Function at 0x40ee00
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x54]
sub esp, 0xab0
mov eax, dword [ebp + 0x70]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
mov dword [ebp + 0x40], ecx
jne 0x40ee1d
lea eax, [ebp + 0x24]
mov ecx, dword [ebp + 0x7c]
cmp ecx, ebx
mov dword [ebp + 0x44], eax
mov dword [eax], ebx
je 0x40ee34
push 1
push ebx
push 0xffffffffffffffff
push ebx
call fcn.0040187e
mov edi, dword [ebp + 0x5c]
cmp edi, ebx
je 0x40f36f
cmp byte [edi], 0
je 0x40f36f
push edi
call fcn.00457520
cmp eax, 0x4001
pop ecx
mov dword [ebp + 0x3c], eax
jb 0x40ee72
cmp byte [ebp + 0x68], 0
je 0x40f437
push 0x4595d8
push str.String_too_long.__The_current_thread_will_exit.
jmp 0x40f42f
inc eax
mov dword [ebp + 0x28], eax
add eax, 3
and eax, 0xfffffffc
call fcn.00457ac0
mov eax, dword [ebp + 0x64]
cmp eax, ebx
mov esi, esp
je 0x40ee92
cmp byte [eax], 0
jne 0x40ee92
mov dword [ebp + 0x64], ebx
mov eax, dword [ebp + 0x60]
cmp eax, ebx
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x4c], eax
jne 0x40eec8
push edi
push esi
mov dword [ebp + 0x4c], 0x4595d8
call fcn.004572f0
cmp byte [esi], 0x22
pop ecx
pop ecx
jne 0x40ef40
lea edi, [esi + 1]
push 0x22
push edi
call fcn.00457650
jmp 0x40ef4d
push str.find
push edi
call fcn.00441ec1
test eax, eax
pop ecx
pop ecx
je 0x40ef37
push str.explore
push edi
call fcn.00441ec1
test eax, eax
pop ecx
pop ecx
je 0x40ef37
push str.open
push edi
call fcn.00441ec1
test eax, eax
pop ecx
pop ecx
je 0x40ef37
push str.edit
push edi
call fcn.00441ec1
test eax, eax
pop ecx
pop ecx
je 0x40ef37
push 0x45c3c0
push edi
call fcn.00441ec1
test eax, eax
pop ecx
pop ecx
je 0x40ef37
push str.properties
push edi
call fcn.00441ec1
test eax, eax
pop ecx
pop ecx
je 0x40ef37
mov byte [ebp + 0x53], 0
jmp 0x40f0c3
mov byte [ebp + 0x53], 1
jmp 0x40f0c3
push 0x45ac08
push esi
mov edi, esi
call fcn.0043956b
cmp eax, ebx
pop ecx
pop ecx
je 0x40ef5b
mov byte [eax], 0
lea ebx, [eax + 1]
jmp 0x40ef5d
xor ebx, ebx
push str.find
push edi
call fcn.00441ec1
test eax, eax
pop ecx
pop ecx
je 0x40f133
push str.explore
push edi
call fcn.00441ec1
test eax, eax
pop ecx
pop ecx
je 0x40f133
push str.open
push edi
call fcn.00441ec1
test eax, eax
pop ecx
pop ecx
je 0x40f133
push str.edit
push edi
call fcn.00441ec1
test eax, eax
pop ecx
pop ecx
je 0x40f133
push 0x45c3c0
push edi
call fcn.00441ec1
test eax, eax
pop ecx
pop ecx
je 0x40f133
push str.properties
push edi
call fcn.00441ec1
test eax, eax
pop ecx
pop ecx
je 0x40f133
push dword [ebp + 0x5c]
mov byte [ebp + 0x53], 0
push esi
call fcn.004572f0
push str..exe
push esi
call fcn.00439191
add esp, 0x10
test eax, eax
jne 0x40f09b
push str..exe_
push esi
call fcn.00439191
test eax, eax
pop ecx
pop ecx
jne 0x40f09b
push str..bat
push esi
call fcn.00439191
test eax, eax
pop ecx
pop ecx
jne 0x40f09b
push str..bat_
push esi
call fcn.00439191
test eax, eax
pop ecx
pop ecx
jne 0x40f09b
push str..com
push esi
call fcn.00439191
test eax, eax
pop ecx
pop ecx
jne 0x40f09b
push str..com_
push esi
call fcn.00439191
test eax, eax
pop ecx
pop ecx
jne 0x40f09b
push str..cmd
push esi
call fcn.00439191
test eax, eax
pop ecx
pop ecx
jne 0x40f09b
push str..cmd_
push esi
call fcn.00439191
test eax, eax
pop ecx
pop ecx
jne 0x40f09b
push str..hta
push esi
call fcn.00439191
test eax, eax
pop ecx
