Function at 0x2e01b8ad
Capabilities:
Create process on windows

Disassembly:
push 0x2d0
mov eax, 0x2e03095f
call fcn.2e02e506
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
and dword [ebp - 0x2d4], 0
or dword [ebp - 0x2c4], 0xffffffff
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2b0], eax
xor eax, eax
test edi, edi
mov dword [ebp - 0x2cc], edi
setne al
movzx ebx, ax
mov eax, dword [0x2e047aec]
mov dword [ebp - 0x2a8], ebx
mov esi, dword [eax + 0xca8]
mov ecx, esi
call dword [0x2e0332d0]
call esi
test ax, ax
je 0x2e01ba24
mov eax, dword [0x2e047aec]
mov esi, dword [eax + 0xcac]
mov ecx, esi
call dword [0x2e0332d0]
call esi
test eax, eax
je 0x2e01ba24
and dword [ebp - 0x2a8], 0
xor ebx, ebx
mov esi, dword [ebp - 0x2b0]
inc ebx
test esi, esi
je 0x2e01b996
and dword [ebp - 0x2a8], 0
cmp dword [esi + 4], 0
je 0x2e01b996
push str._blank
push dword [esi + 4]
call fcn.2e01798d
pop ecx
pop ecx
test eax, eax
je 0x2e01b990
and dword [ebp - 0x2a8], 0
push str.bogusFrame
push dword [esi + 4]
call fcn.2e01798d
pop ecx
pop ecx
test eax, eax
jne 0x2e01b996
mov dword [ebp - 0x2a8], ebx
push edi
call fcn.2e01798d
pop ecx
test eax, eax
je 0x2e01bbea
xor esi, esi
lea ecx, [ebp - 0x2c0]
push ebx
push esi
push eax
mov dword [ebp - 0x2c0], esi
mov dword [ebp - 0x2bc], esi
call fcn.2e01798d
mov eax, dword [0x2e047aec]
mov dword [ebp - 4], esi
mov esi, dword [eax + 0xcac]
mov ecx, esi
call dword [0x2e0332d0]
call esi
push dword [ebp - 0x2a8]
mov ebx, eax
mov eax, dword [0x2e049f58]
push dword [ebp - 0x2c0]
mov esi, dword [eax + 0x54]
mov ecx, esi
mov edi, dword [ebx]
call dword [0x2e0332d0]
call esi
pop ecx
mov ecx, dword [edi + 0xbc]
push eax
call dword [0x2e0332d0]
mov ecx, ebx
call dword [edi + 0xbc]
lea ecx, [ebp - 0x2c0]
call fcn.2e01798d
xor eax, eax
inc eax
jmp 0x2e01bbea
mov eax, dword [ebp - 0x2b0]
test eax, eax
je 0x2e01ba6c
cmp dword [eax + 4], 0
je 0x2e01ba6c
push str.bogusframe
push dword [eax + 4]
call sub.VCRUNTIME140.dll_strstr
pop ecx
pop ecx
test eax, eax
je 0x2e01ba6c
push edi
call fcn.2e01798d
pop ecx
test ax, ax
je 0x2e01ba1c
push 5
push 0x2e033925
push 0
push edi
push 0x2e0343fc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x2e01ba1c
test edi, edi
je 0x2e01bbe7
push 5
push str.file:
push edi
call fcn.2e01798d
mov ecx, eax
add esp, 0xc
xor eax, eax
test ecx, ecx
sete al
movzx esi, ax
mov dword [ebp - 0x2a4], esi
test ecx, ecx
jne 0x2e01baa2
and dword [ebp - 0x2ac], ecx
jmp 0x2e01bac0
push 7
push 0x2e035720
push edi
call fcn.2e01798d
add esp, 0xc
neg eax
sbb eax, eax
inc eax
movzx eax, ax
mov dword [ebp - 0x2ac], eax
push edi
call fcn.2e01b824
movzx eax, ax
mov dword [ebp - 0x2b4], eax
pop ecx
test si, si
