Function at 0x442320
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x41c]
sub esp, 0x41c
push 0xffffffffffffffff
push 0x491cb8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4c4074]
xor eax, ebp
mov dword [ebp + 0x418], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0x4ab678
mov edx, 0x4aaf7c
lea ecx, [ebp]
call fcn.00404930
add esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp]
call fcn.004202d0
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x442391
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov byte [ebp - 4], 0
mov edx, dword [ebp + 0x2c]
cmp edx, 8
jb 0x4423ea
mov ecx, dword [ebp + 0x18]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4423e0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4426b9
push edx
push ecx
call fcn.0046e3c2
add esp, 8
xor eax, eax
mov dword [ebp + 0x28], 0
mov dword [ebp + 0x2c], 7
mov word [ebp + 0x18], ax
cmp ebx, 0xffffffff
jne 0x44240a
or edi, ebx
jmp 0x442643
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 4
lea edx, [ebp - 0x14]
push 0xfde9
mov ecx, esi
call fcn.00420a60
mov edi, dword [ebp - 0x10]
lea esi, [ebp + 0x30]
mov edx, esi
mov ecx, str._InternetShortcut__r_nURL
add esp, 4
mov al, 0x5b
sub ecx, edx
mov edx, edi
nop dword [eax]
mov byte [esi], al
inc esi
mov al, byte [ecx + esi]
test al, al
jne 0x442440
mov byte [esi], al
mov dl, byte [edx]
test dl, dl
je 0x4424d0
lea edi, [edi + 1]
cmp dl, 0x61
jl 0x442463
cmp dl, 0x7a
jle 0x442577
cmp dl, 0x41
jl 0x442471
cmp dl, 0x5a
jle 0x442577
cmp dl, 0x30
jl 0x44247f
cmp dl, 0x39
jle 0x442577
mov eax, str.__.____:_______
mov cl, 0x2d
cmp cl, dl
je 0x44256c
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x442486
mov cl, dl
mov byte [esi], 0x25
sar cl, 4
and dl, 0xf
and cl, 0xf
cmp cl, 0xa
sbb al, al
and al, 0xf9
add al, 0x37
add al, cl
cmp dl, 0xa
mov byte [esi + 1], al
sbb al, al
and al, 0xf9
add al, 0x37
add al, dl
mov byte [esi + 2], al
mov eax, 3
add esi, eax
mov byte [esi], 0
mov dl, byte [edi]
test dl, dl
jne 0x442452
mov word [esi], 0xa0d
lea eax, [ebp + 0x30]
add esi, 2
push 0
mov byte [esi], 0
sub esi, eax
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp + 0x30]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or edi, 0xffffffff
test esi, esi
je 0x44261f
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp]
call fcn.004202d0
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
jb 0x44251e
mov eax, dword [eax]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 5
push 0
push 0
push eax
push str.open
push 0
call esi
mov edi, eax
mov byte [ebp - 4], 4
mov edx, dword [ebp + 0x2c]
cmp edx, 8
jb 0x44258d
mov ecx, dword [ebp + 0x18]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x442583
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4426be
jmp 0x442583
sub eax, str.__.____:_______
js 0x442496
mov byte [esi], dl
mov eax, 1
jmp 0x4424c5
push edx
push ecx
call fcn.0046e3c2
add esp, 8
xor eax, eax
mov dword [ebp + 0x28], 0
mov dword [ebp + 0x2c], 7
mov word [ebp + 0x18], ax
cmp edi, 0x20
ja 0x44261f
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp]
call fcn.004202d0
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 8
jb 0x4425be
mov eax, dword [eax]
push 5
push 0
push 0
push eax
push 0
push 0
call esi
mov edi, eax
mov byte [ebp - 4], 4
mov edx, dword [ebp + 0x2c]
cmp edx, 8
jb 0x44260b
mov ecx, dword [ebp + 0x18]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x442601
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4426c3
push edx
push ecx
call fcn.0046e3c2
add esp, 8
xor eax, eax
mov dword [ebp + 0x28], 0
mov dword [ebp + 0x2c], 7
mov word [ebp + 0x18], ax
xor eax, eax
cmp edi, 0x20
cmova edi, eax
mov byte [ebp - 4], al
push dword [ebp - 0x10]
call fcn.0046eb32
add esp, 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 0x14]
cmp edx, 8
jb 0x442680
mov ecx, dword [ebp]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x442676
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4426c8
push edx
push ecx
call fcn.0046e3c2
add esp, 8
xor eax, eax
mov dword [ebp + 0x10], 0
mov word [ebp], ax
mov eax, edi
mov dword [ebp + 0x14], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x418]
xor ecx, ebp
call fcn.0046e38e
lea esp, [ebp + 0x41c]
pop ebp
ret
call fcn.004736d9
call fcn.004736d9
call fcn.004736d9
call fcn.004736d9
int3