Function at 0x2e017a0b
Capabilities:
Create process on windows

Disassembly:
push 0x2d8
mov eax, 0x2e02900e
call fcn.2e0276dc
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
or dword [ebp - 0x2c4], 0xffffffff
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c0], eax
xor eax, eax
xor ebx, ebx
cmp edi, ebx
setne al
mov dword [ebp - 0x2bc], edi
mov dword [ebp - 0x2b4], esi
mov dword [ebp - 0x2cc], ebx
movzx eax, ax
mov dword [ebp - 0x2a4], eax
mov eax, dword [0x2e03dafc]
call dword [eax + 0xca4]
test ax, ax
je 0x2e017b1f
mov eax, dword [0x2e03dafc]
call dword [eax + 0xca8]
test eax, eax
je 0x2e017b1f
mov byte [ebp - 0x2a5], bl
cmp esi, ebx
je 0x2e017ac9
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x2e017ac9
push str._blank
push eax
call fcn.2e012f91
pop ecx
pop ecx
test eax, eax
je 0x2e017ac2
push str.bogusFrame
push dword [esi + 4]
call fcn.2e012f91
pop ecx
pop ecx
test eax, eax
jne 0x2e017ac9
mov byte [ebp - 0x2a5], 1
push ebx
push edi
lea ecx, [ebp - 0x2d4]
call fcn.2e012f91
mov eax, dword [0x2e03dafc]
mov dword [ebp - 4], ebx
call dword [eax + 0xca8]
mov edi, eax
movzx eax, byte [ebp - 0x2a5]
mov esi, dword [edi]
push eax
push dword [ebp - 0x2d4]
mov eax, dword [0x2e03f770]
call dword [eax + 0x54]
pop ecx
push eax
mov ecx, edi
call dword [esi + 0xbc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d4]
call fcn.2e011e0d
xor eax, eax
inc eax
jmp 0x2e018163
cmp esi, ebx
je 0x2e017b5f
mov esi, dword [esi + 4]
cmp esi, ebx
je 0x2e017b5f
push str.bogusframe
push esi
call dword [sym.imp.MSVCR100.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x2e017b5f
push edi
call fcn.2e012f91
pop ecx
test ax, ax
je 0x2e017b17
push 5
push 0x2e02b538
push ebx
push edi
push 0x2e02be60
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x2e017b17
cmp word [ebp - 0x2a4], bx
je 0x2e01815c
cmp edi, ebx
je 0x2e01815c
push 5
push str.file:
mov esi, edi
push esi
call fcn.2e012f91
add esp, 0xc
neg eax
sbb eax, eax
inc eax
movzx eax, ax
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2ac], edi
cmp ax, bx
je 0x2e017bfc
push ebx
push ebx
push esi
call fcn.2e012f91
pop ecx
push eax
push esi
call fcn.2e012f91
mov edi, eax
push edi
mov dword [ebp - 0x2ac], edi
call sub.MSVCR100.dll_strlen
add esp, 0x14
cmp eax, 0xa
jbe 0x2e017bfc
push 8
push str.file:___
push esi
call fcn.2e012f91
add esp, 0xc
test eax, eax
jne 0x2e017bfc
mov al, byte [edi + 8]
cmp al, 0x61
jl 0x2e017be4
cmp al, 0x7a
jle 0x2e017bec
cmp al, 0x41
jl 0x2e017bfc
cmp al, 0x5a
jg 0x2e017bfc
cmp byte [edi + 9], 0x7c
jne 0x2e017bfc
cmp byte [edi + 0xa], 0x2f
jne 0x2e017bfc
mov byte [edi + 9], 0x3a
call fcn.2e012f91
movzx eax, ax
mov dword [ebp - 0x2b0], eax
cmp edi, ebx
je 0x2e01815c
cmp dword [0x2e03f6c8], ebx
je 0x2e017c67
cmp ax, bx
jne 0x2e017c67
mov eax, dword [0x2e03f6b8]
cmp eax, ebx
je 0x2e017c39
push edi
push eax
call fcn.2e012f91
pop ecx
pop ecx
test eax, eax
je 0x2e017fad
push ebx
push ebx
push 0x1a
push 3
push 4
push ebx
call fcn.2e016759
add esp, 0x18
cmp ax, 3
jne 0x2e017fad
call fcn.2e017268
xor eax, eax
inc eax
mov word [0x2e03f6c0], ax
