Function at 0x11d44150
Capabilities:
Create process on windows
Print debug messages
Query environment variable
Resume thread
Set environment variable

Disassembly:
push 0xffffffffffffffff
push 0x11fa8908
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebp
push esi
mov esi, dword [esp + 0x80]
mov dword [esp + 0x10], ecx
test esi, esi
je 0x11d444e9
mov ebp, dword [esp + 0x84]
test ebp, ebp
je 0x11d444e9
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x11d444e9
push 2
lea ecx, [esp + 0x24]
call fcn.11e15fa0
push 0x12119948
lea ecx, [esp + 0x84]
mov dword [esp + 0x7c], 0
call fcn.11e7eae0
mov byte [esp + 0x78], 1
call fcn.11e93550
test eax, eax
jne 0x11d441f0
push str.shimgvw.dll
push ebp
call fcn.11e68668
add esp, 8
test eax, eax
je 0x11d441f0
push esi
push ebp
lea eax, [esp + 0x88]
push str._rundll32.exe___s_ImageView_Fullscreen__s
push eax
jmp 0x11d4422b
call fcn.11e93550
test eax, eax
je 0x11d4421c
push 0x12081acc
push ebp
call fcn.11e68668
add esp, 8
test eax, eax
je 0x11d4421c
push esi
push ebp
lea ecx, [esp + 0x88]
push str._rundll32.exe____s__ImageView_Fullscreen__s
push ecx
jmp 0x11d4422b
push esi
push ebp
lea edx, [esp + 0x88]
push str.__s____s_
push edx
call fcn.11e82200
add esp, 0x10
mov ecx, 0x11
xor eax, eax
push ebx
push edi
lea edi, [esp + 0x34]
push ebp
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x38], 0x44
push eax
call fcn.11dbdf30
add esp, 8
push 0x12119948
lea ecx, [esp + 0x18]
mov byte [esp + 0x84], 2
call fcn.11e7eae0
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x80], 3
mov eax, dword [ecx - 8]
test eax, eax
je 0x11d4430b
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0
push 0
push str.path
call ebx
test eax, eax
je 0x11d442fb
lea ebp, [eax + 1]
lea edi, [ebp + ebp]
push edi
call fcn.11e679bc
mov ecx, edi
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
push esi
rep stosb byte es:[edi], al
push str.path
call ebx
push 0x12023db8
lea ecx, [esp + 0x14]
call fcn.11e7fed0
push esi
lea ecx, [esp + 0x14]
call fcn.11e7fed0
push esi
lea ecx, [esp + 0x18]
call fcn.11e7f500
push esi
call fcn.11e679b1
mov ebp, dword [esp + 0x90]
add esp, 4
mov eax, dword [esp + 0x10]
push eax
push str.path
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [esp + 0x88]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push ecx
call esi
mov ebx, dword [esp + 0x94]
lea edx, [esp + 0x34]
push ebx
push edx
push 0
push 0
push 0x4000414
push 0
push 0
push 0
push 0x400
lea ecx, [esp + 0xac]
call fcn.11e7ff50
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
push 0xffffffffffffffff
lea ecx, [esp + 0x8c]
mov dword [esp + 0x20], edi
call fcn.11e80020
test edi, edi
je 0x11d44454
push 0x12081a58
call esi
mov eax, dword [esp + 0x90]
test eax, eax
je 0x11d443c9
push 0x12081a50
call esi
mov eax, dword [ebx + 8]
lea edi, [ebx + 8]
push 0
push 0
push 1
push eax
call fcn.11dc4fa0
add esp, 0x10
lea ecx, [esp + 0x20]
call fcn.11e24e50
push 1
push edi
lea ecx, [esp + 0x28]
mov byte [esp + 0x88], 4
call fcn.11e25ee0
lea ecx, [esp + 0x20]
mov byte [esp + 0x80], 3
call fcn.11e24e80
lea ecx, [esp + 0x94]
xor eax, eax
push ecx
lea edx, [esp + 0x90]
push eax
push edx
push ebp
mov ecx, 0x1212b5c0
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa4], eax
call fcn.11d6fd70
push 0x12081a48
mov edi, eax
call esi
test edi, edi
jne 0x11d4440d
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x11d44418
mov ecx, dword [esp + 0x18]
push edi
push ebx
call fcn.11d44500
push 0x12081a40
call esi
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x12081a38
call esi
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
test eax, eax
je 0x11d44486
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x11d44486
push eax
push str.path
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x11d44486
push 0x12081a30
call esi
mov eax, dword [0x12133f80]
test eax, eax
je 0x11d44486
mov edx, dword [esp + 0x88]
mov eax, dword [0x12126854]
push edx
push eax
push str.__s__CSafeInject::OnIExecuteCommandExecuteReadOnly_CreateProcessW__s_Failed__n
push str.SafeInject
push 4
call fcn.11ca5810
add esp, 0x14
lea ecx, [esp + 0x14]
mov byte [esp + 0x80], 2
call fcn.11e7f280
lea ecx, [esp + 0x10]
mov byte [esp + 0x80], 1
call fcn.11e7f280
lea ecx, [esp + 0x88]
mov byte [esp + 0x80], 0
call fcn.11e7f280
lea ecx, [esp + 0x28]
mov dword [esp + 0x80], 0xffffffff
call fcn.11e15fd0
mov eax, dword [esp + 0x1c]
pop edi
pop ebx
pop esi
pop ebp
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
add esp, 0x74
ret 0x10
mov ecx, dword [esp + 0x70]
pop esi
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x74
ret 0x10