Function at 0x41dcc7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1214
call fcn.00423470
mov eax, dword [0x465c14]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x120c], ecx
cmp ecx, 0x63
ja 0x41e34c
imul eax, ecx, 0xc10
push ebx
push esi
lea esi, [eax + 0x469ea0]
mov ebx, esi
lea edx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x41dd06
sub ebx, edx
test ebx, ebx
jle 0x41e345
imul eax, ecx, 0xc10
mov eax, dword [eax + 0x469a90]
cmp eax, 0x65
jne 0x41dd7c
push esi
lea eax, [ebp - 0xa04]
push str.Dyn_Open_URL:__.470s_n
push eax
call fcn.004026f3
xor ebx, ebx
lea eax, [ebp - 0xa08]
inc ebx
push eax
mov dword [ebp - 0xa08], ebx
call fcn.0040c3b6
imul eax, dword [ebp - 0x120c], 0xc10
add esp, 0x10
push ebx
push edi
push edi
add eax, 0x469ea0
push eax
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ebx, ebx
pop esi
mov eax, ebx
pop ebx
jmp 0x41e34f
cmp eax, 0x66
je 0x41e05e
cmp eax, 0x67
je 0x41e05e
cmp eax, 0x68
jne 0x41dda4
push eax
push str.Dyn_ExecFile_As_Sys__
push esi
call fcn.0041f0d1
add esp, 0xc
jmp 0x41dd71
cmp eax, 0x69
jne 0x41ddb1
push eax
push str.Dyn_ExecFile_As_User__
jmp 0x41dd99
cmp eax, 0x6a
jne 0x41ddc8
push 4
lea eax, [ebp - 0x120c]
push eax
push 0xa
call fcn.0041573c
jmp 0x41dd9f
cmp eax, 0x6b
je 0x41df10
cmp eax, 0x6c
je 0x41df10
push 0x6d
pop ebx
cmp eax, ebx
je 0x41ddeb
cmp eax, 0x6e
je 0x41ddeb
push 0xfffffffffffffffd
pop ebx
jmp 0x41dd73
call fcn.00410716
test eax, eax
je 0x41dd71
imul ecx, dword [ebp - 0x120c], 0xc10
mov edi, 0x469ea0
add ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41de0c
sub ecx, edx
lea eax, [ecx + 0x50]
push eax
call fcn.0042a45f
mov esi, eax
imul eax, dword [ebp - 0x120c], 0xc10
pop ecx
test esi, esi
je 0x41de48
add eax, edi
push eax
push str.__SYSTEMROOT___sysnativecmd.exe__C__s
push esi
call fcn.004026f3
mov eax, dword [ebp - 0x120c]
add esp, 0xc
jmp 0x41dec2
cmp dword [eax + 0x469a90], ebx
mov eax, str.ERROR:_Dyn_ExecShellCmd_As_Sys_64
je 0x41de5a
mov eax, str.ERROR:_Dyn_ExecShellCmd_As_User_64
push eax
lea eax, [ebp - 0xa04]
push eax
call fcn.004026f3
pop ecx
pop ecx
lea ecx, [ebp - 0xa04]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41de72
imul eax, dword [ebp - 0x120c], 0xc10
sub ecx, edx
add eax, edi
push eax
lea eax, [ebp - 0xa04]
add eax, ecx
push str.:_memory_allocation_failure_formatting_cmd.exe_to_run__.400s_n
push eax
call fcn.004026f3
lea eax, [ebp - 0xa08]
mov dword [ebp - 0xa08], 1
push eax
call fcn.0040c3b6
mov eax, dword [ebp - 0x120c]
add esp, 0x10
imul esi, eax, 0xc10
add esi, edi
imul eax, eax, 0xc10
mov ecx, str.Dyn_ExecShellCmd_As_Sys_64__
mov edx, dword [eax + 0x469a90]
cmp edx, ebx
je 0x41dedc
mov ecx, str.Dyn_ExecShellCmd_As_User_64__
xor eax, eax
cmp edx, ebx
setne al
add eax, ebx
push eax
push ecx
push esi
call fcn.0041f0d1
add esp, 0xc
imul eax, dword [ebp - 0x120c], 0xc10
add eax, edi
cmp esi, eax
je 0x41dd71
push esi
call fcn.0042a45a
pop ecx
jmp 0x41dd71
push 0x800
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.00427a90
push 0x7c
push esi
call fcn.00425dc0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x41dffa
imul ecx, dword [ebp - 0x120c], 0xc10
sub eax, ecx
sub eax, 0x469a90
sub eax, 0x410
push eax
lea eax, [ecx + 0x469ea0]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.004283f0
lea eax, [esi + 1]
push 0x7c
push eax
call fcn.00425dc0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x41e01c
inc esi
push 0x7c
push esi
call fcn.00425dc0
mov edx, eax
pop ecx
pop ecx
test edx, edx
je 0x41e01c
lea edi, [ebp - 0x804]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41df95
mov ax, word [0x44ee00]
xor ebx, ebx
mov word [edi], ax
imul eax, dword [ebp - 0x120c], 0xc10
cmp dword [eax + 0x469a98], ebx
jne 0x41dfcf
sub edx, esi
lea eax, [ebp - 0x804]
push edx
push esi
push eax
call fcn.00433750
add esp, 0xc
jmp 0x41e01e
inc edx
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x41dfd2
lea edi, [ebp - 0x804]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41dfe2
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41e01e
imul eax, dword [ebp - 0x120c], 0xc10
lea edx, [ebp - 0x804]
