Function at 0x409bd1
Capabilities:
Create process on windows

Disassembly:
push 0x2fc
mov eax, 0x417d8d
call fcn.0040caca
movzx eax, word [ebp + 0x10]
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x26c], edi
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x250], ecx
cmp ax, 1
je 0x409c0d
cmp ax, 2
je 0x409c0d
cmp ax, 3
jne 0x409c13
xor esi, esi
cmp ecx, esi
jne 0x409c20
mov eax, 0x80070057
call fcn.0040cb4d
ret 0x10
mov ecx, edi
call fcn.00408eb6
push dword [edi + 0x10]
lea ecx, [ebp - 0x2c0]
call fcn.004092a2
mov eax, dword [ebp - 0x2bc]
mov ecx, dword [ebp - 0x2c0]
sub eax, ecx
push 0x24
cdq
pop ebx
idiv ebx
mov dword [ebp - 4], esi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x22c], eax
cmp eax, esi
jbe 0x409d4c
mov dword [ebp - 0x21c], ecx
push dword [ebp - 0x21c]
lea eax, [ebp - 0x230]
push eax
call fcn.00402826
pop ecx
pop ecx
mov dword [ebp - 0x224], esi
mov ebx, dword [ebp - 0x230]
mov byte [ebp - 4], 2
cmp ebx, esi
je 0x409ca3
mov eax, dword [ebx]
lea ecx, [ebp - 0x224]
push ecx
push ebx
call dword [eax + 0x20]
cmp dword [ebp - 0x224], esi
jne 0x409cc5
mov eax, dword [ebp - 0x21c]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax]
lea edx, [ebp - 0x224]
push edx
push 0x4199d4
push eax
call dword [ecx]
cmp dword [ebp - 0x224], esi
je 0x409d0b
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x2c4]
push eax
push dword [ebp - 0x224]
call fcn.0040b258
add esp, 0x10
test eax, eax
js 0x409d0b
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x409d0b
cmp dword [ebp - 0x270], eax
jne 0x409d0b
mov ax, word [ebp - 0x234]
cmp word [ebp - 0x238], ax
je 0x409d59
mov eax, dword [ebp - 0x224]
mov byte [ebp - 4], 1
cmp eax, esi
je 0x409d1f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0
cmp ebx, esi
je 0x409d2d
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
inc dword [ebp - 0x218]
mov eax, dword [ebp - 0x218]
add dword [ebp - 0x21c], 0x24
cmp eax, dword [ebp - 0x22c]
jb 0x409c66
cmp dword [ebp + 8], 2
jne 0x409d8d
mov esi, 0x80004005
jmp 0x409d7b
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x250]
mov dword [ebp - 0x224], esi
mov dword [ecx], eax
mov byte [ebp - 4], 0
cmp ebx, esi
je 0x409d7b
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
lea ecx, [ebp - 0x2c0]
call fcn.0040442c
mov eax, esi
jmp 0x409c18
mov ecx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ecx
push 0x18
cdq
pop edi
idiv edi
xor ebx, ebx
cmp eax, esi
jbe 0x409d52
lea edx, [ecx + 0x10]
cmp dword [edx], esi
je 0x409db1
inc ebx
add edx, 0x18
cmp ebx, eax
jb 0x409da3
jmp 0x409d52
imul ebx, ebx, 0x18
add ebx, ecx
or dword [ebx + 0x10], 0xffffffff
xor eax, eax
push 0x18e
mov word [ebp - 0x1f0], ax
lea eax, [ebp - 0x1ee]
push esi
push eax
mov dword [ebp - 0x22c], ebx
call fcn.0040c330
add esp, 0xc
cmp word [ebp - 0x234], 1
mov edi, 0x41a3c8
je 0x409df2
mov edi, 0x41a3c0
push ebx
lea ecx, [ebp - 0x230]
call fcn.00407ec2
push dword [eax]
lea eax, [ebp - 0x1f0]
push edi
push 0x41a390
push 0xc7
push 0xc8
push eax
call fcn.0040f0be
add esp, 0x18
push dword [ebp - 0x230]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x40
lea eax, [ebp - 0x304]
push esi
push eax
mov dword [ebp - 0x308], 0x44
call fcn.0040c330
xor eax, eax
mov dword [ebp - 0x2a0], esi
lea edi, [ebp - 0x29c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
movzx eax, word [ebp - 0x234]
push eax
lea eax, [ebp - 0x228]
push eax
xor edi, edi
call fcn.004040a8
add esp, 0x14
mov eax, dword [ebp - 0x228]
cmp dword [eax - 0xc], esi
jle 0x409eb9
lea ecx, [ebp - 0x2a0]
push ecx
