Function at 0x40d321
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x54]
sub esp, 0xab4
mov eax, dword [ebp + 0x70]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
mov dword [ebp + 0x44], ecx
jne 0x40d33e
lea eax, [ebp + 0x20]
mov ecx, dword [ebp + 0x7c]
cmp ecx, ebx
mov dword [ebp + 0x40], eax
mov dword [eax], ebx
je 0x40d355
push 1
push ebx
push 0xffffffffffffffff
push ebx
call fcn.00401525
mov edi, dword [ebp + 0x5c]
cmp edi, ebx
je 0x40d880
cmp byte [edi], bl
je 0x40d880
push edi
call fcn.00453b00
cmp eax, 0x4001
pop ecx
mov dword [ebp + 0x28], eax
jb 0x40d391
cmp byte [ebp + 0x68], bl
je 0x40d944
push 0x4565d8
push str.String_too_long.__The_current_thread_will_exit.
jmp 0x40d93c
inc eax
mov dword [ebp + 0x24], eax
add eax, 3
and eax, 0xfffffffc
call fcn.004540a0
mov eax, dword [ebp + 0x64]
cmp eax, ebx
mov esi, esp
je 0x40d3b0
cmp byte [eax], bl
jne 0x40d3b0
mov dword [ebp + 0x64], ebx
mov eax, dword [ebp + 0x60]
cmp eax, ebx
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x4c], eax
jne 0x40d3e6
push edi
push esi
mov dword [ebp + 0x4c], 0x4565d8
call fcn.004538d0
cmp byte [esi], 0x22
pop ecx
pop ecx
jne 0x40d45d
lea edi, [esi + 1]
push 0x22
push edi
call fcn.00453c30
jmp 0x40d46a
push str.find
push edi
call fcn.00441849
test eax, eax
pop ecx
pop ecx
je 0x40d454
push str.explore
push edi
call fcn.00441849
test eax, eax
pop ecx
pop ecx
je 0x40d454
push str.open
push edi
call fcn.00441849
test eax, eax
pop ecx
pop ecx
je 0x40d454
push str.edit
push edi
call fcn.00441849
test eax, eax
pop ecx
pop ecx
je 0x40d454
push str.print
push edi
call fcn.00441849
test eax, eax
pop ecx
pop ecx
je 0x40d454
push str.properties
push edi
call fcn.00441849
test eax, eax
pop ecx
pop ecx
je 0x40d454
mov byte [ebp + 0x53], bl
jmp 0x40d5e2
mov byte [ebp + 0x53], 1
jmp 0x40d5e2
push 0x457bf0
push esi
mov edi, esi
call fcn.00438ef0
cmp eax, ebx
pop ecx
pop ecx
je 0x40d478
mov byte [eax], bl
inc eax
mov dword [ebp + 0x3c], eax
jmp 0x40d47b
mov dword [ebp + 0x3c], ebx
push str.find
push edi
call fcn.00441849
test eax, eax
pop ecx
pop ecx
je 0x40d64c
push str.explore
push edi
call fcn.00441849
test eax, eax
pop ecx
pop ecx
je 0x40d64c
push str.open
push edi
call fcn.00441849
test eax, eax
pop ecx
pop ecx
je 0x40d64c
push str.edit
push edi
call fcn.00441849
test eax, eax
pop ecx
pop ecx
je 0x40d64c
push str.print
push edi
call fcn.00441849
test eax, eax
pop ecx
pop ecx
je 0x40d64c
push str.properties
push edi
call fcn.00441849
test eax, eax
pop ecx
pop ecx
je 0x40d64c
push dword [ebp + 0x5c]
mov byte [ebp + 0x53], bl
push esi
call fcn.004538d0
push str..exe
push esi
call fcn.00438b16
add esp, 0x10
cmp eax, ebx
jne 0x40d5b8
push str..exe_
push esi
call fcn.00438b16
cmp eax, ebx
pop ecx
pop ecx
jne 0x40d5b8
push str..bat
push esi
call fcn.00438b16
cmp eax, ebx
pop ecx
pop ecx
jne 0x40d5b8
push str..bat_
push esi
call fcn.00438b16
cmp eax, ebx
pop ecx
pop ecx
jne 0x40d5b8
push str..com
push esi
call fcn.00438b16
cmp eax, ebx
pop ecx
pop ecx
jne 0x40d5b8
push str..com_
push esi
call fcn.00438b16
cmp eax, ebx
pop ecx
pop ecx
jne 0x40d5b8
push str..cmd
push esi
call fcn.00438b16
cmp eax, ebx
pop ecx
pop ecx
jne 0x40d5b8
push str..cmd_
push esi
call fcn.00438b16
cmp eax, ebx
pop ecx
pop ecx
jne 0x40d5b8
push str..hta
push esi
call fcn.00438b16
cmp eax, ebx
pop ecx
pop ecx
jne 0x40d5b8