je 0x2e01bb3c
push 0
push 0
mov esi, edi
push esi
call fcn.2e01798d
pop ecx
push eax
push esi
call fcn.2e01798d
mov edi, eax
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 0x14
cmp eax, 0xa
jbe 0x2e01bb36
push 8
push str.file:___
push esi
call fcn.2e01798d
add esp, 0xc
test eax, eax
jne 0x2e01bb36
mov al, byte [edi + 8]
cmp al, 0x61
jl 0x2e01bb18
cmp al, 0x7a
jle 0x2e01bb1e
sub al, 0x41
cmp al, 0x19
ja 0x2e01bb36
cmp byte [edi + 9], 0x7c
jne 0x2e01bb36
cmp byte [edi + 0xa], 0x2f
mov esi, dword [ebp - 0x2a4]
jne 0x2e01bb3c
mov byte [edi + 9], 0x3a
jmp 0x2e01bb3c
mov esi, dword [ebp - 0x2a4]
push edi
call fcn.2e01798d
movzx eax, ax
mov dword [ebp - 0x2b8], eax
pop ecx
test edi, edi
je 0x2e01bbe7
test si, si
je 0x2e01bb7d
push 5
push 0x2e033925
push 0
push edi
push 0x2e0343fc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov ax, cx
jmp 0x2e01bbea
cmp word [ebp - 0x2ac], 0
jne 0x2e01c137
cmp word [ebp - 0x2b4], 0
jne 0x2e01c137
cmp dword [0x2e049ee8], 0
je 0x2e01bbf0
test ax, ax
jne 0x2e01bbf0
mov eax, dword [0x2e049ed8]
test eax, eax
je 0x2e01bbbd
push edi
push eax
call fcn.2e01798d
pop ecx
pop ecx
test eax, eax
je 0x2e01bbe5
xor eax, eax
push eax
push eax
push 0x1a
push 3
pop ebx
push ebx
push 4
push eax
call fcn.2e01a859
add esp, 0x18
cmp ax, bx
jne 0x2e01bbe5
call fcn.2e004e1c
xor eax, eax
inc eax
mov word [0x2e049ee0], ax
xor ebx, ebx
mov ax, bx
call fcn.2e02e4e4
ret
xor eax, eax
push str.WWW_OpenURL
mov word [0x2e049ee0], ax
call fcn.2e01798d
movzx ebx, ax
mov dword [ebp - 0x2b4], ebx
pop ecx
push edi
test bx, bx
jne 0x2e01bc31
call fcn.2e01798d
pop ecx
test ax, ax
je 0x2e01bc22
xor ebx, ebx
inc ebx
jmp 0x2e01bbe7
push 0
call fcn.2e01798d
pop ecx
test ax, ax
jne 0x2e01bc4d
jmp 0x2e01bbe5
call fcn.2e01798d
pop ecx
cmp eax, 0xec
ja 0x2e01c128
cmp word [ebp + 0x1c], 0
jne 0x2e01c128
call fcn.2e01798d
mov ecx, eax
cmp ecx, 2
je 0x2e01bc7f
push 0
push 0
push 0x19
pop eax
push 0x1b
pop edx
test ecx, ecx
cmove eax, edx
movzx eax, ax
push eax
push 1
push 2
push 0
call fcn.2e01a859
add esp, 0x18
jmp 0x2e01bbe5
call fcn.2e01c6eb
mov eax, dword [0x2e049ed8]
test eax, eax
je 0x2e01bca1
push eax
mov eax, dword [0x2e049f48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2e0332d0]
call esi
pop ecx
push edi
call fcn.2e01798d
xor esi, esi
mov dword [0x2e049ed8], eax
mov eax, dword [0x2e049ed4]
inc esi
pop ecx
cmp eax, 3
je 0x2e01bcd3
cmp eax, 5
je 0x2e01bcd3
cmp eax, 4
je 0x2e01bcd3
cmp eax, 8
je 0x2e01bcd3
cmp eax, 9
je 0x2e01bcd3
cmp eax, 0xa
jne 0x2e01bcea
push dword [ebp - 0x2d0]
call fcn.2e01c8d0
mov eax, dword [0x2e049ed4]
pop ecx
mov dword [ebp - 0x2b8], esi
cmp word [ebp - 0x2b8], 0
jne 0x2e01bd2e
call fcn.2e01798d
