Function at 0x4ad03f69
Capabilities:
Create process on windows

Disassembly:
push 0x100
push 0x4ad0bae8
call fcn.4ad01ad3
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x68]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x68], 0x44
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], ebx
xor ecx, ecx
inc ecx
mov dword [ebp - 0x54], ecx
push 0x64
pop eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x3c], ebx
mov word [ebp - 0x38], cx
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov dword [ebp - 0x6c], eax
lea ecx, [ebp - 0x24]
push ecx
push ebx
push ebx
push 2
push eax
mov esi, dword [sym.imp.USER32.dll_GetUserObjectInformationW]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 0x70], eax
lea ecx, [ebp - 0x20]
push ecx
push ebx
push ebx
push 2
push eax
call esi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + eax + 0x20]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x74], eax
cmp eax, ebx
je 0x4ad0404d
mov edi, eax
lea ecx, [ebp - 0x24]
push ecx
push dword [ebp - 0x24]
push eax
push 2
push dword [ebp - 0x6c]
call esi
test eax, eax
je 0x4ad0404d
mov eax, dword [ebp - 0x24]
cmp eax, ebx
jbe 0x4ad04034
shr eax, 1
mov ecx, edi
lea edi, [ecx + eax*2 - 2]
mov word [edi], 0x5c
inc edi
inc edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push edi
push 2
push dword [ebp - 0x70]
call esi
test eax, eax
je 0x4ad0404d
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x60], eax
mov edi, 0x4ad0baf4
push edi
call fcn.4ad0210b
mov esi, eax
cmp esi, ebx
jne 0x4ad0406b
mov esi, 0x4ad0ba44
cmp esi, ebx
je 0x4ad0f62f
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [ebp - 0x78], eax
cmp eax, ebx
je 0x4ad10e89
cmp esi, ebx
je 0x4ad04098
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
cmp dword [0x4ad30b68], ebx
jne 0x4ad040ac
cmp dword [0x4ad2cabc], ebx
je 0x4ad0f61e
push 0x5c
push dword [ebp + 0x1c]
call fcn.4ad01b0c
cmp eax, ebx
je 0x4ad040ce
push 0x4ad0bad0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4ad10e9b
mov eax, dword [0x4ad2cac4]
cmp eax, ebx
je 0x4ad040e2
mov eax, dword [eax + 0x14]
cmp eax, ebx
jne 0x4ad10eac
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x68]
push eax
mov esi, 0x4ad31400
push esi
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
cmp edi, ebx
je 0x4ad10ed5
mov eax, dword [ebp - 0x88]
mov dword [0x4ad2ca98], eax
push dword [ebp - 0x84]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push dword [ebp - 0x78]
push 0x4ad0baf4
call fcn.4ad01fd9
push dword [ebp - 0x78]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 0x74]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp edi, ebx
je 0x4ad10ee5
mov ecx, dword [0x4ad2ca98]
mov eax, ecx
xor esi, esi
inc esi
and eax, esi
mov dword [ebp - 0xcc], eax
cmp ecx, ebx
je 0x4ad054ad
cmp byte [0x4ad2ca64], bl
je 0x4ad04186
cmp dword [0x4ad2cac4], ebx
je 0x4ad05477
mov dword [ebp - 0xd0], ebx
mov dword [0x4ad2ca9c], esi
cmp dword [ebp + 0x10], ebx
jne 0x4ad04205
push dword [0x4ad2ca98]
call fcn.4ad0189e
mov dword [0x4ad2ca20], eax
mov dword [ebp - 0xd0], eax
push eax
push 0x4ad0bac4
lea eax, [ebp - 0xf8]
push eax
mov edi, dword [sym.imp.msvcrt.dll_swprintf]
call edi
add esp, 0xc
mov esi, 0x4ad280d0
push esi
lea eax, [ebp - 0xf8]
push eax
push str.ExitCode
call fcn.4ad01fd9
cmp dword [ebp - 0xd0], 0x20
jge 0x4ad10fe7
push esi
push 0x4ad0ba48
push str.ExitCodeAscii
call fcn.4ad01fd9
cmp dword [ebp - 0xcc], ebx
jne 0x4ad11018
cmp dword [ebp + 0x10], 4
je 0x4ad0f6ef
cmp dword [ebp + 0x10], 2
je 0x4ad0a16e
mov eax, dword [ebp - 0xd0]
call fcn.4ad01371
ret 0x1c
cmp dword [0x4ad30b68], ebx
jne 0x4ad04186
cmp dword [0x4ad2cabc], ebx
jne 0x4ad04186
cmp dword [ebp + 0x10], ebx
jne 0x4ad04186
test cl, 2
jne 0x4ad054ad
push ecx
call fcn.4ad0f636
cmp ax, 2
jne 0x4ad04186
mov dword [ebp + 0x10], 4
mov dword [ebp - 0x1c], esi
jmp 0x4ad04186
cmp dword [ebp + 0x14], ebx
je 0x4ad11047
mov eax, dword [0x4ad2ca98]
mov dword [0x4ad30b28], eax
jmp 0x4ad04219
cmp dword [0x4ad2cac4], ebx
je 0x4ad040ce
jmp 0x4ad040ac
xor eax, eax
jmp 0x4ad04073
cmp dword [ebp - 0x1c], ebx
je 0x4ad11022
mov eax, dword [0x4ad2ca98]
cmp eax, ebx
je 0x4ad04219
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4ad2ca98], ebx
jmp 0x4ad04219
push ebx
push 0x2374
call fcn.4ad0b54d
pop ecx
pop ecx
jmp 0x4ad10fdf
push ebx
push 0x4ad1c3c0
push edi
call fcn.4ad01fd9
jmp 0x4ad040ce
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x68]
push ecx
mov esi, 0x4ad31400
push esi
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x4ad04105
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4ad28a04], eax
jmp 0x4ad04126
cmp byte [0x4ad2ca64], bl
je 0x4ad10fb7
cmp dword [0x4ad28a04], 0xc1
jne 0x4ad10fb7
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0xc4]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc4], 0x3c
mov dword [ebp - 0xc0], 0x88140
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], esi
movzx eax, word [ebp - 0x38]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 4], ebx
lea eax, [ebp - 0xc4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
mov dword [ebp - 0xc8], edi
cmp edi, ebx
je 0x4ad10f70
mov eax, dword [ebp - 0x8c]
mov dword [0x4ad2ca98], eax
jmp 0x4ad10fb3
mov eax, dword [ebp - 0xa4]
cmp eax, ebx
jne 0x4ad10f86
mov dword [0x4ad28a04], 8
jmp 0x4ad10fb3
cmp eax, 0x20
mov dword [0x4ad28a04], 2
je 0x4ad10fb3
mov dword [0x4ad28a04], eax
jmp 0x4ad10fb3
or dword [ebp - 4], 0xffffffff
cmp edi, ebx
jne 0x4ad04157
cmp dword [ebp + 0xc], ebx
je 0x4ad10fd7
cmp dword [ebp + 0x1c], ebx
je 0x4ad10fd7
push dword [ebp + 0x1c]
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push dword [ebp + 0xc]
call fcn.4ad1683f
xor eax, eax
inc eax
jmp 0x4ad0421f
cmp dword [ebp - 0xd0], 0x7e
jg 0x4ad041e9
push dword [ebp - 0xd0]
push 0x4ad15b00
lea eax, [ebp - 0x110]
push eax
call edi
add esp, 0xc
push esi
lea eax, [ebp - 0x110]
push eax
jmp 0x4ad041ef
call fcn.4ad167ae
jmp 0x4ad04205
push dword [0x4ad2ca98]
push 0x4ad15af8
call fcn.4ad09368
push eax
push 1
push 0x234c
call fcn.4ad0b54d
add esp, 0xc
jmp 0x4ad0f6f8
push dword [0x4ad2ca98]
call fcn.4ad0189e
mov dword [0x4ad2ca20], eax
mov dword [ebp - 0xd0], eax
jmp 0x4ad04219