Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push 0
push 0
push 0
lea ecx, [ebp - 0x50]
call fcn.00403fe0
push 0
push 0
push 0
lea ecx, [ebp - 0x30]
call fcn.00403fe0
mov eax, 0x374
mov word [ebp - 0xb4], ax
mov cx, word [ebp - 0xb4]
mov word [ebp - 0xf0], cx
mov dword [ebp - 0x10c], 0xd502
mov edx, dword [ebp - 0x10c]
mov dword [ebp - 0x11c], edx
cmp dword [ebp - 0x11c], 0xa4cc
je 0x401063
jmp 0x401098
mov byte [ebp + 8], 0x23
movzx eax, word [ebp - 0xb4]
and eax, 0xcb7
mov word [ebp - 0xf0], ax
push 0x36
mov ecx, dword [ebp - 0xe4]
push ecx
mov edx, dword [ebp - 0xac]
push edx
call dword [sym.imp.SHELL32.dll_ExtractIconA]
mov dword [ebp - 0x20], eax
jmp 0x401756
mov eax, 0xc6
mov word [ebp - 0x108], ax
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x10c]
mov dword [ebp - 0xb0], edx
mov byte [ebp - 0xe9], 0x44
lea eax, [ebp - 0xe9]
mov dword [ebp - 0xbc], eax
mov ecx, dword [ebp - 0xbc]
movzx edx, byte [ecx]
imul edx, edx, 0xd0
movzx eax, byte [ebp - 0xe9]
cmp edx, eax
jl 0x401140
mov cl, byte [ebp + 8]
mov byte [ebp - 0xe], cl
lea edx, [ebp - 0x108]
mov dword [ebp - 0x98], edx
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xc5], al
mov ecx, dword [section..data]
mov dword [ebp - 0x118], ecx
lea edx, [ebp - 0xb0]
mov dword [ebp - 0x114], edx
mov ax, word [ebp - 0xb4]
mov word [ebp - 0xcc], ax
mov ecx, dword [ebp - 0xbc]
mov dl, byte [ecx]
mov byte [ebp - 0x15], dl
lea eax, [ebp - 0x118]
mov dword [ebp - 0x100], eax
jmp 0x40115d
mov ecx, dword [ebp - 0x114]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb0]
shr edx, cl
mov eax, dword [ebp - 0x114]
mov dword [eax], edx
call fcn.00403410
mov ecx, dword [ebp - 0x118]
mov dword [ebp - 0x120], ecx
cmp dword [ebp - 0x120], 0x8331
je 0x401177
jmp 0x401199
mov edx, dword [ebp - 0x118]
mov dword [ebp - 8], edx
lea eax, [ebp - 0xf0]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xbc]
mov dl, byte [ecx]
mov byte [ebp - 0xbd], dl
jmp 0x4011b1
mov eax, dword [ebp - 0x114]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xb0]
shl edx, cl
mov eax, dword [ebp - 0x114]
mov dword [eax], edx
mov ecx, dword [ebp - 0x118]
mov dword [ebp - 0x110], ecx
mov dl, byte [ebp - 0xe]
mov byte [ebp - 0xd], dl
lea eax, [ebp - 0x108]
mov dword [ebp - 0xa4], eax
movzx eax, byte [ebp - 0xe9]
movzx ecx, byte [ebp - 0xbd]
cdq
idiv ecx
mov edx, dword [ebp - 0xbc]
movzx ecx, byte [edx]
movzx edx, byte [ebp - 0x15]
or ecx, edx
cmp eax, ecx
jl 0x401272
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
push ecx
call fcn.004031f0
add esp, 4
movzx edx, word [ebp - 0xcc]
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax]
add edx, ecx
mov word [ebp - 0xf0], dx
lea edx, [ebp - 0xa0]
push edx
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x114]
push ecx
call sub.gdiplus.dll_GdiplusStartup
mov dword [ebp - 0xf8], eax
movzx edx, byte [ebp - 0xe9]
movzx eax, byte [ebp - 0x15]
sub edx, eax
mov ecx, dword [ebp - 0xbc]
mov byte [ecx], dl
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 0xb0]
and eax, dword [edx]
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004031f0
add esp, 4
mov dl, byte [ebp - 0xd]
mov byte [ebp + 8], dl
lea eax, [ebp - 0x118]
mov dword [ebp - 0xdc], eax
mov ecx, dword [ebp - 0x114]
mov edx, dword [ecx]
add edx, dword [ebp - 0xb0]
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp - 0x100]
