Function at 0x4132c7
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4297a3
call fcn.0041bd3c
sub esp, 0x1a4
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x10
lea eax, [esp + 0x80]
push ebx
push eax
mov dword [esp + 0x24], ebx
call fcn.0041b420
add esp, 0xc
call fcn.00413e2f
mov ebp, dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp eax, 2
jae 0x413316
push str.870870
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x413316
push eax
call ebp
push 0x44
pop esi
push esi
lea eax, [esp + 0x174]
push ebx
push eax
call fcn.0041b420
mov dword [esp + 0x17c], esi
mov esi, dword [esp + 0x1d4]
add esp, 0xc
mov eax, dword [esi]
mov dword [esp + 0x14], 0x20
mov eax, dword [eax]
and eax, 0xf000
cmp eax, 0x2000
je 0x413362
cmp eax, 0x8000
jne 0x41336a
mov dword [esp + 0x14], 0x80
jmp 0x41336a
mov dword [esp + 0x14], 0x40
call fcn.00413a9f
lea edi, [esi + 0x1c]
push edi
mov dword [esi + 0x10], eax
lea eax, [esp + 0x144]
push 0x438b68
push eax
mov dword [esi + 0x14], edx
call fcn.0040f18f
mov dword [esp + 0x1c8], ebx
push 0x438b64
push eax
lea eax, [esp + 0x16c]
push eax
call fcn.0040f148
mov ecx, eax
mov byte [esp + 0x1d4], 1
lea eax, [esi + 0x34]
push eax
push ecx
lea eax, [esp + 0xe8]
push eax
call fcn.0040f107
add esp, 0x24
mov byte [esp + 0x1bc], 3
lea ecx, [esp + 0x158]
call fcn.0040165f
mov byte [esp + 0x1bc], 4
lea ecx, [esp + 0x140]
call fcn.0040165f
lea eax, [esp + 0x34]
push edi
push eax
call fcn.0040f66c
mov byte [esp + 0x1c4], 5
lea eax, [esp + 0xd0]
push eax
lea eax, [esp + 0x58]
push eax
call fcn.0040f66c
add esp, 0x10
mov byte [esp + 0x1bc], 6
cmp dword [edi + 0x14], 0x10
jb 0x413426
mov eax, dword [edi]
jmp 0x413428
mov eax, edi
push ebx
push eax
call fcn.004180ef
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
pop ecx
pop ecx
test al, al
jne 0x4136b0
push dword [0x4371e0]
cmp dword [0x4371e4], 0x10
mov eax, 0x4371d0
cmovae eax, dword [0x4371d0]
push 0
push eax
mov ecx, edi
call fcn.00413a37
cmp eax, 0xffffffff
jne 0x4136b0
call fcn.00413e2f
cmp eax, 3
jae 0x413484
push str.Local772
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.00413e2f
cmp eax, 2
jae 0x4134a1
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call fcn.00413e2f
cmp eax, 2
jae 0x4134c2
push str.Local11226
xor eax, eax
push eax
push eax
push eax
call ebx
test eax, eax
je 0x4134c2
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [esp + 0xe0]
push str.PATH
push eax
call fcn.004188af
mov byte [esp + 0x1c4], 7
push 1
push 0x3b
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0041a53e
add esp, 0x18
mov byte [esp + 0x1bc], 9
lea ecx, [esp + 0xe0]
call fcn.0040165f
lea eax, [esp + 0x64]
push str.SYSTEMROOT
push eax
call fcn.004188af
mov byte [esp + 0x1c4], 0xa
cmp dword [esp + 0x80], 0x10
lea eax, [esp + 0x6c]
cmovae eax, dword [esp + 0x6c]
push eax
lea eax, [esp + 0x134]
push str._sSYSTEM32
push eax
call fcn.0040b674
add esp, 0x14
mov byte [esp + 0x1bc], 0xb
push eax
lea ecx, [esp + 0x2c]
call fcn.00413d3d
mov byte [esp + 0x1bc], 0xa
lea ecx, [esp + 0x128]
call fcn.0040165f
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x2c]
call fcn.00413daa
call fcn.00413e2f
cmp eax, 2
jae 0x413596
push str.Local11227
push 1
push 1
push 0
call ebx
test eax, eax
je 0x413596
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.00413e2f
cmp eax, 2
jae 0x4135b3
xor eax, eax
push eax
push eax
push eax
push eax
call ebx
test eax, eax
je 0x4135b3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00413e2f
cmp eax, 3
jae 0x4135da
push str.Global268
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4135da
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00413e2f
cmp eax, 3
jae 0x413601
push str.Global928
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x413601
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00413e2f
cmp eax, 3
jae 0x41361a
push str.Local138
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp dword [edi + 0x14], 0x10
jb 0x413622
mov edi, dword [edi]
lea eax, [esp + 0x28]
push eax
push 0
lea eax, [esp + 0x118]
push edi
push eax
call fcn.00419468
mov byte [esp + 0x1cc], 0xc
push eax
lea eax, [esp + 0x10c]
push eax
call fcn.0040f66c
add esp, 0x18
mov byte [esp + 0x1bc], 0xd
push eax
lea ecx, [esp + 0x38]
call fcn.0040facf
mov byte [esp + 0x1bc], 0xc
push 0
push 1
lea ecx, [esp + 0x100]
call fcn.00401bb0
mov byte [esp + 0x1bc], 0xa
lea ecx, [esp + 0x110]
call fcn.0040165f
mov byte [esp + 0x1bc], 9