pop ecx
jne 0x40f09b
push str..hta_
push esi
call fcn.00439191
test eax, eax
pop ecx
pop ecx
je 0x40f0c3
add eax, 4
cmp byte [eax], 0x22
mov dword [ebp + 0x48], esi
mov dword [ebp + 0x4c], eax
jne 0x40f0ad
inc eax
mov dword [ebp + 0x4c], eax
cmp byte [eax], 0
je 0x40f0c3
mov byte [eax], 0
inc eax
push 0xffffffffffffffff
push eax
mov dword [ebp + 0x4c], eax
call fcn.0040a45e
pop ecx
pop ecx
mov ebx, dword [ebp + 0x40]
push 0x7f
xor eax, eax
cmp byte [ebp + 0x78], 0
mov byte [ebp - 0x25c], 0
pop ecx
lea edi, [ebp - 0x25b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [ebp + 0x52], 0
stosb byte es:[edi], al
je 0x40f14f
mov eax, dword [ebx + 0x4d0]
test eax, eax
je 0x40f14f
xor ecx, ecx
cmp word [eax], cx
jne 0x40f10e
mov eax, dword [ebx + 0x4d4]
cmp word [eax], cx
jne 0x40f10e
mov eax, dword [ebx + 0x4d8]
cmp word [eax], cx
je 0x40f14f
cmp byte [ebp + 0x53], 0
mov byte [ebp + 0x7b], 1
je 0x40f15d
cmp byte [ebp + 0x68], 0
je 0x40f437
push 0x4595d8
push str.System_verbs_unsupported_with_RunAs.__The_current_thread_will_exit.
mov ecx, ebx
jmp 0x40f432
test ebx, ebx
mov byte [ebp + 0x53], 1
mov dword [ebp + 0x48], edi
je 0x40f143
mov dword [ebp + 0x4c], ebx
jmp 0x40f0c3
mov dword [ebp + 0x4c], 0x4595d8
jmp 0x40f0c3
cmp byte [ebp + 0x53], 0
mov byte [ebp + 0x7b], 0
jne 0x40f2b1
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0x6c]
inc eax
test ecx, ecx
mov dword [ebp - 0x20], 0x44
mov dword [ebp + 0xc], eax
je 0x40f185
cmp byte [ecx], 0
je 0x40f185
push ecx
call fcn.00416d23
pop ecx
and dword [ebp + 0x2c], 0
mov word [ebp + 0x10], ax
xor eax, eax
lea edi, [ebp + 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 0x60]
test edi, edi
je 0x40f1d0
cmp byte [edi], 0
je 0x40f1d0
push edi
call fcn.00457520
pop ecx
mov ecx, dword [ebp + 0x3c]
lea eax, [eax + ecx + 0xa]
add eax, 3
and eax, 0xfffffffc
call fcn.00457ac0
mov esi, esp
push edi
push dword [ebp + 0x5c]
push str._s__s
push esi
call fcn.0040a5ef
add esp, 0x10
jmp 0x40f1eb
mov eax, dword [ebp + 0x28]
add eax, 3
and eax, 0xfffffffc
call fcn.00457ac0
mov esi, esp
push dword [ebp + 0x5c]
push esi
call fcn.004572f0
pop ecx
pop ecx
cmp byte [ebp + 0x7b], 0
je 0x40f223
lea eax, [ebp - 0x25c]
push eax
push dword [ebp + 0x44]
lea eax, [ebp + 0x52]
push eax
lea eax, [ebp + 0x2c]
push eax
push dword [ebp + 0x7c]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0x74]
push dword [ebp + 0x68]
push dword [ebp + 0x64]
push esi
call fcn.0040f43e
test eax, eax
jne 0x40f286
jmp 0x40f437
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x64]
xor edi, edi
push edi
push edi
push edi
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40f26f
cmp dword [ebp + 0x30], edi
mov byte [ebp + 0x52], 1
je 0x40f253
push dword [ebp + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x44]
mov eax, dword [ebp + 0x2c]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x7c]
cmp ecx, edi
je 0x40f286
push 0x18
push edi
push dword [ebp + 0x34]
call fcn.00401c4f
jmp 0x40f286
push dword [ebp + 0x74]
lea eax, [ebp - 0x25c]
push 0x200
push eax
call fcn.00438672
add esp, 0xc
cmp byte [ebp + 0x52], 0
jne 0x40f34a
cmp byte [ebp + 0x7b], 0
je 0x40f2b1
cmp byte [ebp + 0x68], 0
je 0x40f437
lea eax, [ebp - 0x25c]
push eax
push str.Launch_Error__possibly_related_to_RunAs_.__The_current_thread_will_exit.