jmp 0x2e017fad
xor eax, eax
push str.WWW_OpenURL
mov word [0x2e03f6c0], ax
call fcn.2e012f91
movzx eax, ax
pop ecx
mov dword [ebp - 0x2e0], eax
cmp ax, bx
jne 0x2e017ca3
mov ecx, edi
call fcn.2e012f91
test ax, ax
je 0x2e017ccc
mov dword [ebp - 0x2a4], 1
jmp 0x2e018144
push edi
call fcn.2e012f91
pop ecx
cmp eax, 0xec
ja 0x2e017cb7
cmp word [ebp + 0x1c], bx
je 0x2e017cdc
mov ecx, edi
call fcn.2e012f91
movzx eax, ax
mov dword [ebp - 0x2a4], eax
jmp 0x2e018144
xor ecx, ecx
call fcn.2e012f91
test ax, ax
je 0x2e017fad
call fcn.2e012f91
cmp eax, 2
je 0x2e017d06
xor ecx, ecx
cmp eax, ebx
sete cl
push ebx
push ebx
lea ecx, [ecx + ecx + 0x19]
push ecx
push 1
push 2
push ebx
call fcn.2e016759
add esp, 0x18
jmp 0x2e017fad
call fcn.2e017776
mov eax, dword [0x2e03f6b8]
cmp eax, ebx
je 0x2e017d1e
push eax
mov eax, dword [0x2e03f708]
call dword [eax + 0xc]
pop ecx
push edi
call fcn.2e012f91
mov dword [0x2e03f6b8], eax
mov eax, dword [0x2e03f6b4]
pop ecx
cmp eax, 3
je 0x2e017d4d
cmp eax, 5
je 0x2e017d4d
cmp eax, 4
je 0x2e017d4d
cmp eax, 8
je 0x2e017d4d
cmp eax, 9
je 0x2e017d4d
cmp eax, 0xa
jne 0x2e017d63
push dword [ebp - 0x2c8]
call fcn.2e012f91
pop ecx
mov dword [ebp - 0x2b0], 1
cmp word [ebp - 0x2b0], bx
jne 0x2e017da0
call fcn.2e012f91
push ebx
mov dword [0x2e03f6d0], eax
mov dword [0x2e03f6d4], edx
call dword [sym.imp.MSVCR100.dll__time64]
push 5
push eax
push 0x2e017330
mov dword [ebp - 0x2d8], edx
call fcn.2e012f91
add esp, 0x10
mov dword [0x2e03f6c8], eax
jmp 0x2e017da6
mov dword [0x2e03f6c8], ebx
cmp dword [ebp - 0x2b4], ebx
je 0x2e017f37
mov eax, dword [ebp - 0x2b4]
cmp dword [eax + 4], ebx
je 0x2e017f37
push str.WWW_ListWindows
push 0x2e03f694
push dword [0x2e03f690]
call fcn.2e012f91
mov esi, eax
add esp, 0xc
cmp esi, ebx
je 0x2e017f37
mov eax, dword [esi]
push ebx
push str.ABCD
push dword [eax]
call sub.USER32.dll_DdeCreateStringHandleA
push ebx
push 0x2710
push 0x20b0
push 1
mov edi, eax
push edi
push dword [esi + 0xc]
push ebx
push ebx
call sub.USER32.dll_DdeClientTransaction
mov dword [ebp - 0x2d8], eax
mov eax, dword [esi]
push edi
push dword [eax]
call sub.USER32.dll_DdeFreeStringHandle
cmp dword [ebp - 0x2d8], ebx
je 0x2e017f1e
mov eax, dword [esi]
push dword [eax]
call sub.USER32.dll_DdeGetLastError
push ebx
push 0x102
lea eax, [ebp - 0x198]
push eax
push dword [ebp - 0x2d8]
call sub.USER32.dll_DdeGetData
mov eax, dword [esi]
push dword [eax]
call sub.USER32.dll_DdeGetLastError
test eax, eax
jne 0x2e017f1e
mov edi, dword [ebp - 0x198]
lea eax, [ebp - 0x198]
mov dword [ebp - 0x2b8], eax
jmp 0x2e017efe
push str.WWW_GetWindowInfo
push 0x2e03f694
push dword [0x2e03f690]
call fcn.2e012f91
mov esi, eax
add esp, 0xc
cmp esi, ebx
je 0x2e017edf
mov eax, 0x82
push eax
lea ecx, [ebp - 0x94]
push ecx
push eax
lea ecx, [ebp - 0x21c]
push ecx
push eax
lea eax, [ebp - 0x2a0]
push eax
push edi
push 0x2e02d190
push 0x2e02c3d4
push esi
call fcn.2e012f91
add esp, 0x28
test eax, eax
jne 0x2e017edf
mov eax, dword [ebp - 0x2b4]
push dword [eax + 4]
lea eax, [ebp - 0x94]
push eax
call fcn.2e012f91
pop ecx
pop ecx
test eax, eax
