Function at 0x402d00
Capabilities:
Create process on windows
Create process suspended
Query environment variable

Disassembly:
push ebp
mov eax, sym.___gxx_personality_sj0
mov ebp, esp
push edi
mov edi, 0x403126
push esi
mov esi, 0xc8
push ebx
sub esp, 0x3dc
mov dword [ebp - 0x354], eax
mov eax, 0x4b2654
xor ebx, ebx
mov dword [ebp - 0x350], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34c], eax
lea eax, [ebp - 0x36c]
mov dword [esp], eax
mov dword [ebp - 0x348], edi
mov dword [ebp - 0x344], esp
call sym.__Unwind_SjLj_Register
mov dword [esp], str.ProgramFiles
call sym._getenv
mov dword [ebp - 0x370], eax
lea edx, [ebp - 0xe8]
mov dword [esp], edx
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
call sym._memset
mov ecx, 0xc8
xor edx, edx
mov dword [esp + 8], ecx
lea ecx, [ebp - 0x1b8]
mov dword [esp + 4], edx
mov dword [esp], ecx
call sym._memset
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, str.iexplore.exe__s
mov dword [esp + 4], eax
lea eax, [ebp - 0x1b8]
mov dword [esp], eax
mov eax, 0xffffffff
mov dword [ebp - 0x368], eax
call sym._sprintf
mov eax, dword [ebp - 0x370]
test eax, eax
je 0x4031b8
mov edx, dword [ebp - 0x370]
mov eax, str._sInternet_Exploreriexplore.exe
lea ecx, [ebp - 0xe8]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], edx
call sym._sprintf
mov eax, dword [ebp - 0x370]
mov dword [esp], eax
call sym._free
mov eax, 0x44
lea edx, [ebp - 0x208]
mov edi, 0x44
mov dword [esp + 8], eax
xor eax, eax
xor esi, esi
mov dword [esp], edx
xor ebx, ebx
mov dword [esp + 4], eax
call sym._memset
cld
mov edx, 4
mov dword [ebp - 0x208], edi
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x218]
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0x228]
xor edx, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x1c], esi
lea eax, [ebp - 0x228]
mov ecx, 0x20
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x208]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
lea eax, [ebp - 0x1b8]
mov dword [esp + 4], eax
lea eax, [ebp - 0xe8]
mov dword [esp], eax
mov eax, 0xffffffff
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [ebp - 0x368], eax
call sym._CreateProcessA_40
sub esp, 0x28
test eax, eax
jne 0x403110
mov eax, 0xc8
lea edx, [ebp - 0x2f8]
mov edi, str._s_d
mov dword [esp + 8], eax
xor eax, eax
mov esi, 0xc
mov dword [esp], edx
mov dword [esp + 4], eax
call sym._memset
mov eax, str.SHELLEXECUTEERROR
lea edx, [ebp - 0x308]
mov dword [esp + 8], eax
mov eax, dword [0x4bf014]
mov eax, dword [eax + 0x18]
mov dword [esp], edx
mov dword [esp + 4], eax
call method.LocalKit.findstr_char_const_
mov eax, dword [0x4bf014]
sub esp, 4
lea ecx, [ebp - 0x2f8]
mov edx, dword [ebp - 0x308]
mov eax, dword [eax + 0x14]
mov eax, dword [eax + 0x460]
mov dword [esp + 8], edx
mov dword [esp + 4], edi
mov dword [esp + 0xc], eax
mov dword [esp], ecx
mov dword [ebp - 0x368], esi
call sym._sprintf
mov eax, dword [ebp - 0x308]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b6200
mov dword [ebp - 0x380], ecx
jne 0x4032a0
lea eax, [ebp - 0x2f8]
mov esi, 0xffffffff
mov ebx, 0x4b620c
mov dword [esp], eax
mov dword [ebp - 0x368], esi
call sym.UTF8ToAnsi1_char_const_
mov dword [ebp - 0x384], eax
test eax, eax
mov dword [ebp - 0x308], ebx
je 0x402fb0
mov dword [esp], eax
call sym._strlen
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0x384]
lea eax, [ebp - 0x308]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov ecx, 9
mov dword [ebp - 0x368], ecx
call method.std::string.assign_char_const__unsigned_int_
mov edx, dword [ebp - 0x384]
mov dword [esp], edx
call sym._free
mov edx, str.ERRORHAPPEN
lea eax, [ebp - 0x328]
mov dword [esp + 8], edx
mov edx, dword [0x4bf014]
mov edx, dword [edx + 0x18]
mov dword [esp], eax
mov eax, 9
mov dword [esp + 4], edx
mov dword [ebp - 0x368], eax
call method.LocalKit.findstr_char_const_
mov eax, dword [ebp - 0x328]
sub esp, 4
mov edi, 8
mov dword [ebp - 0x368], edi
mov dword [esp], eax
call sym.UTF8ToAnsi1_char_const_
mov dword [ebp - 0x388], eax
mov esi, 0x4b620c
test eax, eax
mov dword [ebp - 0x338], esi
je 0x40304d
mov dword [esp], eax
mov ebx, 7
call sym._strlen
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0x388]
lea eax, [ebp - 0x338]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [ebp - 0x368], ebx
call method.std::string.assign_char_const__unsigned_int_
mov edx, dword [ebp - 0x388]
mov dword [esp], edx
call sym._free
mov dword [esp], 0
mov eax, dword [ebp - 0x338]
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov edx, dword [ebp - 0x308]
mov dword [esp + 8], eax
mov eax, 7
mov dword [esp + 4], edx
mov dword [ebp - 0x368], eax
call sym._MessageBoxA_16
mov eax, dword [ebp - 0x338]
sub esp, 0x10
lea ecx, [eax - 0xc]
mov dword [ebp - 0x394], ecx
cmp ecx, 0x4b6200
jne 0x4033f8
mov eax, dword [ebp - 0x328]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b6200
mov dword [ebp - 0x3a0], ecx
jne 0x4033b4
mov eax, dword [ebp - 0x308]
lea edx, [eax - 0xc]
cmp edx, 0x4b6200
mov dword [ebp - 0x3ac], edx
je 0x403110
sub eax, 4
mov edx, 0xffffffff
mov dword [esp], eax
mov eax, 1
mov dword [esp + 4], edx
mov dword [ebp - 0x368], eax
call method.__gnu_cxx.__exchange_and_add_int_volatile__int_
test eax, eax
jg 0x403110
mov eax, dword [ebp - 0x3ac]
lea ecx, [ebp - 0x318]
mov dword [esp + 4], ecx
mov dword [esp], eax
call method.std::string::_Rep._M_destroy_std::allocator_char__const_
lea esi, [esi]
lea eax, [ebp - 0x36c]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cld
mov esi, str.C:Program_FilesInternet_Exploreriexplore.exe
mov ecx, 0xc
lea edi, [ebp - 0xe8]
rep movsd dword es:[edi], dword [esi]
jmp 0x402dfc
mov edx, 0xffffffff
sub eax, 4
mov edi, 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [ebp - 0x368], edi
call method.__gnu_cxx.__exchange_and_add_int_volatile__int_
test eax, eax
jg 0x402f45
mov edx, dword [ebp - 0x380]
lea eax, [ebp - 0x318]
mov dword [esp + 4], eax
mov dword [esp], edx
call method.std::string::_Rep._M_destroy_std::allocator_char__const_
jmp 0x402f45
mov edi, 0xffffffff
sub eax, 4
mov esi, 3
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [ebp - 0x368], esi
call method.__gnu_cxx.__exchange_and_add_int_volatile__int_
test eax, eax
jg 0x4030b7
mov edx, dword [ebp - 0x3a0]
lea eax, [ebp - 0x318]
mov dword [esp + 4], eax
mov dword [esp], edx
call method.std::string::_Rep._M_destroy_std::allocator_char__const_
jmp 0x4030b7
mov ebx, 0xffffffff
sub eax, 4
mov ecx, 5
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [ebp - 0x368], ecx
call method.__gnu_cxx.__exchange_and_add_int_volatile__int_
test eax, eax
jg 0x40309c
mov edx, dword [ebp - 0x394]
lea eax, [ebp - 0x318]
mov dword [esp + 4], eax
mov dword [esp], edx
call method.std::string::_Rep._M_destroy_std::allocator_char__const_
jmp 0x40309c