jmp 0x40f12c
xor eax, eax
push 0xe
pop ecx
lea edi, [ebp - 0x14]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x64]
mov dword [ebp], eax
mov eax, dword [ebp + 0x6c]
test eax, eax
mov dword [ebp - 0x18], 0x3c
mov dword [ebp - 0x14], 0x440
je 0x40f2e7
cmp byte [eax], 0
je 0x40f2e7
push eax
call fcn.00416d23
pop ecx
mov dword [ebp + 4], eax
jmp 0x40f2ee
mov dword [ebp + 4], 1
cmp byte [ebp + 0x53], 0
mov esi, dword [ebp + 0x48]
je 0x40f31b
push str.properties
push esi
mov dword [ebp - 0xc], esi
call fcn.00441ec1
test eax, eax
pop ecx
pop ecx
jne 0x40f30f
or dword [ebp - 0x14], 0xc
mov eax, dword [ebp + 0x4c]
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
jmp 0x40f330
mov eax, dword [ebp + 0x4c]
mov cl, byte [eax]
and dword [ebp - 0xc], 0
neg cl
mov dword [ebp - 8], esi
sbb ecx, ecx
and ecx, eax
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40f382
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x44]
mov dword [ecx], eax
mov byte [ebp + 0x52], 1
cmp byte [ebp + 0x74], 0
je 0x40f359
mov eax, dword [0x464108]
and dword [eax + 0x30], 0
cmp dword [ebp + 0x70], 0
jne 0x40f36f
mov eax, dword [ebp + 0x44]
mov eax, dword [eax]
test eax, eax
je 0x40f36f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
lea esp, [ebp - 0xa68]
pop edi
pop esi
pop ebx
add ebp, 0x54
leave
ret 0x24
push dword [ebp + 0x74]
lea eax, [ebp - 0x25c]
push 0x200
push eax
call fcn.00438672
add esp, 0xc
cmp byte [ebp + 0x52], 0
jne 0x40f34a
cmp byte [ebp + 0x68], 0
je 0x40f437
cmp byte [ebp + 0x53], 0
je 0x40f3c8
push esi
push str._nVerb:___s_
lea eax, [ebp - 0x5c]
push 0x80
push eax
call fcn.0040a513
add esp, 0x10
jmp 0x40f3cc
mov byte [ebp - 0x5c], 0
push dword [ebp + 0x4c]
call fcn.00457520
mov esi, 0x190
cmp eax, esi
mov edi, 0x45b0c8
pop ecx
mov ebx, edi
ja 0x40f3ea
mov ebx, 0x4595d8
push dword [ebp + 0x48]
call fcn.00457520
cmp eax, esi
pop ecx
ja 0x40f3fc
mov edi, 0x4595d8
push ebx
push dword [ebp + 0x4c]
lea eax, [ebp - 0x5c]
push eax
push edi
push dword [ebp + 0x48]
lea eax, [ebp - 0xa5c]
push str.Failed_attempt_to_launch_program_or_document:_nAction:____0.400s_s__s_nParams:____0.400s_s__n_nThe_current_thread_will_exit.
push 0x800
push eax
call fcn.0040a513
add esp, 0x20
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0xa5c]
push eax
mov ecx, dword [ebp + 0x40]
call fcn.0044bc5a
xor eax, eax
jmp 0x40f372