add esp, 4
xor ecx, ecx
mov dword [esp + 0x9c], 0xffffffff
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], cx
cmp dword [esp + 0x34], ebp
jb 0xe9d58e
mov edx, dword [esp + 0x20]
push edx
call fcn.00eb8a36
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7c]
xor ecx, esp
call fcn.00eb8a41
add esp, 0x8c
ret