push str..hta_
push esi
call fcn.00438b16
cmp eax, ebx
pop ecx
pop ecx
je 0x40d5e2
add eax, 4
cmp byte [eax], 0x22
mov dword [ebp + 0x48], esi
mov dword [ebp + 0x4c], eax
jne 0x40d5ca
inc eax
mov dword [ebp + 0x4c], eax
cmp byte [eax], bl
je 0x40d5e2
mov eax, dword [ebp + 0x4c]
inc dword [ebp + 0x4c]
push 0xffffffffffffffff
push dword [ebp + 0x4c]
mov byte [eax], bl
call fcn.0040a90c
pop ecx
pop ecx
mov edx, dword [ebp + 0x6c]
push 0x7f
xor eax, eax
cmp byte [ebp + 0x78], bl
mov byte [ebp - 0x260], bl
pop ecx
lea edi, [ebp - 0x25f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [ebp + 0x52], bl
stosb byte es:[edi], al
je 0x40d66b
mov ecx, dword [ebp + 0x44]
mov eax, dword [ecx + 0x4d0]
cmp eax, ebx
je 0x40d66b
cmp word [eax], bx
jne 0x40d62b
mov eax, dword [ecx + 0x4d4]
cmp word [eax], bx
jne 0x40d62b
mov eax, dword [ecx + 0x4d8]
cmp word [eax], bx
je 0x40d66b
cmp byte [ebp + 0x53], bl
mov byte [ebp + 0x7b], 1
je 0x40d677
cmp byte [ebp + 0x68], bl
je 0x40d944
push 0x4565d8
push str.System_verbs_unsupported_with_RunAs.__The_current_thread_will_exit.
jmp 0x40d93f
mov eax, dword [ebp + 0x3c]
cmp eax, ebx
mov byte [ebp + 0x53], 1
mov dword [ebp + 0x48], edi
je 0x40d65f
mov dword [ebp + 0x4c], eax
jmp 0x40d5e2
mov dword [ebp + 0x4c], 0x4565d8
jmp 0x40d5e2
cmp byte [ebp + 0x53], bl
mov byte [ebp + 0x7b], bl
jne 0x40d7cb
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
inc eax
cmp edx, ebx
mov dword [ebp - 0x24], 0x44
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 8], eax
je 0x40d6a7
cmp byte [edx], bl
je 0x40d6a7
push edx
call fcn.00414fab
pop ecx
mov word [ebp + 0xc], ax
xor eax, eax
mov dword [ebp + 0x2c], ebx
lea edi, [ebp + 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x60]
cmp eax, ebx
je 0x40d6f2
cmp byte [eax], bl
je 0x40d6f2
push eax
call fcn.00453b00
pop ecx
mov ecx, dword [ebp + 0x28]
lea eax, [eax + ecx + 0xa]
add eax, 3
and eax, 0xfffffffc
call fcn.004540a0
mov esi, esp
push dword [ebp + 0x60]
push dword [ebp + 0x5c]
push str._s__s
push esi
call fcn.0044118f
add esp, 0x10
jmp 0x40d70d
mov eax, dword [ebp + 0x24]
add eax, 3
and eax, 0xfffffffc
call fcn.004540a0
mov esi, esp
push dword [ebp + 0x5c]
push esi
call fcn.004538d0
pop ecx
pop ecx
cmp byte [ebp + 0x7b], bl
je 0x40d745
mov ecx, dword [ebp + 0x44]
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 0x40]
lea eax, [ebp + 0x52]
push eax
lea eax, [ebp + 0x2c]
push eax
push dword [ebp + 0x7c]
push dword [ebp + 0xc]
push dword [ebp + 0x74]
push dword [ebp + 0x68]
push dword [ebp + 0x64]
push esi
call fcn.0040d94b
test eax, eax
jne 0x40d7a3
jmp 0x40d944
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0x64]
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x40d78c
cmp dword [ebp + 0x30], ebx
mov byte [ebp + 0x52], 1
je 0x40d773
push dword [ebp + 0x30]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp + 0x40]
mov eax, dword [ebp + 0x2c]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x7c]
cmp ecx, ebx
je 0x40d7a3
push dword [ebp + 0x34]
call fcn.0040188b
jmp 0x40d7a3
push dword [ebp + 0x74]
lea eax, [ebp - 0x260]
push 0x200
push eax
call fcn.0043808d
add esp, 0xc
cmp byte [ebp + 0x52], bl
jne 0x40d860
cmp byte [ebp + 0x7b], bl
je 0x40d7cb
cmp byte [ebp + 0x68], bl
je 0x40d944
lea eax, [ebp - 0x260]
push eax
push str.Launch_Error__possibly_related_to_RunAs_.__The_current_thread_will_exit.