mov ecx, dword [eax]
mov dword [ebp - 0xfc], ecx
movzx edx, word [ebp - 0xb4]
movzx eax, word [ebp - 0xf0]
sub edx, eax
mov word [ebp - 0xcc], dx
mov cl, byte [ebp - 0xe9]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 0xbd]
mov eax, dword [ebp - 0xbc]
movzx ecx, byte [eax]
add edx, ecx
movzx eax, byte [ebp - 0xe9]
movzx ecx, byte [ebp - 1]
sub eax, ecx
cmp edx, eax
je 0x4013fc
lea edx, [ebp - 0xfc]
mov dword [ebp - 0xb8], edx
mov eax, dword [ebp - 0xbc]
movzx eax, byte [eax]
movzx ecx, byte [ebp - 0x15]
cdq
idiv ecx
movzx edx, byte [ebp - 1]
movzx ecx, byte [ebp - 0xe9]
or edx, ecx
cmp eax, edx
jne 0x4013fc
mov edx, dword [ebp - 0xdc]
mov eax, dword [edx]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0x5321
je 0x401337
jmp 0x4013e8
push 0x24
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0x22
mov eax, dword [ebp - 0xd4]
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconExA]
mov dword [ebp - 0xb0], eax
mov ecx, dword [ebp - 0x114]
mov edx, dword [ebp - 0x10c]
mov ecx, dword [ecx]
shr edx, cl
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xf8]
shl eax, cl
cmp edx, eax
ja 0x40138f
mov ecx, dword [ebp - 0xb0]
xor ecx, dword [ebp - 0xf8]
mov edx, dword [ebp - 0x114]
mov dword [edx], ecx
mov eax, dword [ebp - 0x118]
and eax, dword [ebp - 0xfc]
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x100]
mov edx, dword [ecx]
push edx
call fcn.004031f0
add esp, 4
mov al, byte [ebp - 0xc5]
mov byte [ebp + 8], al
movzx ecx, byte [ebp - 0xbd]
movzx edx, byte [ebp - 1]
sub ecx, edx
mov eax, dword [ebp - 0xbc]
mov byte [eax], cl
movzx ecx, word [ebp - 0xf0]
mov edx, dword [ebp - 0x14]
movzx eax, word [edx]
add ecx, eax
mov word [ebp - 0xcc], cx
jmp 0x4013fc
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x38]
push eax
call sub.gdiplus.dll_GdiplusStartup
mov dword [ebp - 0xc], eax
movsx ecx, byte [ebp - 0xd]
movsx edx, byte [ebp + 8]
sub ecx, edx
mov byte [ebp - 0xc5], cl
mov eax, dword [ebp - 0x98]
mov cx, word [eax]
mov word [ebp - 0x1c], cx
lea edx, [ebp - 0xb0]
mov dword [ebp - 0xe8], edx
lea eax, [ebp - 0xfc]
mov dword [ebp - 0xd8], eax
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx]
movzx eax, word [ebp - 0xcc]
add edx, eax
mov word [ebp - 0xb4], dx
movzx ecx, byte [ebp - 0x15]
movzx edx, byte [ebp - 0xbd]
imul ecx, edx
mov byte [ebp - 1], cl
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax]
mov dword [ebp - 0xf4], ecx
mov edx, dword [ebp - 0xb8]
mov eax, dword [edx]
and eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0xd8]
mov edx, dword [ecx]
sub edx, dword [ebp - 8]
cmp eax, edx
je 0x4014f0
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax]
movzx edx, word [ebp - 0xcc]
sub ecx, edx
movzx eax, word [ebp - 0xb4]
movzx edx, word [ebp - 0xf0]
or eax, edx
cmp ecx, eax
jle 0x4014ad
call fcn.00403410
jmp 0x4014eb
movzx eax, word [ebp - 0xcc]
movzx ecx, word [ebp - 0xf0]
xor eax, ecx
mov edx, dword [ebp - 0x14]
movzx edx, word [edx]
movzx ecx, word [ebp - 0xb4]
sar edx, cl
cmp eax, edx
jge 0x4014eb
mov al, byte [ebp - 0xd]
mov byte [ebp + 8], al
mov ecx, dword [ebp - 0xdc]
mov edx, dword [ebp - 8]
mov ecx, dword [ecx]
shl edx, cl
mov eax, dword [ebp - 0x100]
mov dword [eax], edx
jmp 0x4015cd
mov ecx, dword [ebp - 0xbc]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 1]
add edx, eax
movzx ecx, byte [ebp - 0xe9]
