Function at 0x40eb32
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x50]
sub esp, 0xaec
mov eax, dword [ebp + 0x70]
mov ecx, dword [ebp + 0x7c]
push ebx
mov ebx, dword [ebp + 0x64]
push esi
xor esi, esi
cmp eax, esi
push edi
mov edi, dword [ebp + 0x5c]
jne 0x40eb55
lea eax, [ebp - 0x1c]
cmp ecx, esi
mov dword [ebp + 0x40], eax
mov dword [eax], esi
je 0x40eb69
push 1
push esi
push 0xffffffffffffffff
push esi
call fcn.0040161c
cmp edi, esi
je 0x40eea3
cmp byte [edi], 0
je 0x40eea3
push edi
call sub.MSVCR71.dll_strlen
cmp eax, 0x4001
pop ecx
mov dword [ebp + 0x24], eax
jb 0x40eba4
cmp byte [ebp + 0x68], 0
je 0x40f128
push 0x45282f
push str.String_too_long.__The_current_thread_will_exit.
jmp 0x40f120
inc eax
mov dword [ebp + 0x3c], eax
add eax, 3
and eax, 0xfffffffc
call fcn.0044ff40
test ebx, ebx
mov esi, esp
mov dword [ebp + 0x28], esi
je 0x40ebc5
cmp byte [ebx], 0
jne 0x40ebc5
and dword [ebp + 0x64], 0
mov eax, dword [ebp + 0x60]
test eax, eax
mov dword [ebp + 0x44], edi
mov dword [ebp + 0x48], eax
jne 0x40ebf5
push edi
push esi
mov dword [ebp + 0x48], 0x45282f
call sub.MSVCR71.dll_strcpy
cmp byte [esi], 0x22
pop ecx
pop ecx
jne 0x40ec61
inc esi
push 0x22
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
pop ecx
pop ecx
jmp 0x40ec6d
mov ebx, dword [sym.imp.MSVCR71.dll__stricmp]
push str.find
push edi
call ebx
test eax, eax
pop ecx
pop ecx
je 0x40ec58
push str.explore
push edi
call ebx
test eax, eax
pop ecx
pop ecx
je 0x40ec58
push str.open
push edi
call ebx
test eax, eax
pop ecx
pop ecx
je 0x40ec58
push str.edit
push edi
call ebx
test eax, eax
pop ecx
pop ecx
je 0x40ec58
push str.print
push edi
call ebx
test eax, eax
pop ecx
pop ecx
je 0x40ec58
push str.properties
push edi
call ebx
test eax, eax
pop ecx
pop ecx
je 0x40ec58
mov byte [ebp + 0x4f], 0
jmp 0x40ecee
mov byte [ebp + 0x4f], 1
jmp 0x40ecee
mov edi, 0x453ea4
mov eax, esi
call fcn.00438cc6
test eax, eax
je 0x40ec79
mov byte [eax], 0
lea edi, [eax + 1]
jmp 0x40ec7b
xor edi, edi
mov ebx, dword [sym.imp.MSVCR71.dll__stricmp]
push str.find
push esi
call ebx
test eax, eax
pop ecx
pop ecx
je 0x40ecd9
push str.explore
push esi
call ebx
test eax, eax
pop ecx
pop ecx
je 0x40ecd9
push str.open
push esi
call ebx
test eax, eax
pop ecx
pop ecx
je 0x40ecd9
push str.edit
push esi
call ebx
test eax, eax
pop ecx
pop ecx
je 0x40ecd9
push str.print
push esi
call ebx
test eax, eax
pop ecx
pop ecx
je 0x40ecd9
push str.properties
push esi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x40ec4f
test edi, edi
mov byte [ebp + 0x4f], 1
mov dword [ebp + 0x44], esi
mov dword [ebp + 0x48], edi
jne 0x40ecee
mov dword [ebp + 0x48], 0x45282f
push 0x7f
xor eax, eax
mov byte [ebp - 0x29c], 0
pop ecx
lea edi, [ebp - 0x29b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor esi, esi
cmp byte [ebp + 0x78], 0
mov byte [ebp + 0x4e], 0
stosb byte es:[edi], al
je 0x40ed5f
mov eax, dword [ebp + 0x58]
mov eax, dword [eax + 0x4d0]
cmp eax, esi
je 0x40ed5f
cmp word [eax], si
jne 0x40ed3c
mov eax, dword [ebp + 0x58]
mov ecx, dword [eax + 0x4d4]
cmp word [ecx], si
jne 0x40ed3c
mov eax, dword [eax + 0x4d8]
cmp word [eax], si
je 0x40ed5f
cmp byte [ebp + 0x4f], 0
mov byte [ebp + 0x7b], 1
je 0x40ed6d
cmp byte [ebp + 0x68], 0
je 0x40f128
push 0x45282f
push str.System_verbs_unsupported_with_RunAs.__The_current_thread_will_exit.
