Function at 0x40efde
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x54]
sub esp, 0xab4
mov eax, dword [ebp + 0x70]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
mov dword [ebp + 0x48], ecx
jne 0x40effb
lea eax, [ebp + 0x20]
mov ecx, dword [ebp + 0x7c]
cmp ecx, ebx
mov dword [ebp + 0x40], eax
mov dword [eax], ebx
je 0x40f012
push 1
push ebx
push 0xffffffffffffffff
push ebx
call fcn.0040184e
mov edi, dword [ebp + 0x5c]
cmp edi, ebx
je 0x40f524
cmp byte [edi], bl
je 0x40f524
push edi
call fcn.00457cb0
cmp eax, 0x4001
pop ecx
mov dword [ebp + 0x3c], eax
jb 0x40f04e
cmp byte [ebp + 0x68], bl
je 0x40f5e8
push 0x45a5d8
push str.String_too_long.__The_current_thread_will_exit.
jmp 0x40f5e0
inc eax
mov dword [ebp + 0x28], eax
add eax, 3
and eax, 0xfffffffc
call fcn.00458250
mov eax, dword [ebp + 0x64]
cmp eax, ebx
mov esi, esp
mov dword [ebp + 0x24], esi
je 0x40f070
cmp byte [eax], bl
jne 0x40f070
mov dword [ebp + 0x64], ebx
mov eax, dword [ebp + 0x60]
cmp eax, ebx
mov dword [ebp + 0x44], edi
mov dword [ebp + 0x4c], eax
jne 0x40f0a4
push edi
push esi
mov dword [ebp + 0x4c], 0x45a5d8
call fcn.00457a80
cmp byte [esi], 0x22
pop ecx
pop ecx
jne 0x40f11b
inc esi
push 0x22
push esi
call fcn.00457de0
jmp 0x40f126
push str.find
push edi
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x40f112
push str.explore
push edi
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x40f112
push str.open
push edi
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x40f112
push str.edit
push edi
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x40f112
push 0x45d3e0
push edi
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x40f112
push str.properties
push edi
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x40f112
mov byte [ebp + 0x53], bl
jmp 0x40f1b4
mov byte [ebp + 0x53], 1
jmp 0x40f1b4
push 0x45bc18
push esi
call fcn.00439b0d
cmp eax, ebx
pop ecx
pop ecx
je 0x40f133
mov byte [eax], bl
lea edi, [eax + 1]
jmp 0x40f135
xor edi, edi
push str.find
push esi
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x40f19f
push str.explore
push esi
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x40f19f
push str.open
push esi
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x40f19f
push str.edit
push esi
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x40f19f
push 0x45d3e0
push esi
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x40f19f
push str.properties
push esi
call fcn.00442502
test eax, eax
pop ecx
pop ecx
jne 0x40f10a
cmp edi, ebx
mov byte [ebp + 0x53], 1
mov dword [ebp + 0x44], esi
mov dword [ebp + 0x4c], edi
jne 0x40f1b4
mov dword [ebp + 0x4c], 0x45a5d8
mov edx, dword [ebp + 0x6c]
push 0x7f
xor eax, eax
cmp byte [ebp + 0x78], bl
mov byte [ebp - 0x260], bl
pop ecx
lea edi, [ebp - 0x25f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [ebp + 0x52], bl
stosb byte es:[edi], al
je 0x40f21e
mov ecx, dword [ebp + 0x48]
mov eax, dword [ecx + 0x4d0]
cmp eax, ebx
je 0x40f21e
cmp word [eax], bx
jne 0x40f1fd
mov eax, dword [ecx + 0x4d4]
cmp word [eax], bx
jne 0x40f1fd
mov eax, dword [ecx + 0x4d8]
cmp word [eax], bx
je 0x40f21e
cmp byte [ebp + 0x53], bl
mov byte [ebp + 0x7b], 1
je 0x40f22a
cmp byte [ebp + 0x68], bl
je 0x40f5e8
push 0x45a5d8
push str.System_verbs_unsupported_with_RunAs.__The_current_thread_will_exit.