lea ecx, [ebp - 0x308]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x1f0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
cmp edi, esi
je 0x409eb9
push dword [ebp - 0x2a0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x29c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x230], esi
mov byte [ebp - 4], 4
cmp edi, esi
je 0x40a40e
mov eax, dword [ebp - 0x298]
push 0x13
pop ecx
mov dword [ebx + 0x10], eax
mov esi, 0x41a340
lea edi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x60]
push eax
movsw word es:[edi], word [esi]
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
cmp edi, esi
je 0x409f0b
push 0x5dc
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x220], esi
lea eax, [ebp - 0x220]
push eax
push 0x4199d4
push 4
push esi
push ebx
mov byte [ebp - 4], 5
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x264], esi
mov dword [ebp - 0x268], esi
cmp eax, esi
jl 0x40a2d8
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x220]
call fcn.0040b258
add esp, 0x10
test eax, eax
js 0x40a2d8
cmp dword [ebp - 0x264], esi
jne 0x40a3e2
mov eax, dword [ebp - 0x23c]
cmp eax, dword [ebp - 0x298]
jne 0x40a3e2
xor eax, eax
push 0x41a32c
lea ecx, [ebp - 0x290]
mov word [ebp - 0x290], ax
call fcn.004083e6
mov dword [ebp - 0x21c], esi
mov eax, dword [ebp - 0x220]
mov ecx, dword [eax]
lea edx, [ebp - 0x21c]
push edx
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x290]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
mov byte [ebp - 4], 7
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x24]
test eax, eax
je 0x40a009
and dword [ebx + 0x10], 0
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 6
test eax, eax
je 0x409fef
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x220]
test eax, eax
jmp 0x40a3ed
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax]
lea edx, [ebp - 0x218]
push edx
push 0x41a31c
push eax
mov byte [ebp - 4], 8
call dword [ecx]
test eax, eax
je 0x40a049
mov eax, dword [ebp - 0x218]
and dword [ebx + 0x10], 0
mov byte [ebp - 4], 7
test eax, eax
je 0x409fdb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x409fdb
push 3
pop eax
mov word [ebp - 0x24c], ax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x244], eax
lea esi, [ebp - 0x24c]
lea edi, [ebp - 0x2b0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
push 0x41a314
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 9
movsd dword es:[edi], dword [esi]
mov word [ebp - 0x260], ax
call fcn.004083e6
sub esp, 0x10
mov edi, esp
mov eax, dword [ebp - 0x218]
lea esi, [ebp - 0x2b0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x260]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
mov byte [ebp - 4], 0xa
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x24]
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x260]
push eax
call ebx
lea eax, [ebp - 0x24c]
push eax
call ebx
push 0x13
pop eax
mov word [ebp - 0x260], ax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x258], eax
lea esi, [ebp - 0x260]
lea edi, [ebp - 0x2b0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
push 0x41a308
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 0xb
movsd dword es:[edi], dword [esi]
mov word [ebp - 0x24c], ax
call fcn.004083e6
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x2b0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
lea esi, [ebp - 0x24c]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov byte [ebp - 4], 0xc
movsd dword es:[edi], dword [esi]
push eax
call dword [ecx + 0x24]
lea eax, [ebp - 0x24c]
push eax
call ebx