jmp 0x40f120
cmp byte [ebp + 0x4f], 0
mov byte [ebp + 0x7b], 0
jne 0x40eef1
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x5c]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0x6c]
inc eax
cmp ecx, esi
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], eax
je 0x40ed97
cmp byte [ecx], 0
je 0x40ed97
mov esi, ecx
call fcn.004167f6
xor esi, esi
mov word [ebp - 0x30], ax
xor eax, eax
mov dword [ebp + 0x2c], esi
lea edi, [ebp + 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x60]
cmp eax, esi
je 0x40ede4
cmp byte [eax], 0
je 0x40ede4
push eax
call sub.MSVCR71.dll_strlen
pop ecx
mov ecx, dword [ebp + 0x24]
lea eax, [eax + ecx + 0xa]
add eax, 3
and eax, 0xfffffffc
call fcn.0044ff40
mov edi, esp
push dword [ebp + 0x60]
push dword [ebp + 0x5c]
push str._s__s
push edi
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0x10
jmp 0x40edff
mov eax, dword [ebp + 0x3c]
add eax, 3
and eax, 0xfffffffc
call fcn.0044ff40
mov edi, esp
push dword [ebp + 0x5c]
push edi
call sub.MSVCR71.dll_strcpy
pop ecx
pop ecx
cmp byte [ebp + 0x7b], 0
je 0x40ee3c
lea eax, [ebp - 0x29c]
push eax
push dword [ebp + 0x40]
lea eax, [ebp + 0x4e]
push eax
lea eax, [ebp + 0x2c]
push eax
push dword [ebp + 0x7c]
push dword [ebp - 0x30]
push dword [ebp + 0x74]
push dword [ebp + 0x68]
push dword [ebp + 0x64]
push edi
push dword [ebp + 0x58]
call fcn.0040f12f
test eax, eax
jne 0x40eeca
jmp 0x40f128
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x60]
push eax
push dword [ebp + 0x64]
push esi
push esi
push esi
push esi
push esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40eeb6
cmp dword [ebp + 0x30], esi
je 0x40ee66
push dword [ebp + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x40]
mov dword [ecx], eax
mov eax, dword [ebp + 0x7c]
cmp eax, esi
je 0x40ee80
push 0x18
push esi
push dword [ebp + 0x34]
call fcn.004019da
cmp byte [ebp + 0x74], 0
je 0x40ee8e
mov eax, dword [0x45b170]
mov dword [eax + 0x30], esi
cmp dword [ebp + 0x70], esi
jne 0x40eea3
mov eax, dword [ebp + 0x40]
mov eax, dword [eax]
cmp eax, esi
je 0x40eea3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
lea esp, [ebp - 0xaa8]
pop edi
pop esi
pop ebx
add ebp, 0x50
leave
ret 0x28
push dword [ebp + 0x74]
mov eax, 0x200
lea edi, [ebp - 0x29c]
call fcn.00437e38
pop ecx
cmp byte [ebp + 0x4e], 0
jne 0x40ee80
cmp byte [ebp + 0x7b], 0
je 0x40eef1
cmp byte [ebp + 0x68], 0
je 0x40f128
lea eax, [ebp - 0x29c]
push eax
push str.Launch_Error__possibly_related_to_RunAs_.__The_current_thread_will_exit.
jmp 0x40f120
xor eax, eax
push 0xe
pop ecx
lea edi, [ebp - 0x14]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x64]
mov dword [ebp], eax
mov eax, dword [ebp + 0x6c]
cmp eax, esi
mov dword [ebp - 0x18], 0x3c
mov dword [ebp - 0x14], 0x440
je 0x40ef27
cmp byte [eax], 0
je 0x40ef27
mov esi, eax
call fcn.004167f6
mov dword [ebp + 4], eax
jmp 0x40ef2e
mov dword [ebp + 4], 1
cmp byte [ebp + 0x4f], 0
je 0x40ef5b
mov eax, dword [ebp + 0x44]
push str.properties
push eax
mov dword [ebp - 0xc], eax
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x40ef4c
or dword [ebp - 0x14], 0xc
mov eax, dword [ebp + 0x48]
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
jmp 0x40f05b
cmp dword [ebp + 0x60], 0
jne 0x40f043
push dword [ebp + 0x5c]
mov esi, dword [ebp + 0x28]
push esi
call sub.MSVCR71.dll_strcpy
pop ecx
pop ecx
mov eax, str..exe
mov ecx, esi
call fcn.004388e8
test eax, eax
jne 0x40f01b
mov eax, str..exe_
mov ecx, esi
call fcn.004388e8
test eax, eax
jne 0x40f01b
mov eax, str..bat
mov ecx, esi
call fcn.004388e8
test eax, eax
jne 0x40f01b
mov eax, str..bat_
mov ecx, esi
call fcn.004388e8
test eax, eax
jne 0x40f01b
mov eax, str..com
mov ecx, esi
call fcn.004388e8
test eax, eax
jne 0x40f01b
mov eax, str..com_
mov ecx, esi
call fcn.004388e8
test eax, eax
jne 0x40f01b
mov eax, str..cmd
mov ecx, esi
call fcn.004388e8
test eax, eax
jne 0x40f01b
mov eax, str..cmd_
mov ecx, esi
call fcn.004388e8
test eax, eax
jne 0x40f01b
mov eax, str..hta
mov ecx, esi
call fcn.004388e8
test eax, eax
jne 0x40f01b
mov eax, str..hta_
mov ecx, esi
call fcn.004388e8
test eax, eax
je 0x40f043
lea ebx, [eax + 4]
cmp byte [ebx], 0x22
mov dword [ebp + 0x44], esi
mov dword [ebp + 0x48], ebx
jne 0x40f02d
inc ebx
mov dword [ebp + 0x48], ebx
cmp byte [ebx], 0
je 0x40f046
mov byte [ebx], 0
inc ebx
or eax, 0xffffffff
mov dword [ebp + 0x48], ebx
call fcn.0040a344
jmp 0x40f046
mov ebx, dword [ebp + 0x48]
mov eax, dword [ebp + 0x44]
and dword [ebp - 0xc], 0
mov dword [ebp - 8], eax
mov al, byte [ebx]
neg al
sbb eax, eax
and eax, ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40f078
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x40]
mov dword [ecx], eax
xor esi, esi
jmp 0x40ee80
push dword [ebp + 0x74]
mov eax, 0x200
lea edi, [ebp - 0x29c]
call fcn.00437e38
cmp byte [ebp + 0x68], 0
pop ecx
je 0x40f128
cmp byte [ebp + 0x4f], 0
je 0x40f0b8
push dword [ebp + 0x44]
mov esi, 0x80
push str._nVerb:___s_
lea edi, [ebp - 0x9c]
call fcn.0040a3cc
pop ecx
pop ecx
jmp 0x40f0bf
mov byte [ebp - 0x9c], 0
push dword [ebp + 0x48]
call sub.MSVCR71.dll_strlen
mov esi, 0x190
cmp eax, esi
mov edi, 0x4564f8
pop ecx
mov ebx, edi
ja 0x40f0dd
mov ebx, 0x45282f
push dword [ebp + 0x44]
call sub.MSVCR71.dll_strlen
cmp eax, esi
pop ecx
ja 0x40f0ef
mov edi, 0x45282f
push ebx
push dword [ebp + 0x48]
lea eax, [ebp - 0x9c]
push eax
push edi
push dword [ebp + 0x44]
mov esi, 0x800
push str.Failed_attempt_to_launch_program_or_document:_nAction:____0.400s_s__s_nParams:____0.400s_s__n_nThe_current_thread_will_exit.
lea edi, [ebp - 0xa9c]
call fcn.0040a3cc
add esp, 0x18
lea eax, [ebp - 0x29c]
push eax
mov eax, edi
push eax
mov ecx, dword [ebp + 0x58]
call fcn.0044506b
xor eax, eax
jmp 0x40eea6