je 0x2e017f08
push esi
push dword [0x2e03f690]
call fcn.2e012f91
xor esi, esi
add dword [ebp - 0x2b8], 4
mov eax, dword [ebp - 0x2b8]
mov edi, dword [eax]
pop ecx
pop ecx
cmp edi, ebx
jne 0x2e017e71
jmp 0x2e017f1e
push esi
push dword [0x2e03f690]
mov dword [ebp - 0x2c4], edi
call fcn.2e012f91
pop ecx
pop ecx
xor esi, esi
push dword [ebp - 0x2d8]
call sub.USER32.dll_DdeFreeDataHandle
push esi
push dword [0x2e03f690]
call fcn.2e012f91
pop ecx
pop ecx
cmp dword [0x2e03f6b4], 3
jne 0x2e017f54
cmp word [ebp - 0x2e0], bx
jne 0x2e017f54
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
push str.WWW_OpenURL
push 0x2e03f694
push dword [0x2e03f690]
call fcn.2e012f91
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x2e017fb8
push dword [0x2e03f690]
call fcn.2e012f91
pop ecx
test ax, ax
jne 0x2e017fa8
push dword [0x2e03f6c4]
mov eax, dword [0x2e03e3e8]
call dword [eax + 0x18]
pop ecx
test ax, ax
jne 0x2e017fa8
push ebx
push ebx
push 0x14
push 1
push 2
push ebx
call fcn.2e016759
add esp, 0x18
call fcn.2e017136
mov dword [ebp - 0x2a4], ebx
jmp 0x2e018144
mov eax, dword [0x2e03f6b4]
cmp eax, 7
je 0x2e0180ec
cmp eax, 6
je 0x2e0180ec
mov eax, 0x2e02b538
mov ecx, str.AcroWWW
mov edx, eax
cmp word [ebp - 0x2b0], bx
jne 0x2e017fe8
mov edx, ecx
jmp 0x2e017fea
mov ecx, eax
lea edi, [ebp - 0x2cc]
push edi
push edx
push ecx
push eax
push dword [ebp - 0x2c0]
push 4
push dword [ebp - 0x2c4]
push eax
push dword [ebp - 0x2ac]
push 0x2e02d0f4
push str.ssllssss
push esi
call fcn.2e012f91
add esp, 0x30
sub eax, ebx
je 0x2e0180ba
dec eax
je 0x2e01807b
dec eax
jne 0x2e01812b
push dword [0x2e03f690]
call fcn.2e012f91
pop ecx
test ax, ax
jne 0x2e018064
push dword [0x2e03f6c4]
mov eax, dword [0x2e03e3e8]
call dword [eax + 0x18]
pop ecx
test ax, ax
jne 0x2e018064
push ebx
push ebx
push 0x14
push 1
push 2
push ebx
call fcn.2e016759
add esp, 0x18
push esi
push dword [0x2e03f690]
call fcn.2e012f91
mov dword [ebp - 0x2a4], ebx
jmp 0x2e018129
push esi
push dword [0x2e03f690]
call fcn.2e012f91
push 1
push dword [ebp - 0x2b4]
push dword [ebp - 0x2c0]
push dword [ebp - 0x2bc]
push dword [ebp - 0x2e4]
push dword [ebp - 0x2c8]
call fcn.2e017a0b
movzx eax, ax
add esp, 0x20
mov dword [ebp - 0x2a4], eax
jmp 0x2e01812b
push esi
push dword [0x2e03f690]
call fcn.2e012f91
cmp dword [0x2e03f6b4], 2
pop ecx
pop ecx
jne 0x2e01812b
cmp dword [ebp - 0x2cc], ebx
jge 0x2e01812b
push ebx
push ebx
push 0x47
push 1
push 2
push ebx
call fcn.2e016759
add esp, 0x18
jmp 0x2e01812b
push dword [ebp - 0x2ac]
call fcn.2e012f91
inc eax
push eax
push dword [ebp - 0x2ac]
push esi
call fcn.2e012f91
add esp, 0x10
test ax, ax
jne 0x2e01811d
push dword [0x2e03f690]
call fcn.2e012f91
jmp 0x2e01804d
push esi
push dword [0x2e03f690]
call fcn.2e012f91
pop ecx
pop ecx
mov eax, dword [0x2e03f6b8]
cmp eax, ebx
je 0x2e018144
push eax
mov eax, dword [0x2e03f708]
call dword [eax + 0xc]
pop ecx
mov dword [0x2e03f6b8], ebx
cmp word [ebp - 0x2d0], bx
je 0x2e01815c
push dword [ebp - 0x2ac]
mov eax, dword [0x2e03f708]
call dword [eax + 0xc]
pop ecx
mov ax, word [ebp - 0x2a4]
call fcn.2e02774b
ret