push 0
mov dword [0x2e049ef0], eax
mov dword [0x2e049ef4], edx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
push 5
push eax
push 0x2e01c2d0
mov dword [ebp - 0x2d8], edx
call fcn.2e01798d
mov dword [0x2e049ee8], eax
add esp, 0x10
mov eax, dword [0x2e049ed4]
jmp 0x2e01bd35
and dword [0x2e049ee8], 0
mov ecx, dword [ebp - 0x2b0]
test ecx, ecx
je 0x2e01bef6
cmp dword [ecx + 4], 0
je 0x2e01bef6
push str.WWW_ListWindows
push 0x2e049eb4
push dword [0x2e049eb0]
call fcn.2e01798d
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x2e01beeb
mov eax, dword [ebx]
push 0
push str.ABCD
push dword [eax]
call sub.USER32.dll_DdeCreateStringHandleA
xor ecx, ecx
mov esi, eax
push ecx
push 0x2710
push 0x20b0
xor eax, eax
inc eax
push eax
push esi
push dword [ebx + 0xc]
push ecx
push ecx
call sub.USER32.dll_DdeClientTransaction
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebx]
push esi
push dword [eax]
call sub.USER32.dll_DdeFreeStringHandle
mov eax, dword [ebp - 0x2a4]
test eax, eax
je 0x2e01bed4
mov eax, dword [ebx]
push dword [eax]
call sub.USER32.dll_DdeGetLastError
push 0
push 0x102
lea eax, [ebp - 0x198]
push eax
push dword [ebp - 0x2a4]
call sub.USER32.dll_DdeGetData
mov eax, dword [ebx]
push dword [eax]
call sub.USER32.dll_DdeGetLastError
test eax, eax
jne 0x2e01bece
lea eax, [ebp - 0x198]
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x2ac], eax
test eax, eax
je 0x2e01bece
mov esi, dword [ebp - 0x2b0]
push str.WWW_GetWindowInfo
push 0x2e049eb4
push dword [0x2e049eb0]
call fcn.2e01798d
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x2e01be81
mov ecx, 0x82
lea eax, [ebp - 0x94]
push ecx
push eax
push ecx
lea eax, [ebp - 0x21c]
push eax
push ecx
lea eax, [ebp - 0x2a0]
push eax
push dword [ebp - 0x2ac]
push 0x2e03576c
push 0x2e034a24
push ebx
call fcn.2e01798d
add esp, 0x28
test eax, eax
jne 0x2e01be81
push dword [esi + 4]
lea eax, [ebp - 0x94]
push eax
call fcn.2e01798d
pop ecx
pop ecx
test eax, eax
je 0x2e01beb2
push ebx
push dword [0x2e049eb0]
call fcn.2e01798d
mov eax, dword [ebp - 0x2d8]
xor ebx, ebx
add eax, 4
mov dword [ebp - 0x2d8], eax
pop ecx
pop ecx
mov eax, dword [eax]
mov dword [ebp - 0x2ac], eax
test eax, eax
jne 0x2e01be14
jmp 0x2e01bece
mov eax, dword [ebp - 0x2ac]
push ebx
push dword [0x2e049eb0]
mov dword [ebp - 0x2c4], eax
call fcn.2e01798d
pop ecx
pop ecx
xor ebx, ebx
mov eax, dword [ebp - 0x2a4]
push eax
call sub.USER32.dll_DdeFreeDataHandle
push ebx
push dword [0x2e049eb0]
call fcn.2e01798d
pop ecx
xor esi, esi
pop ecx
inc esi
mov ebx, dword [ebp - 0x2b4]
mov eax, dword [0x2e049ed4]
cmp eax, 3
jne 0x2e01bf0b
test bx, bx
jne 0x2e01bf0b
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