lea ecx, [esp + 0x64]
call fcn.0040165f
mov byte [esp + 0x1bc], 6
lea ecx, [esp + 0x28]
call fcn.00411418
mov eax, dword [esi]
test dword [eax], 0x600
je 0x413974
call fcn.00413e2f
cmp eax, 2
jae 0x4136dd
push 0
push 0
push 0
push 0
call ebx
test eax, eax
je 0x4136dd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00413e2f
cmp eax, 2
jae 0x4136f9
push str.281281
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x4136f9
push eax
call ebp
call fcn.00413e2f
cmp eax, 2
jae 0x41371b
push str.Local11241
push 1
push 1
push 0
call ebx
test eax, eax
je 0x41371b
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.004192a0
test al, al
jne 0x413974
push 0x3c
pop edi
push edi
lea eax, [esp + 0x90]
push 0
push eax
call fcn.0041b420
add esp, 0xc
mov dword [esp + 0x8c], edi
mov dword [esp + 0x90], 0x4140
call fcn.00413e2f
push 2
pop edi
cmp eax, edi
jae 0x41376e
push str.464464
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x41376e
push eax
call ebp
call fcn.00413e2f
cmp eax, edi
jae 0x413789
push str.308308
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x413789
push eax
call ebp
call fcn.00413e2f
xor ebp, ebp
cmp eax, edi
jae 0x4137a3
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call fcn.00413e2f
cmp eax, 3
jae 0x4137c9
push str.Global103
push ebp
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4137c9
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00413e2f
cmp eax, edi
jae 0x4137e1
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call fcn.00413e2f
cmp eax, edi
jae 0x413800
push edi
call fcn.0041a976
pop ecx
test eax, eax
je 0x413800
push eax
mov byte [eax + 1], 0xe
call fcn.0040c4f8
pop ecx
call fcn.00413e2f
cmp eax, edi
jae 0x41381c
push ebp
push 1
push 1
push ebp
call ebx
test eax, eax
je 0x41381c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00413e2f
cmp eax, edi
jae 0x413836
push ebp
push ebp
push ebp
push ebp
call ebx
test eax, eax
je 0x413836
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x48], 8
lea eax, [esp + 0x34]
cmovae eax, dword [esp + 0x34]
cmp dword [esp + 0x60], 8
mov dword [esp + 0x9c], eax
lea eax, [esp + 0x4c]
cmovae eax, dword [esp + 0x4c]
mov dword [esp + 0x98], str.runas
mov dword [esp + 0xa0], eax
call fcn.00413e2f
cmp eax, 3
jae 0x413891
push str.Global236
push ebp
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x413891
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x4138b3
push eax
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x4138ec
push 0x48
pop edi
jmp 0x4138c5
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x48
call dword [sym.imp.KERNEL32.dll_Sleep]
xor ebp, ebp
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
dec edi
jne 0x4138c3
push 2
pop edi
jmp 0x4138ee
xor ebp, ebp
call fcn.00413e2f
cmp eax, edi
jae 0x41390d
push edi
call fcn.0041a976
pop ecx
test eax, eax
je 0x41390d
push eax
mov byte [eax + 1], 0x2b
call fcn.0040c4f8
pop ecx
call fcn.00413e2f
cmp eax, edi
jae 0x413927
push ebp
push ebp
push ebp
push ebp
call ebx
test eax, eax
je 0x413927
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x8c]
push eax
mov dword [esp + 0xac], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x413968
cmp dword [esp + 0xac], 0x20
jbe 0x413968
mov eax, dword [esi]
test byte [eax], 0x44
je 0x41395f
push ebp
push dword [esp + 0xc8]
jmp 0x4139da
mov eax, dword [esp + 0xc4]
jmp 0x4139c9
mov eax, dword [esi]
test dword [eax], 0x400
jne 0x4139e3
jmp 0x413976
xor ebp, ebp
cmp dword [esp + 0x60], 8
lea edx, [esp + 0x7c]
push edx
lea edx, [esp + 0x174]
push edx
push ebp
push ebp
push dword [esp + 0x24]
lea ecx, [esp + 0x60]
cmovae ecx, dword [esp + 0x60]
cmp dword [esp + 0x5c], 8
push ebp
push ebp
push ebp
lea eax, [esp + 0x54]
cmovae eax, dword [esp + 0x54]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4139ce
mov eax, dword [esi]
test byte [eax], 0x44
je 0x4139c5
push ebp
push dword [esp + 0x80]
jmp 0x4139da
mov eax, dword [esp + 0x7c]
mov dword [esi + 8], eax
jmp 0x4139e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [esp + 0x1c], eax
push ebp
push esi
call fcn.00411a9a
add esp, 0xc
mov byte [esp + 0x1bc], 5
push ebp
push 1
lea ecx, [esp + 0x54]
call fcn.00401bb0
mov byte [esp + 0x1bc], 4
push ebp
push 1
lea ecx, [esp + 0x3c]
call fcn.00401bb0
or dword [esp + 0x1bc], 0xffffffff
lea ecx, [esp + 0xc8]
call fcn.0040165f
mov ecx, dword [esp + 0x1b4]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret