Function at 0x436916
Capabilities:
Create process on windows

Disassembly:
push 0x1cc
mov eax, 0x50a78a
call fcn.005060cc
mov ax, word [ebp + 0xc]
mov ecx, 0x81f3
cmp ax, cx
jne 0x43697c
push 0x21
pop edx
lea ecx, [ebp - 0x1d4]
call fcn.004237db
push 1
xor ebx, ebx
push ebx
push ebx
push dword [eax]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, dword [ebp - 0x1d4]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x436d86
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x436d86
xor ebx, ebx
mov dword [ebp - 0x1cc], 0x81b2
mov ecx, 0x5545ac
mov dword [ebp - 0x1c8], str.msinfo32
mov dword [ebp - 0x1c4], ebx
mov dword [ebp - 0x1c0], 0x81b0
mov dword [ebp - 0x1bc], str.eventvwr.msc
mov dword [ebp - 0x1b8], ebx
mov dword [ebp - 0x1b4], 0x81b1
mov dword [ebp - 0x1b0], str.perfmon.msc
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x1a8], 0x81b3
mov dword [ebp - 0x1a4], str.ciadv.msc
mov dword [ebp - 0x1a0], ebx
mov dword [ebp - 0x19c], 0x81b4
mov dword [ebp - 0x198], str.compmgmt.msc
mov dword [ebp - 0x194], ebx
mov dword [ebp - 0x190], 0x81b5
mov dword [ebp - 0x18c], str.devmgmt.msc
mov dword [ebp - 0x188], ebx
mov dword [ebp - 0x184], 0x81b6
mov dword [ebp - 0x180], str.dfrg.msc
mov dword [ebp - 0x17c], ebx
mov dword [ebp - 0x178], 0x81b7
mov dword [ebp - 0x174], str.diskmgmt.msc
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x16c], 0x81b8
mov dword [ebp - 0x168], str.gpedit.msc
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x160], 0x81b9
mov dword [ebp - 0x15c], str.lusrmgr.msc
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x154], 0x81ba
mov dword [ebp - 0x150], str.ntmsmgr.msc
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], 0x81bc
mov dword [ebp - 0x144], str.secpol.msc
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], 0x81bd
mov dword [ebp - 0x138], str.services.msc
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], 0x81be
mov dword [ebp - 0x12c], str.wmimgmt.msc
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], 0x81bf
mov dword [ebp - 0x120], str.certmgr.msc
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], 0x81c0
mov dword [ebp - 0x114], str.fsmgmt.msc
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], 0x81c1
mov dword [ebp - 0x108], str.taskmgr
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0x100], 0x81ce
mov dword [ebp - 0xfc], str.regedit
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xf4], 0x81d0
mov dword [ebp - 0xf0], str.msconfig
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe8], 0x81cf
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xe0], str.shell32.dll_Control_RunDLL_sysdm.cpl
mov dword [ebp - 0xdc], 0x81d1
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0xd4], str.shell32.dll_Control_RunDLL_desk.cpl
mov dword [ebp - 0xd0], 0x81d2
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0xc8], str.shell32.dll_Control_RunDLL_firewall.cpl
mov dword [ebp - 0xc4], 0x81d3
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0xbc], str.shell32.dll_Control_RunDLL_inetcpl.cpl
mov dword [ebp - 0xb8], 0x81d4
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 0xb0], str.shell32.dll_Control_RunDLL_intl.cpl
mov dword [ebp - 0xac], 0x81d5
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xa4], str.shell32.dll_Control_RunDLL_main.cpl
mov dword [ebp - 0xa0], 0x81d6
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], str.shell32.dll_Control_RunDLL_mmsys.cpl
mov dword [ebp - 0x94], 0x81d7
mov dword [ebp - 0x90], ecx
mov esi, ebx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x60], ecx
mov ecx, str.control
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x1cc]
mov dword [ebp - 0x8c], str.shell32.dll_Control_RunDLL_ncpa.cpl
mov dword [ebp - 0x88], 0x81d8
mov dword [ebp - 0x80], str.shell32.dll_Control_RunDLL_nusrmgr.cpl
mov dword [ebp - 0x7c], 0x81d9
mov dword [ebp - 0x74], str.shell32.dll_Control_RunDLL_powercfg.cpl
mov dword [ebp - 0x70], 0x81dc
mov dword [ebp - 0x68], str.shell32.dll_Control_RunDLL_wscui.cpl
mov dword [ebp - 0x64], 0x81dd
mov dword [ebp - 0x5c], str.shell32.dll_Control_RunDLL_wuaucpl.cpl
mov dword [ebp - 0x58], 0x81e2
mov dword [ebp - 0x50], str.folders
mov dword [ebp - 0x4c], 0x81e3
mov dword [ebp - 0x44], str.printers
mov dword [ebp - 0x40], 0x81e4
mov dword [ebp - 0x38], str.keyboard
mov dword [ebp - 0x34], 0x81e5
mov dword [ebp - 0x2c], str.schedtasks
mov dword [ebp - 0x28], 0x81ec
mov dword [ebp - 0x24], str.chkdsk.exe
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 0x81ed
mov dword [ebp - 0x18], str.cleanmgr.exe
mov dword [ebp - 0x14], ebx
movzx edx, ax
cmp edx, dword [ecx]
je 0x436d10
inc esi
add ecx, 0xc
cmp esi, 0x25
jb 0x436d01
jmp 0x436d86
mov ecx, 0x81c1
mov edi, ebx
cmp ax, cx
jne 0x436d31
call fcn.004be604
test eax, eax
je 0x436d31
xor edi, edi
inc edi
call fcn.004be71b
test eax, eax
je 0x436d81
lea ecx, [ebp - 0x1cd]
call fcn.004266ae
imul esi, esi, 0xc
push ecx
mov dword [ebp - 4], ebx
mov ecx, esp
mov dword [ebp - 0x1d4], esp
push dword [ebp + esi - 0x1c4]
call fcn.004094e6
push ecx
mov byte [ebp - 4], 1
mov ecx, esp
push dword [ebp + esi - 0x1c8]
call fcn.004094e6
mov byte [ebp - 4], bl
call fcn.00425b6c
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
call fcn.004267da
test edi, edi
je 0x436d86
call fcn.004be6a3
xor eax, eax
call fcn.00506076
ret 0x10