push str.WWW_OpenURL
push 0x2e049eb4
push dword [0x2e049eb0]
call fcn.2e01798d
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x2e01bf77
push dword [0x2e049eb0]
call fcn.2e01798d
pop ecx
test ax, ax
jne 0x2e01bf6d
mov eax, dword [0x2e048be4]
push dword [0x2e049ee4]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x2e0332d0]
call esi
pop ecx
test ax, ax
jne 0x2e01bf6d
xor ecx, ecx
xor eax, eax
push ecx
push ecx
push 0x14
inc eax
push eax
push 2
push ecx
call fcn.2e01a859
add esp, 0x18
call fcn.2e01c286
jmp 0x2e01bbe5
mov eax, dword [0x2e049ed4]
cmp eax, 7
je 0x2e01c09a
cmp eax, 6
je 0x2e01c09a
cmp word [ebp - 0x2b8], 0
mov edx, 0x2e033925
mov eax, edx
mov ecx, str.AcroWWW
cmove eax, ecx
lea ecx, [ebp - 0x2d4]
push ecx
push eax
push eax
push edx
push dword [ebp - 0x2c8]
push 4
push dword [ebp - 0x2c4]
push edx
push edi
push 0x2e035778
push str.ssllssss
push ebx
call fcn.2e01798d
xor edi, edi
add esp, 0x30
sub eax, edi
je 0x2e01c069
sub eax, 1
je 0x2e01c02e
sub eax, 1
jne 0x2e01c0f6
push dword [0x2e049eb0]
call fcn.2e01798d
pop ecx
test ax, ax
jne 0x2e01c0d4
mov eax, dword [0x2e048be4]
push dword [0x2e049ee4]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x2e0332d0]
call esi
pop ecx
test ax, ax
jne 0x2e01c0d4
push edi
push edi
xor eax, eax
push 0x14
inc eax
push eax
jmp 0x2e01c0c9
push ebx
push dword [0x2e049eb0]
call fcn.2e01798d
push esi
push dword [ebp - 0x2b0]
push dword [ebp - 0x2c8]
push dword [ebp - 0x2cc]
push dword [ebp - 0x2bc]
push dword [ebp - 0x2d0]
call fcn.2e01b8ad
add esp, 0x20
movzx ebx, ax
jmp 0x2e01c0fc
push ebx
push dword [0x2e049eb0]
call fcn.2e01798d
cmp dword [0x2e049ed4], 2
pop ecx
pop ecx
jne 0x2e01c0f6
cmp dword [ebp - 0x2d4], edi
jge 0x2e01c0f6
push edi
push edi
push 0x47
push esi
push 2
push edi
call fcn.2e01a859
add esp, 0x18
jmp 0x2e01c0f6
push edi
call fcn.2e01798d
inc eax
push eax
push edi
push ebx
call fcn.2e01798d
add esp, 0x10
test ax, ax
jne 0x2e01c0e6
push dword [0x2e049eb0]
call fcn.2e01798d
xor edi, edi
pop ecx
test ax, ax
jne 0x2e01c0d4
push edi
push edi
push 0x14
push esi
push 2
push edi
call fcn.2e01a859
add esp, 0x18
push ebx
push dword [0x2e049eb0]
call fcn.2e01798d
pop ecx
pop ecx
mov ebx, edi
jmp 0x2e01c0fc
push ebx
push dword [0x2e049eb0]
call fcn.2e01798d
pop ecx
pop ecx
xor edi, edi
mov ebx, dword [ebp - 0x2a8]
mov eax, dword [0x2e049ed8]
test eax, eax
je 0x2e01bbe7
push eax
mov eax, dword [0x2e049f48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2e0332d0]
call esi
pop ecx
mov dword [0x2e049ed8], edi
jmp 0x2e01bbe7
push edi
call fcn.2e01798d
pop ecx
movzx ebx, ax
jmp 0x2e01bbe7
push 5
push 0x2e033925
xor eax, eax
push eax
push edi
push eax
push eax
jmp 0x2e01bb6a