jmp 0x40f5e0
cmp byte [ebp + 0x53], bl
mov byte [ebp + 0x7b], bl
jne 0x40f377
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
inc eax
cmp edx, ebx
mov dword [ebp - 0x24], 0x44
mov dword [ebp + 8], eax
je 0x40f250
cmp byte [edx], bl
je 0x40f250
push dword [ebp + 0x6c]
call fcn.0041704d
pop ecx
mov word [ebp + 0xc], ax
xor eax, eax
mov dword [ebp + 0x2c], ebx
lea edi, [ebp + 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x60]
cmp eax, ebx
je 0x40f29b
cmp byte [eax], bl
je 0x40f29b
push eax
call fcn.00457cb0
pop ecx
mov ecx, dword [ebp + 0x3c]
lea eax, [eax + ecx + 0xa]
add eax, 3
and eax, 0xfffffffc
call fcn.00458250
mov esi, esp
push dword [ebp + 0x60]
push dword [ebp + 0x5c]
push str._s__s
push esi
call fcn.0040a7af
add esp, 0x10
jmp 0x40f2b6
mov eax, dword [ebp + 0x28]
add eax, 3
and eax, 0xfffffffc
call fcn.00458250
mov esi, esp
push dword [ebp + 0x5c]
push esi
call fcn.00457a80
pop ecx
pop ecx
cmp byte [ebp + 0x7b], bl
je 0x40f2ee
mov ecx, dword [ebp + 0x48]
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 0x40]
lea eax, [ebp + 0x52]
push eax
lea eax, [ebp + 0x2c]
push eax
push dword [ebp + 0x7c]
push dword [ebp + 0xc]
push dword [ebp + 0x74]
push dword [ebp + 0x68]
push dword [ebp + 0x64]
push esi
call fcn.0040f5ef
test eax, eax
jne 0x40f34f
jmp 0x40f5e8
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0x64]
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40f338
cmp dword [ebp + 0x30], ebx
mov byte [ebp + 0x52], 1
je 0x40f31c
push dword [ebp + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x2c]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x7c]
cmp ecx, ebx
je 0x40f34f
push 0x18
push ebx
push dword [ebp + 0x34]
call fcn.00401c1f
jmp 0x40f34f
push dword [ebp + 0x74]
lea eax, [ebp - 0x260]
push 0x200
push eax
call fcn.00438c5a
add esp, 0xc
cmp byte [ebp + 0x52], bl
jne 0x40f502
cmp byte [ebp + 0x7b], bl
je 0x40f377
cmp byte [ebp + 0x68], bl
je 0x40f5e8
lea eax, [ebp - 0x260]
push eax
push str.Launch_Error__possibly_related_to_RunAs_.__The_current_thread_will_exit.
jmp 0x40f5e0
xor eax, eax
push 0xe
pop ecx
lea edi, [ebp - 0x18]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x64]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x6c]
cmp eax, ebx
mov dword [ebp - 0x1c], 0x3c
mov dword [ebp - 0x18], 0x440
je 0x40f3ac
cmp byte [eax], bl
je 0x40f3ac
push eax
call fcn.0041704d
pop ecx
mov dword [ebp], eax
jmp 0x40f3b3
mov dword [ebp], 1
cmp byte [ebp + 0x53], bl
je 0x40f3e1
mov edi, dword [ebp + 0x44]
push str.properties
push edi
mov dword [ebp - 0x10], edi
call fcn.00442502
test eax, eax
pop ecx
pop ecx
jne 0x40f3d3
or dword [ebp - 0x18], 0xc
mov eax, dword [ebp + 0x4c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ebx
jmp 0x40f4e8
cmp dword [ebp + 0x60], ebx
jne 0x40f4d1
push dword [ebp + 0x5c]
mov esi, dword [ebp + 0x24]
push esi
call fcn.00457a80
