Function at 0x428fc0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b278
mov eax, dword fs:[0]
push eax
sub esp, 0x88
push ebx
push esi
push edi
mov eax, dword [0x5d7ce0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.Wow64DisableWow64FsRedirection
xor ebx, ebx
push str.kernel32
mov dword [ebp - 0x34], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x38], eax
cmp eax, ebx
je 0x429014
lea ecx, [ebp - 0x34]
push ecx
call eax
mov dword [ebp - 4], ebx
call fcn.0044d418
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x429031
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
call fcn.0044d418
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x42905e
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x24], eax
push 1
lea ecx, [ebp - 0x18]
push ecx
push ecx
mov byte [ebp - 4], 2
mov esi, esp
mov dword [ebp - 0x30], esp
mov dword [ebp - 0x30], esi
call fcn.0044d418
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x42909a
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov ecx, str.strActiveXPath
mov byte [ebp - 4], 3
test ecx, 0xffff0000
jne 0x4290d3
mov edx, ecx
movzx edi, dx
push edi
call fcn.0044d834
cmp eax, ebx
je 0x4290e1
push edi
push eax
mov ecx, esi
call fcn.004074b0
jmp 0x4290e1
push 0xe
push str.strActiveXPath
mov ecx, esi
call fcn.00407870
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
push eax
mov byte [ebp - 4], 2
call fcn.0043b9d0
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x429193
mov ecx, 0xa0000001
lea esi, [ebp - 0x28]
call fcn.0041ae20
push eax
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.0040d290
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42913b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
mov dword [ecx], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x429167
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429895
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x429895
push 1
lea ecx, [ebp - 0x24]
push ecx
push ecx
mov esi, esp
mov dword [ebp - 0x30], esp
mov dword [ebp - 0x30], esi
call fcn.0044d418
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4291bc
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov ecx, str.iSystemBits
mov byte [ebp - 4], 5
test ecx, 0xffff0000
jne 0x4291f5
mov edx, ecx
movzx edi, dx
push edi
call fcn.0044d834
test eax, eax
je 0x429203
push edi
push eax
mov ecx, esi
call fcn.004074b0
jmp 0x429203
push 0xb
push str.iSystemBits
mov ecx, esi
call fcn.00407870
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
push eax
mov byte [ebp - 4], 2
call fcn.0043b9d0
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x4292b5
mov ecx, 0xa0000001
lea esi, [ebp - 0x28]
call fcn.0041ae20
push eax
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.0040d290
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42925d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
mov dword [ecx], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x429289
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429895
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x429895
mov edi, dword [ebp - 0x24]
push edi
call fcn.0054df0d
add esp, 4
cmp dword [0x5d9fb8], 0
mov esi, eax
je 0x429311
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x429307
lea ecx, [ebp - 0x74]
push ecx
call eax
mov ax, word [ebp - 0x74]
cmp ax, 9
je 0x4292fd
cmp ax, 6
jne 0x429307
mov dword [0x5e0c44], 1
mov dword [0x5d9fb8], 0
test esi, esi
je 0x429323
cmp esi, 1
jne 0x42933d
cmp dword [0x5e0c44], 0
jne 0x42934b
call fcn.0044d418
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x42939e
push 0x80004005
call fcn.00407ad0
cmp esi, 2
jne 0x42934b
cmp dword [0x5e0c44], 0
jne 0x429323
lea eax, [edi - 0x10]
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x429372
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429895
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x429895
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 7
call fcn.0044d418
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4293cb
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 8
mov ebx, dword [ebp - 0x18]
push ecx
mov dword [ebp - 0x30], esp
mov ecx, dword [ebx - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add ebx, 0xfffffff0
mov edi, esp
call eax
cmp dword [ebx + 0xc], 0
lea edx, [ebx + 0xc]
jl 0x42940e
cmp eax, dword [ebx]
jne 0x42940e
mov esi, ebx
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x42944a
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
jne 0x429427
call fcn.0043d450
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebx + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.0054de82
add esp, 0x10
add esi, 0x10
mov dword [edi], esi
lea esi, [ebp - 0x30]
call fcn.0044a6f0
add esp, 4
push eax
mov byte [ebp - 4], 9
push ecx
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x14], esp
mov edi, esp
call eax
