Function at 0x40d437
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x54]
sub esp, 0xab0
mov eax, dword [ebp + 0x70]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
mov dword [ebp + 0x40], ecx
jne 0x40d454
lea eax, [ebp + 0x24]
mov ecx, dword [ebp + 0x7c]
cmp ecx, ebx
mov dword [ebp + 0x44], eax
mov dword [eax], ebx
je 0x40d46b
push 1
push ebx
push 0xffffffffffffffff
push ebx
call fcn.0040152b
mov edi, dword [ebp + 0x5c]
cmp edi, ebx
je 0x40d9a1
cmp byte [edi], 0
je 0x40d9a1
push edi
call fcn.00454880
cmp eax, 0x4001
pop ecx
mov dword [ebp + 0x3c], eax
jb 0x40d4a9
cmp byte [ebp + 0x68], 0
je 0x40da69
push 0x4575d8
push str.String_too_long.__The_current_thread_will_exit.
jmp 0x40da61
inc eax
mov dword [ebp + 0x28], eax
add eax, 3
and eax, 0xfffffffc
call fcn.00454e20
mov eax, dword [ebp + 0x64]
cmp eax, ebx
mov esi, esp
je 0x40d4c9
cmp byte [eax], 0
jne 0x40d4c9
mov dword [ebp + 0x64], ebx
mov eax, dword [ebp + 0x60]
cmp eax, ebx
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x4c], eax
jne 0x40d4ff
push edi
push esi
mov dword [ebp + 0x4c], 0x4575d8
call fcn.00454650
cmp byte [esi], 0x22
pop ecx
pop ecx
jne 0x40d577
lea edi, [esi + 1]
push 0x22
push edi
call fcn.004549b0
jmp 0x40d584
push str.find
push edi
call fcn.00441439
test eax, eax
pop ecx
pop ecx
je 0x40d56e
push str.explore
push edi
call fcn.00441439
test eax, eax
pop ecx
pop ecx
je 0x40d56e
push str.open
push edi
call fcn.00441439
test eax, eax
pop ecx
pop ecx
je 0x40d56e
push str.edit
push edi
call fcn.00441439
test eax, eax
pop ecx
pop ecx
je 0x40d56e
push str.print
push edi
call fcn.00441439
test eax, eax
pop ecx
pop ecx
je 0x40d56e
push str.properties
push edi
call fcn.00441439
test eax, eax
pop ecx
pop ecx
je 0x40d56e
mov byte [ebp + 0x53], 0
jmp 0x40d6fa
mov byte [ebp + 0x53], 1
jmp 0x40d6fa
push 0x458bf0
push esi
mov edi, esi
call fcn.00438acb
cmp eax, ebx
pop ecx
pop ecx
je 0x40d592
mov byte [eax], 0
lea ebx, [eax + 1]
jmp 0x40d594
xor ebx, ebx
push str.find
push edi
call fcn.00441439
test eax, eax
pop ecx
pop ecx
je 0x40d76a
push str.explore
push edi
call fcn.00441439
test eax, eax
pop ecx
pop ecx
je 0x40d76a
push str.open
push edi
call fcn.00441439
test eax, eax
pop ecx
pop ecx
je 0x40d76a
push str.edit
push edi
call fcn.00441439
test eax, eax
pop ecx
pop ecx
je 0x40d76a
push str.print
push edi
call fcn.00441439
test eax, eax
pop ecx
pop ecx
je 0x40d76a
push str.properties
push edi
call fcn.00441439
test eax, eax
pop ecx
pop ecx
je 0x40d76a
push dword [ebp + 0x5c]
mov byte [ebp + 0x53], 0
push esi
call fcn.00454650
push str..exe
push esi
call fcn.004386f1
add esp, 0x10
test eax, eax
jne 0x40d6d2
push str..exe_
push esi
call fcn.004386f1
test eax, eax
pop ecx
pop ecx
jne 0x40d6d2
push str..bat
push esi
call fcn.004386f1
test eax, eax
pop ecx
pop ecx
jne 0x40d6d2
push str..bat_
push esi
call fcn.004386f1
test eax, eax
pop ecx
pop ecx
jne 0x40d6d2
push str..com
push esi
call fcn.004386f1
test eax, eax
pop ecx
pop ecx
jne 0x40d6d2
push str..com_
push esi
call fcn.004386f1
test eax, eax
pop ecx
pop ecx
jne 0x40d6d2
push str..cmd
push esi
call fcn.004386f1
test eax, eax
pop ecx
pop ecx
jne 0x40d6d2
push str..cmd_
push esi
call fcn.004386f1
test eax, eax
pop ecx
pop ecx
jne 0x40d6d2
push str..hta
push esi
call fcn.004386f1
test eax, eax
pop ecx
pop ecx
jne 0x40d6d2
push str..hta_
push esi
call fcn.004386f1
test eax, eax
pop ecx
pop ecx
je 0x40d6fa
add eax, 4
cmp byte [eax], 0x22
mov dword [ebp + 0x48], esi
mov dword [ebp + 0x4c], eax
jne 0x40d6e4
inc eax
mov dword [ebp + 0x4c], eax
cmp byte [eax], 0
je 0x40d6fa
mov byte [eax], 0
inc eax
push 0xffffffffffffffff
push eax
mov dword [ebp + 0x4c], eax
call fcn.0040a9b7
pop ecx
pop ecx
mov ebx, dword [ebp + 0x40]
push 0x7f
xor eax, eax
cmp byte [ebp + 0x78], 0
mov byte [ebp - 0x25c], 0
pop ecx
lea edi, [ebp - 0x25b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [ebp + 0x52], 0
stosb byte es:[edi], al
je 0x40d786
mov eax, dword [ebx + 0x4d0]
test eax, eax
je 0x40d786
xor ecx, ecx
cmp word [eax], cx
jne 0x40d745
mov eax, dword [ebx + 0x4d4]
cmp word [eax], cx
jne 0x40d745
mov eax, dword [ebx + 0x4d8]
cmp word [eax], cx
je 0x40d786
cmp byte [ebp + 0x53], 0
mov byte [ebp + 0x7b], 1
je 0x40d794
cmp byte [ebp + 0x68], 0
je 0x40da69
push 0x4575d8
push str.System_verbs_unsupported_with_RunAs.__The_current_thread_will_exit.
mov ecx, ebx
jmp 0x40da64
test ebx, ebx
mov byte [ebp + 0x53], 1
mov dword [ebp + 0x48], edi
je 0x40d77a
mov dword [ebp + 0x4c], ebx
jmp 0x40d6fa
mov dword [ebp + 0x4c], 0x4575d8
jmp 0x40d6fa
cmp byte [ebp + 0x53], 0
mov byte [ebp + 0x7b], 0
jne 0x40d8e5
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0x6c]
inc eax
test ecx, ecx
mov dword [ebp - 0x20], 0x44
mov dword [ebp + 0xc], eax
je 0x40d7bc
cmp byte [ecx], 0
je 0x40d7bc
push ecx
call fcn.004150d0
pop ecx
and dword [ebp + 0x2c], 0
mov word [ebp + 0x10], ax
xor eax, eax
lea edi, [ebp + 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 0x60]
test edi, edi
je 0x40d807
cmp byte [edi], 0
je 0x40d807
push edi
call fcn.00454880
pop ecx
mov ecx, dword [ebp + 0x3c]
lea eax, [eax + ecx + 0xa]
add eax, 3
and eax, 0xfffffffc
call fcn.00454e20
mov esi, esp
push edi
push dword [ebp + 0x5c]
push str._s__s
push esi
call fcn.00440d7f
add esp, 0x10
jmp 0x40d822
mov eax, dword [ebp + 0x28]
add eax, 3
and eax, 0xfffffffc
call fcn.00454e20
mov esi, esp
push dword [ebp + 0x5c]
push esi
call fcn.00454650
pop ecx
pop ecx
cmp byte [ebp + 0x7b], 0
je 0x40d85a
lea eax, [ebp - 0x25c]
push eax
push dword [ebp + 0x44]
lea eax, [ebp + 0x52]
push eax
lea eax, [ebp + 0x2c]
push eax
push dword [ebp + 0x7c]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0x74]
push dword [ebp + 0x68]
push dword [ebp + 0x64]
push esi
call fcn.0040da70
test eax, eax
jne 0x40d8ba
jmp 0x40da69
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x64]
xor edi, edi
push edi
push edi
push edi
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x40d8a3
cmp dword [ebp + 0x30], edi
mov byte [ebp + 0x52], 1
je 0x40d88a
push dword [ebp + 0x30]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp + 0x44]
mov eax, dword [ebp + 0x2c]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x7c]
cmp ecx, edi
je 0x40d8ba
push dword [ebp + 0x34]
call fcn.00401891
jmp 0x40d8ba
push dword [ebp + 0x74]
lea eax, [ebp - 0x25c]
push 0x200
push eax
call fcn.00437c1c
add esp, 0xc
cmp byte [ebp + 0x52], 0
jne 0x40d97e
cmp byte [ebp + 0x7b], 0
je 0x40d8e5
cmp byte [ebp + 0x68], 0
je 0x40da69
lea eax, [ebp - 0x25c]
push eax
push str.Launch_Error__possibly_related_to_RunAs_.__The_current_thread_will_exit.
jmp 0x40d763
xor eax, eax
push 0xe
pop ecx
lea edi, [ebp - 0x14]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x64]
mov dword [ebp], eax
mov eax, dword [ebp + 0x6c]
test eax, eax
mov dword [ebp - 0x18], 0x3c
mov dword [ebp - 0x14], 0x440
je 0x40d91b
cmp byte [eax], 0
je 0x40d91b
push eax
call fcn.004150d0
pop ecx
mov dword [ebp + 4], eax
jmp 0x40d922
mov dword [ebp + 4], 1
cmp byte [ebp + 0x53], 0
mov esi, dword [ebp + 0x48]
je 0x40d94f
push str.properties
push esi
mov dword [ebp - 0xc], esi
call fcn.00441439
test eax, eax
pop ecx
pop ecx
jne 0x40d943
or dword [ebp - 0x14], 0xc
mov eax, dword [ebp + 0x4c]
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
jmp 0x40d964
mov eax, dword [ebp + 0x4c]
mov cl, byte [eax]
and dword [ebp - 0xc], 0
neg cl
mov dword [ebp - 8], esi
sbb ecx, ecx
and ecx, eax
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40d9b4
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x44]
mov dword [ecx], eax
mov byte [ebp + 0x52], 1
cmp byte [ebp + 0x74], 0
je 0x40d98b
and dword [0x464268], 0
cmp dword [ebp + 0x70], 0
jne 0x40d9a1
mov eax, dword [ebp + 0x44]
mov eax, dword [eax]
test eax, eax
je 0x40d9a1
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
inc eax
lea esp, [ebp - 0xa68]
pop edi
pop esi
pop ebx
add ebp, 0x54
leave
ret 0x24
push dword [ebp + 0x74]
lea eax, [ebp - 0x25c]
push 0x200
push eax
call fcn.00437c1c
add esp, 0xc
cmp byte [ebp + 0x52], 0
jne 0x40d97e
cmp byte [ebp + 0x68], 0
je 0x40da69
cmp byte [ebp + 0x53], 0
je 0x40d9fa
push esi
push str._nVerb:___s_
lea eax, [ebp - 0x5c]
push 0x80
push eax
call fcn.0040aa6c
add esp, 0x10
jmp 0x40d9fe
mov byte [ebp - 0x5c], 0
push dword [ebp + 0x4c]
call fcn.00454880
mov esi, 0x190
cmp eax, esi
mov edi, 0x4590a8
pop ecx
mov ebx, edi
ja 0x40da1c
mov ebx, 0x4575d8
push dword [ebp + 0x48]
call fcn.00454880
cmp eax, esi
pop ecx
ja 0x40da2e
mov edi, 0x4575d8
push ebx
push dword [ebp + 0x4c]
lea eax, [ebp - 0x5c]
push eax
push edi
push dword [ebp + 0x48]
lea eax, [ebp - 0xa5c]
push str.Failed_attempt_to_launch_program_or_document:_nAction:____0.400s_s__s_nParams:____0.400s_s__n_nThe_current_thread_will_exit.
push 0x800
push eax
call fcn.0040aa6c
add esp, 0x20
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0xa5c]
push eax
mov ecx, dword [ebp + 0x40]
call fcn.0044a384
xor eax, eax
jmp 0x40d9a4