jmp 0x40d93c
xor eax, eax
push 0xe
pop ecx
lea edi, [ebp - 0x18]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x64]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x6c]
cmp eax, ebx
mov dword [ebp - 0x1c], 0x3c
mov dword [ebp - 0x18], 0x440
je 0x40d800
cmp byte [eax], bl
je 0x40d800
push eax
call fcn.00414fab
pop ecx
mov dword [ebp], eax
jmp 0x40d807
mov dword [ebp], 1
cmp byte [ebp + 0x53], bl
mov esi, dword [ebp + 0x48]
je 0x40d832
push str.properties
push esi
mov dword [ebp - 0x10], esi
call fcn.00441849
test eax, eax
pop ecx
pop ecx
jne 0x40d827
or dword [ebp - 0x18], 0xc
mov eax, dword [ebp + 0x4c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ebx
jmp 0x40d846
mov eax, dword [ebp + 0x4c]
mov cl, byte [eax]
neg cl
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], esi
sbb ecx, ecx
and ecx, eax
mov dword [ebp - 8], ecx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40d893
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x40]
mov dword [ecx], eax
mov byte [ebp + 0x52], 1
cmp byte [ebp + 0x74], bl
je 0x40d86b
mov dword [0x463248], ebx
cmp dword [ebp + 0x70], ebx
jne 0x40d880
mov eax, dword [ebp + 0x40]
mov eax, dword [eax]
cmp eax, ebx
je 0x40d880
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
inc eax
lea esp, [ebp - 0xa6c]
pop edi
pop esi
pop ebx
add ebp, 0x54
leave
ret 0x24
push dword [ebp + 0x74]
lea eax, [ebp - 0x260]
push 0x200
push eax
call fcn.0043808d
add esp, 0xc
cmp byte [ebp + 0x52], bl
jne 0x40d860
cmp byte [ebp + 0x68], bl
je 0x40d944
cmp byte [ebp + 0x53], bl
je 0x40d8d6
push esi
push str._nVerb:___s_
lea eax, [ebp - 0x60]
push 0x80
push eax
call fcn.0040a9c1
add esp, 0x10
jmp 0x40d8d9
mov byte [ebp - 0x60], bl
push dword [ebp + 0x4c]
call fcn.00453b00
mov esi, 0x190
cmp eax, esi
mov edi, 0x4580a8
pop ecx
mov ebx, edi
ja 0x40d8f7
mov ebx, 0x4565d8
push dword [ebp + 0x48]
call fcn.00453b00
cmp eax, esi
pop ecx
ja 0x40d909
mov edi, 0x4565d8
push ebx
push dword [ebp + 0x4c]
lea eax, [ebp - 0x60]
push eax
push edi
push dword [ebp + 0x48]
lea eax, [ebp - 0xa60]
push str.Failed_attempt_to_launch_program_or_document:_nAction:____0.400s_s__s_nParams:____0.400s_s__n_nThe_current_thread_will_exit.
push 0x800
push eax
call fcn.0040a9c1
add esp, 0x20
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0xa60]
push eax
mov ecx, dword [ebp + 0x44]
call fcn.0044a877
xor eax, eax
jmp 0x40d883