movzx eax, byte [ebp - 0xbd]
add ecx, eax
cmp edx, ecx
jl 0x4015cd
mov cl, byte [ebp - 0xd]
mov byte [ebp + 8], cl
mov edx, dword [ebp - 0x114]
mov eax, dword [edx]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0x988
je 0x4015c4
cmp dword [ebp - 0x128], 0x5441
je 0x40154c
jmp 0x4015cd
mov eax, dword [ebp - 0x118]
cdq
idiv dword [ebp - 8]
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ebp - 0xfc]
and edx, dword [ecx]
cmp eax, edx
jl 0x4015c2
mov eax, dword [ebp - 0xd0]
push eax
mov ecx, dword [ebp - 0xd4]
push ecx
mov edx, dword [ebp - 0xa8]
push edx
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.dll_ShellAboutA]
mov dword [ebp - 0xfc], eax
movzx ecx, word [ebp - 0xb4]
movzx edx, word [ebp - 0xcc]
add ecx, edx
mov eax, dword [ebp - 0x14]
mov word [eax], cx
movzx ecx, byte [ebp - 0xd]
push ecx
call section..text
mov edx, dword [ebp - 0xbc]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0xe9]
sub eax, ecx
mov byte [ebp - 1], al
jmp 0x4015cd
mov dl, byte [ebp - 0xc5]
mov byte [ebp + 8], dl
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0x118]
add ecx, dword [eax]
mov dword [ebp - 0xfc], ecx
lea edx, [ebp - 0xf8]
mov dword [ebp - 0x3c], edx
mov al, byte [ebp - 0xe]
mov byte [ebp - 0x12c], al
cmp byte [ebp - 0x12c], 0
je 0x401660
cmp byte [ebp - 0x12c], 0x7a
je 0x40160a
jmp 0x401707
movsx ecx, word [ebp - 0x1c]
mov edx, dword [ebp - 0xa4]
movsx eax, word [edx]
sub ecx, eax
mov word [ebp - 0x108], cx
mov cl, byte [ebp - 0xc5]
mov byte [ebp + 8], cl
movzx edx, byte [ebp - 0x15]
movzx eax, byte [ebp - 0xe9]
and edx, eax
mov ecx, dword [ebp - 0xbc]
mov byte [ecx], dl
movzx edx, byte [ebp - 0xe]
push edx
call section..text
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov dword [ebp - 0xe0], eax
jmp 0x401707
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0xb0]
add ecx, dword [eax]
cmp edx, ecx
jae 0x4016f1
mov dl, byte [ebp - 0xc5]
mov byte [ebp - 0x130], dl
cmp byte [ebp - 0x130], 0
je 0x401691
jmp 0x4016c4
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xc4], eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x104], edx
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0xd8]
mov edx, dword [eax]
mov ecx, dword [ecx]
sar edx, cl
mov eax, dword [ebp - 0xb8]
mov dword [eax], edx
jmp 0x4016ef
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx]
movzx eax, word [ebp - 0xf0]
or edx, eax
mov word [ebp - 0xcc], dx
movzx ecx, byte [ebp - 1]
mov edx, dword [ebp - 0xbc]
movzx eax, byte [edx]
xor ecx, eax
mov byte [ebp - 0xe9], cl
jmp 0x401707
mov ecx, dword [ebp - 0x114]
mov edx, dword [ebp - 0xf8]
mov ecx, dword [ecx]
shl edx, cl
mov dword [ebp - 0xb0], edx
mov eax, dword [ebp - 0xa4]
mov dx, word [eax]
mov cl, byte [ebp - 0xe9]
call fcn.00403990
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xfc]
mov edx, dword [ebp - 0xd8]
mov dword [edx], ecx
mov al, byte [ebp - 0xe]
mov byte [ebp + 8], al
lea ecx, [ebp - 0xf4]
push ecx
push 0x24
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0xd8]
push ecx
call dword [sym.imp.SHELL32.dll_SHParseDisplayName]
mov dword [ebp - 0x34], eax
mov edx, dword [section..data]
push edx
call fcn.004031f0
add esp, 4
movzx eax, word [ebp - 0xf0]
add eax, 0x7a9
mov word [ebp - 0xb4], ax
mov ecx, dword [ebp - 0x10c]
sub ecx, 0x4989
mov dword [ebp - 0x10c], ecx
mov eax, dword [section..data]
mov esp, ebp
pop ebp
ret 4