cmp dword [ebx + 0xc], 0
lea edx, [ebx + 0xc]
jl 0x429488
cmp eax, dword [ebx]
jne 0x429488
mov esi, ebx
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4294c4
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
jne 0x4294a1
call fcn.0043d450
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebx + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.0054de82
add esp, 0x10
add esi, 0x10
mov dword [edi], esi
lea esi, [ebp - 0x2c]
call fcn.0044a7b0
add esp, 4
push eax
lea edx, [ebp - 0x28]
push edx
mov byte [ebp - 4], 0xa
call fcn.004135f0
add esp, 0xc
mov byte [ebp - 4], 0xb
mov eax, dword [eax]
mov edi, dword [ebp - 0x1c]
lea esi, [eax - 0x10]
add edi, 0xfffffff0
cmp esi, edi
je 0x4295a3
cmp dword [edi + 0xc], 0
jl 0x429596
mov ecx, dword [esi]
cmp ecx, dword [edi]
jne 0x429596
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x429532
cmp eax, dword [esi]
jne 0x429532
mov dword [ebp - 0x14], esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x429572
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x42954c
call fcn.0043d450
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], eax
mov eax, dword [esi + 4]
lea edx, [eax + eax + 2]
push edx
add esi, 0x10
push esi
lea eax, [eax + eax + 2]
push eax
add ecx, 0x10
push ecx
call fcn.0054de82
add esp, 0x10
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42958b
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
mov dword [ebp - 0x1c], ecx
jmp 0x4295a3
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.00407870
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4295c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4295e9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42960c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x30], esp
mov edi, esp
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x429635
cmp eax, dword [ebx]
jne 0x429635
mov esi, ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x429671
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
jne 0x42964e
call fcn.0043d450
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebx + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.0054de82
add esp, 0x10
add esi, 0x10
mov dword [edi], esi
call fcn.0044aaa0
add esp, 4
test eax, eax
je 0x4297e4
xor edi, edi
push 0x40
xor eax, eax
lea edx, [ebp - 0x90]
push edi
push edx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
call fcn.00550f40
xor eax, eax
add esp, 0xc
mov word [ebp - 0x64], ax
mov dword [ebp - 0x94], 0x44
mov dword [ebp - 0x68], 0x81
mov eax, str._u__s
cmp dword [ebp + 0x18], edi
jne 0x4296d1
mov eax, 0x5ae914
mov ecx, dword [ebp - 0x18]
push ecx
push eax
lea edx, [ebp - 0x20]
push str.regsvr32.exe__s___s_
push edx
call fcn.00409220
mov eax, dword [ebp - 0x20]
add esp, 0x10
cmp dword [eax - 4], 1
jle 0x4296ff
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x20]
call fcn.004076d0
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x94]
push edx
push edi
push edi
push edi
push edi
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x4297da
mov eax, dword [ebp - 0x48]
push 0x4e20
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x429759
mov edx, dword [ebp - 0x48]
lea ecx, [ebp - 0x28]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor eax, eax
cmp dword [ebp - 0x28], edi
mov esi, 0xa0000004
sete al
mov dword [ebp - 0x14], eax
jmp 0x42976c
mov ecx, dword [ebp - 0x48]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x14], edi
mov esi, 0xa0000003
mov edx, dword [ebp - 0x48]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [ebp - 0x44]
push eax
call edi
cmp dword [ebp - 0x14], 0
jne 0x4297f2
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x10]
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
mov ecx, esi
lea esi, [ebp - 0x28]
call fcn.0041ae20
mov edx, dword [ebp + 0x14]
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x1c]
mov eax, dword [edi + 0x2c]
push ecx
push esi
push eax
push edx
call fcn.00409220
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429812
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x429812
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x429784
mov esi, 2
mov dword [ebp - 0x14], 0
jmp 0x429784
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0x1c]
mov dword [ecx], 2
mov eax, dword [edx + 0x30]
push esi
push eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.00409220
add esp, 0xc
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429835
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429855
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429878
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429895
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x38], 0
je 0x4298c3
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4298c3
mov ecx, dword [ebp - 0x34]
push ecx
call eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret