Function at 0x41206e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9ac
push 0
push 0x540053
push 0x4f0050
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
lea edx, [esp + 0x10]
push edx
call fcn.00412924
add esp, 0xc
test eax, eax
je 0x4126f1
mov dword [ebp - 0x9ac], 0
mov word [ebp - 0x950], 8
mov dword [ebp - 0x948], eax
push 0x74
push 0x700069
push 0x720063
push 0x73006a
push esp
call dword [sym.imp.oleaut32.dll_SysAllocString]
mov dword [ebp - 0x9a4], eax
add esp, 0x10
push 0
push 0x3d006a
push 0x200072
push 0x610076
mov word [ebp - 0x960], 8
push esp
call dword [sym.imp.oleaut32.dll_SysAllocString]
mov dword [ebp - 0x958], eax
mov word [ebp - 0x940], 1
lea edx, [ebp - 0x940]
push edx
lea edx, [ebp - 0x950]
push edx
lea edx, [ebp - 0x960]
push edx
call dword [sym.imp.oleaut32.dll_VarAdd]
lea edx, [ebp - 0x960]
push edx
call dword [sym.imp.oleaut32.dll_VariantClear]
lea edx, [ebp - 0x950]
push edx
call dword [sym.imp.oleaut32.dll_VariantClear]
add esp, 0x10
push 0
push 0x3b0029
push 0x280065
push 0x730061
push 0x430072
push 0x650077
push 0x6f004c
push 0x6f0074
push 0x2e0070
push 0x3d0072
push 0x29006a
push 0x20006e
push 0x690020
push 0x700028
push 0x72006f
push 0x66003b
push 0x720020
push 0x720061
push 0x76003b
mov word [ebp - 0x960], 8
push esp
call dword [sym.imp.oleaut32.dll_SysAllocString]
mov dword [ebp - 0x958], eax
mov word [ebp - 0x9a0], 1
lea edx, [ebp - 0x9a0]
push edx
lea edx, [ebp - 0x960]
push edx
lea edx, [ebp - 0x940]
push edx
call dword [sym.imp.oleaut32.dll_VarAdd]
lea edx, [ebp - 0x960]
push edx
call dword [sym.imp.oleaut32.dll_VariantClear]
add esp, 0x4c
push 0
push 0x3b0065
push 0x670061
push 0x730073
push 0x65006d
push 0x2e0065
push 0x720075
push 0x6c0069
push 0x610066
push 0x2e006a
push 0x3d006d
push 0x3b0022
push 0x22003d
push 0x6d0020
push 0x720061
push 0x76003b
mov word [ebp - 0x960], 8
push esp
call dword [sym.imp.oleaut32.dll_SysAllocString]
mov dword [ebp - 0x958], eax
mov word [ebp - 0x980], 1
lea edx, [ebp - 0x980]
push edx
lea edx, [ebp - 0x960]
push edx
lea edx, [ebp - 0x940]
push edx
call dword [sym.imp.oleaut32.dll_VarAdd]
lea edx, [ebp - 0x960]
push edx
call dword [sym.imp.oleaut32.dll_VariantClear]
add esp, 0x40
push 0
push 0x3b006c
push 0x720055
push 0x650067
push 0x610070
push 0x2e0073
push 0x730065
push 0x630063
push 0x750073
push 0x2e006a
push 0x3d0075
push 0x3b0022
push 0x22003d
push 0x750020
push 0x720061
push 0x76003b
mov word [ebp - 0x960], 8
push esp
call dword [sym.imp.oleaut32.dll_SysAllocString]
mov dword [ebp - 0x958], eax
mov word [ebp - 0x970], 1
lea edx, [ebp - 0x970]
push edx
lea edx, [ebp - 0x960]
push edx
lea edx, [ebp - 0x940]
push edx
call dword [sym.imp.oleaut32.dll_VarAdd]
lea edx, [ebp - 0x960]
push edx
call dword [sym.imp.oleaut32.dll_VariantClear]
lea edx, [ebp - 0x940]
push edx
call dword [sym.imp.oleaut32.dll_VariantClear]
add esp, 0x40
push 0x6c
push 0x6f0072
push 0x74006e
push 0x6f0043
push 0x740070
push 0x690072
push 0x630053
push 0x2e006c
push 0x6f0072
push 0x74006e
push 0x6f0043
push 0x740070
push 0x690072
push 0x630053
push 0x53004d
lea edx, [ebp - 0x924]
push edx
lea edx, [esp + 4]
push edx
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
add esp, 0x3c
test eax, eax
je 0x41239d
mov dword [ebp - 0x9ac], 0x77
mov dword [ebp - 0x9a8], eax
jmp 0x41263a
push 0xbc3800d1
push 0xa000f28f
push 0x11d01fbe
push 0xe59f1d3
lea edx, [ebp - 0x928]
push edx
lea edx, [esp + 4]
push edx
push 1
push 0
lea edx, [ebp - 0x924]
push edx
call dword [sym.imp.ole32.dll_CoCreateInstance]
add esp, 0x10
test eax, eax
je 0x4123ea
mov dword [ebp - 0x9ac], 0x78
mov dword [ebp - 0x9a8], eax