push str..exe
push esi
call fcn.00439733
add esp, 0x10
cmp eax, ebx
jne 0x40f4a9
push str..exe_
push esi
call fcn.00439733
cmp eax, ebx
pop ecx
pop ecx
jne 0x40f4a9
push str..bat
push esi
call fcn.00439733
cmp eax, ebx
pop ecx
pop ecx
jne 0x40f4a9
push str..bat_
push esi
call fcn.00439733
cmp eax, ebx
pop ecx
pop ecx
jne 0x40f4a9
push str..com
push esi
call fcn.00439733
cmp eax, ebx
pop ecx
pop ecx
jne 0x40f4a9
push str..com_
push esi
call fcn.00439733
cmp eax, ebx
pop ecx
pop ecx
jne 0x40f4a9
push str..cmd
push esi
call fcn.00439733
cmp eax, ebx
pop ecx
pop ecx
jne 0x40f4a9
push str..cmd_
push esi
call fcn.00439733
cmp eax, ebx
pop ecx
pop ecx
jne 0x40f4a9
push str..hta
push esi
call fcn.00439733
cmp eax, ebx
pop ecx
pop ecx
jne 0x40f4a9
push str..hta_
push esi
call fcn.00439733
cmp eax, ebx
pop ecx
pop ecx
je 0x40f4d1
mov dword [ebp + 0x44], esi
lea esi, [eax + 4]
cmp byte [esi], 0x22
mov dword [ebp + 0x4c], esi
jne 0x40f4bb
inc esi
mov dword [ebp + 0x4c], esi
cmp byte [esi], bl
je 0x40f4d4
mov byte [esi], bl
inc esi
push 0xffffffffffffffff
push esi
mov dword [ebp + 0x4c], esi
call fcn.0040a61e
pop ecx
pop ecx
jmp 0x40f4d4
mov esi, dword [ebp + 0x4c]
mov edi, dword [ebp + 0x44]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], edi
mov al, byte [esi]
neg al
sbb eax, eax
and eax, esi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40f537
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x40]
mov dword [ecx], eax
mov byte [ebp + 0x52], 1
cmp byte [ebp + 0x74], bl
je 0x40f50f
mov eax, dword [0x465108]
mov dword [eax + 0x30], ebx
cmp dword [ebp + 0x70], ebx
jne 0x40f524
mov eax, dword [ebp + 0x40]
mov eax, dword [eax]
cmp eax, ebx
je 0x40f524
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
lea esp, [ebp - 0xa6c]
pop edi
pop esi
pop ebx
add ebp, 0x54
leave
ret 0x24
push dword [ebp + 0x74]
lea eax, [ebp - 0x260]
push 0x200
push eax
call fcn.00438c5a
add esp, 0xc
cmp byte [ebp + 0x52], bl
jne 0x40f502
cmp byte [ebp + 0x68], bl
je 0x40f5e8
cmp byte [ebp + 0x53], bl
je 0x40f57a
push edi
push str._nVerb:___s_
lea eax, [ebp - 0x60]
push 0x80
push eax
call fcn.0040a6d3
add esp, 0x10
jmp 0x40f57d
mov byte [ebp - 0x60], bl
push dword [ebp + 0x4c]
call fcn.00457cb0
mov esi, 0x190
cmp eax, esi
mov edi, 0x45c0e0
pop ecx
mov ebx, edi
ja 0x40f59b
mov ebx, 0x45a5d8
push dword [ebp + 0x44]
call fcn.00457cb0
cmp eax, esi
pop ecx
ja 0x40f5ad
mov edi, 0x45a5d8
push ebx
push dword [ebp + 0x4c]
lea eax, [ebp - 0x60]
push eax
push edi
push dword [ebp + 0x44]
lea eax, [ebp - 0xa60]
push str.Failed_attempt_to_launch_program_or_document:_nAction:____0.400s_s__s_nParams:____0.400s_s__n_nThe_current_thread_will_exit.
push 0x800
push eax
call fcn.0040a6d3
add esp, 0x20
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0xa60]
push eax
mov ecx, dword [ebp + 0x48]
call fcn.0044c37d
xor eax, eax
jmp 0x40f527