lea eax, [ebp - 0x260]
push eax
call ebx
push 2
pop eax
mov word [ebp - 0x260], ax
mov ax, word [ebp - 0x234]
mov word [ebp - 0x258], ax
lea esi, [ebp - 0x260]
lea edi, [ebp - 0x2b0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
push 0x41a2f8
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 0xd
movsd dword es:[edi], dword [esi]
mov word [ebp - 0x24c], ax
call fcn.004083e6
sub esp, 0x10
mov edi, esp
mov eax, dword [ebp - 0x218]
lea esi, [ebp - 0x2b0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x24c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
mov byte [ebp - 4], 0xe
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x24]
lea eax, [ebp - 0x24c]
push eax
call ebx
lea eax, [ebp - 0x260]
push eax
call ebx
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 9
pop eax
lea edx, [ebp - 0x278]
push edx
mov word [ebp - 0x280], ax
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax]
push 0x41a634
push eax
mov byte [ebp - 4], 0xf
call dword [ecx]
test eax, eax
je 0x40a25c
xor eax, eax
mov word [ebp - 0x280], ax
mov eax, dword [ebp - 0x22c]
and dword [eax + 0x10], 0
lea eax, [ebp - 0x280]
push eax
call ebx
mov eax, dword [ebp - 0x218]
mov byte [ebp - 4], 7
test eax, eax
je 0x40a23a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 6
test eax, eax
je 0x40a24e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x290]
push eax
call ebx
jmp 0x409ffc
mov eax, dword [ebp - 0x220]
mov ecx, dword [eax]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x280]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x20]
test eax, eax
js 0x40a296
cmp dword [ebp - 0x220], 0
je 0x40a296
push dword [ebp - 0x220]
lea eax, [ebp - 0x230]
push eax
call fcn.0040132c
lea eax, [ebp - 0x280]
push eax
call ebx
mov eax, dword [ebp - 0x218]
mov byte [ebp - 4], 7
test eax, eax
je 0x40a2b3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 6
test eax, eax
je 0x40a2c7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x290]
push eax
call ebx
mov ebx, dword [ebp - 0x22c]
xor esi, esi
mov eax, dword [ebp - 0x220]
mov byte [ebp - 4], 4
cmp eax, esi
je 0x40a2ec
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [ebp - 0x230]
cmp edi, esi
je 0x40a40c
lea ecx, [ebp - 0x214]
call fcn.004027c8
mov esi, 0x41a2f4
push esi
mov byte [ebp - 4], 0x10
call fcn.0040c429
pop ecx
push eax
push esi
lea ecx, [ebp - 0x200]
call fcn.00403972
mov esi, dword [ebp - 0x234]
mov eax, 0x41a3c8
cmp si, 1
je 0x40a338
mov eax, 0x41a3c0
push eax
lea ecx, [ebp - 0x1fc]
call fcn.00403dbf
mov eax, dword [ebx + 0x10]
push eax
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x22c]
push edi
push eax
call fcn.0040b689
add esp, 0xc
push eax
lea ecx, [ebp - 0x1f8]
call fcn.004085bf
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x40a37a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
and dword [ebp - 0x204], eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x214]
push eax
mov eax, dword [ebp - 0x26c]
mov ecx, dword [eax + 0x10]
mov byte [ebp - 0x1f4], 1
mov word [ebp - 0x20e], si
call fcn.00404a9f
add ebx, 0x14
cmp dword [ebx], edi
je 0x40a3ba
push edi
push ebx
call fcn.0040132c
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x214]
mov dword [eax], edi
call fcn.0040289a
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.00401ac9
xor esi, esi
jmp 0x409d7b
mov eax, dword [ebp - 0x220]
mov dword [ebx + 0x10], esi
cmp eax, esi
mov byte [ebp - 4], 4
je 0x40a3f9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.00401ac9
jmp 0x409d52
xor esi, esi
mov dword [ebx + 0x10], esi
jmp 0x40a3f9