lea ecx, [eax + 0x469ea0]
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x41e012
xor ebx, ebx
imul eax, dword [ebp - 0x120c], 0xc10
mov ecx, str.Dyn_ExecFile_As_Sys__
mov edx, dword [eax + 0x469a90]
cmp edx, 0x6b
je 0x41e03d
mov ecx, str.Dyn_ExecFile_As_User__
xor eax, eax
cmp edx, 0x6b
setne al
add eax, 0x68
push eax
push ecx
lea eax, [ebp - 0x804]
push eax
call fcn.0041f0d1
add esp, 0xc
jmp 0x41dd73
call fcn.0041009a
mov dword [ebp - 0x1214], eax
cmp eax, 7
je 0x41e183
cmp eax, 6
je 0x41e183
cmp eax, 5
je 0x41e183
cmp eax, 4
je 0x41e183
imul ecx, dword [ebp - 0x120c], 0xc10
mov edi, 0x469ea0
add ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41e0a1
sub ecx, edx
lea eax, [ecx + 0x50]
push eax
call fcn.0042a45f
mov esi, eax
imul eax, dword [ebp - 0x120c], 0xc10
pop ecx
test esi, esi
je 0x41e0dd
add eax, edi
push eax
push str.__SYSTEMROOT___system32cmd.exe__C__s
push esi
call fcn.004026f3
mov eax, dword [ebp - 0x120c]
add esp, 0xc
jmp 0x41e158
cmp dword [eax + 0x469a90], 0x66
mov eax, str.ERROR:_Dyn_ExecShellCmd_As_Sys
je 0x41e0f0
mov eax, str.ERROR:_Dyn_ExecShellCmd_As_User
push eax
lea eax, [ebp - 0xa04]
push eax
call fcn.004026f3
pop ecx
pop ecx
lea ecx, [ebp - 0xa04]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41e108
imul eax, dword [ebp - 0x120c], 0xc10
sub ecx, edx
add eax, edi
push eax
lea eax, [ebp - 0xa04]
add eax, ecx
push str.:_memory_allocation_failure_formatting_cmd.exe_to_run__.400s_n
push eax
call fcn.004026f3
lea eax, [ebp - 0xa08]
mov dword [ebp - 0xa08], 1
push eax
call fcn.0040c3b6
mov eax, dword [ebp - 0x120c]
add esp, 0x10
imul esi, eax, 0xc10
add esi, edi
imul eax, eax, 0xc10
mov ecx, str.Dyn_ExecShellCmd_As_Sys__
mov edx, dword [eax + 0x469a90]
cmp edx, 0x66
je 0x41e173
mov ecx, str.Dyn_ExecShellCmd_As_User__
xor eax, eax
cmp edx, 0x66
setne al
add eax, 0x66
jmp 0x41dee5
imul eax, dword [ebp - 0x120c], 0xc10
mov esi, edi
mov dword [ebp - 0x1210], edi
mov edi, 0x469ea0
push 0x22
add eax, edi
push eax
call fcn.00425dc0
pop ecx
pop ecx
test eax, eax
je 0x41e1c0
inc esi
inc eax
push 0x22
push eax
call fcn.00425dc0
pop ecx
pop ecx
test eax, eax
jne 0x41e1aa
mov dword [ebp - 0x1210], esi
imul esi, dword [ebp - 0x120c], 0xc10
add esi, edi
cmp dword [ebp - 0x1210], 3
jle 0x41e2ab
push dword [ebp - 0x1214]
call fcn.004106fa
pop ecx
test eax, eax
jne 0x41e2ab
imul ecx, dword [ebp - 0x120c], 0xc10
add ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41e1fc
sub ecx, edx
lea ebx, [ecx + 0x50]
push ebx
call fcn.0042a45f
mov esi, eax
imul eax, dword [ebp - 0x120c], 0xc10
pop ecx
test esi, esi
je 0x41e232
add eax, edi
push eax
push str.__s_
push esi
call fcn.004026f3
add esp, 0xc
jmp 0x41e2ab
cmp dword [eax + 0x469a90], 0x66
mov eax, str.ERROR:_Dyn_ExecShellCmd_As_Sys
je 0x41e245
mov eax, str.ERROR:_Dyn_ExecShellCmd_As_User
push eax
lea eax, [ebp - 0xa04]
push eax
call fcn.004026f3
pop ecx
pop ecx
lea ecx, [ebp - 0xa04]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41e25d
imul eax, dword [ebp - 0x120c], 0xc10
sub ecx, edx
add eax, edi
push eax
lea eax, [ebp - 0xa04]
add eax, ecx
push str.:_memory_allocation_failure_while_processing__.400s_n
push eax
call fcn.004026f3
lea eax, [ebp - 0xa08]
mov dword [ebp - 0xa08], 1
push eax
call fcn.0040c3b6
imul esi, dword [ebp - 0x120c], 0xc10
add esp, 0x10
add esi, edi
imul eax, dword [ebp - 0x120c], 0xc10
push esi
cmp dword [eax + 0x469a90], 0x66
lea eax, [ebp - 0xa04]
jne 0x41e315
push str.Dyn_ExecShellCmd_As_Sys:__.470s_n
push eax
call fcn.004026f3
lea eax, [ebp - 0xa08]
mov dword [ebp - 0xa08], 1
push eax
call fcn.0040c3b6
lea edx, [ebp - 0x1208]
add esp, 0x10
mov ecx, esi
sub edx, esi
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x41e2f3
push 0x800
lea eax, [ebp - 0x1208]
push eax
push 5
call fcn.0041573c
jmp 0x41deed
push str.Dyn_ExecShellCmd_As_User:__.470s_n
push eax
call fcn.004026f3
lea eax, [ebp - 0xa08]
mov dword [ebp - 0xa08], 1
push eax
call fcn.0040c3b6
push ebx
push esi
call fcn.0040f5bf
add esp, 0x18
jmp 0x41def0
push 0xfffffffffffffffe
jmp 0x41dde8
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0042345f
leave
ret