jmp 0x41263a
push dword [ebp - 0x9a4]
mov eax, dword [ebp - 0x928]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
test eax, eax
je 0x412415
mov dword [ebp - 0x9ac], 0x79
mov dword [ebp - 0x9a8], eax
jmp 0x41262e
lea edx, [ebp - 0x960]
push edx
push dword [ebp - 0x998]
mov eax, dword [ebp - 0x928]
push eax
mov eax, dword [eax]
call dword [eax + 0x6c]
test eax, eax
je 0x412447
mov dword [ebp - 0x9ac], 0x7a
mov dword [ebp - 0x9a8], eax
jmp 0x41262e
cmp word [ebp - 0x960], 8
jne 0x41262e
push 0x73
push 0x730065
push 0x630063
push 0x750073
push esp
push dword [ebp - 0x958]
call dword [sym.imp.kernel32.dll_lstrcmpiW]
add esp, 0x10
test eax, eax
jne 0x4124ed
lea edx, [ebp - 0x950]
push edx
push dword [ebp - 0x968]
mov eax, dword [ebp - 0x928]
push eax
mov eax, dword [eax]
call dword [eax + 0x6c]
test eax, eax
je 0x4124a9
mov dword [ebp - 0x9ac], 0x7b
mov dword [ebp - 0x9a8], eax
jmp 0x4124e8
cmp word [ebp - 0x950], 8
jne 0x4124db
push 0
push 0x6e0065
push 0x70006f
push 1
push 0
push 0
push dword [ebp - 0x948]
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.shell32.dll_ShellExecuteW]
add esp, 0xc
lea edx, [ebp - 0x950]
push edx
call dword [sym.imp.oleaut32.dll_VariantClear]
jmp 0x412621
push 0x65
push 0x720075
push 0x6c0069
push 0x610066
push esp
push dword [ebp - 0x958]
call dword [sym.imp.kernel32.dll_lstrcmpiW]
add esp, 0x10
test eax, eax
jne 0x412621
lea edx, [ebp - 0x940]
push edx
push dword [ebp - 0x978]
mov eax, dword [ebp - 0x928]
push eax
mov eax, dword [eax]
call dword [eax + 0x6c]
test eax, eax
je 0x412548
mov dword [ebp - 0x9ac], 0x7d
mov dword [ebp - 0x9a8], eax
jmp 0x412621
cmp word [ebp - 0x940], 8
jne 0x412614
push 0x64
push 0x650073
push 0x730065
push 0x63006f
push 0x720070
push 0x6e0075
push esp
push dword [ebp - 0x938]
call dword [sym.imp.kernel32.dll_lstrcmpiW]
add esp, 0x18
test eax, eax
je 0x412614
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0x938]
push 0
push 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
push 0
push 0
push eax
lea edx, [ebp - 0x504]
push edx
push 0xffffffffffffffff
push dword [ebp - 0x938]
push 0
push 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
lea ecx, [ebp - 0x504]
push 0xa0d
push 0x7325203a
push 0x24524f52
push 0x52455f4e
push 0x574f4e4b
push 0x4e555f43
push 0x54445543
push 0x455f524f
push 0x52524524
push ecx
lea eax, [esp + 4]
push eax
lea eax, [ebp - 0x914]
push eax
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x30
lea eax, [ebp - 0x914]
push eax
call dword [ebx + 0x30]
lea edx, [ebp - 0x940]
push edx
call dword [sym.imp.oleaut32.dll_VariantClear]
lea edx, [ebp - 0x960]
push edx
call dword [sym.imp.oleaut32.dll_VariantClear]
mov eax, dword [ebp - 0x928]
push eax
mov eax, dword [eax]
call dword [eax + 8]
lea edx, [ebp - 0x970]
push edx
call dword [sym.imp.oleaut32.dll_VariantClear]
lea edx, [ebp - 0x980]
push edx
call dword [sym.imp.oleaut32.dll_VariantClear]
lea edx, [ebp - 0x990]
push edx
call dword [sym.imp.oleaut32.dll_VariantClear]
lea edx, [ebp - 0x9a0]
push edx
call dword [sym.imp.oleaut32.dll_VariantClear]
push dword [ebp - 0x9a4]
call dword [sym.imp.oleaut32.dll_SysFreeString]
mov eax, dword [ebp - 0x9a8]
mov ecx, dword [ebp - 0x9ac]
test ecx, ecx
je 0x4126f1
push 0x58382e
push 0x25642523
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x45242024
push 0x524f5252
push 0x455f4c41
push 0x4e524554
push 0x4e495f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push eax
push ecx
lea edx, [esp + 8]
push edx
lea edx, [ebp - 0x914]
push edx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x10
add esp, 0x34
lea edx, [ebp - 0x914]
push edx
call fcn.0040bfea
leave
ret 0x10