Function at 0x409eed
Capabilities:
Create process on windows

Disassembly:
push 8
push 0x308
mov eax, 0x41f659
call fcn.0040cd73
mov esi, ecx
mov dword [ebp - 0x254], esi
movzx edi, word [ebx + 0x10]
xor edx, edx
mov eax, dword [ebx + 0x14]
inc edx
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x258], eax
push 2
pop ecx
cmp di, dx
je 0x409f31
cmp di, cx
je 0x409f31
push 3
pop ecx
cmp di, cx
jne 0x409f35
test eax, eax
jne 0x409f3f
mov eax, 0x80070057
jmp 0x40a0f8
mov ecx, esi
call fcn.0040b706
push dword [esi + 0xc]
lea ecx, [ebp - 0x290]
call fcn.0040903d
mov eax, dword [ebp - 0x28c]
xor ecx, ecx
sub eax, dword [ebp - 0x290]
cdq
mov dword [ebp - 0x250], 0x24
idiv dword [ebp - 0x250]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x244], eax
test eax, eax
je 0x40a0a1
mov eax, ecx
mov dword [ebp - 0x224], ecx
add eax, dword [ebp - 0x290]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.00403e24
pop ecx
pop ecx
xor edi, edi
mov dword [ebp - 0x220], edi
mov esi, dword [ebp - 0x248]
mov byte [ebp - 4], 2
test esi, esi
je 0x409fd4
mov eax, dword [esi]
lea ecx, [ebp - 0x220]
push ecx
push esi
call dword [eax + 0x20]
mov eax, dword [ebp - 0x220]
test eax, eax
jne 0x409fff
mov eax, dword [ebp - 0x290]
lea edx, [ebp - 0x220]
mov ecx, dword [ebp - 0x224]
push edx
push 0x42091c
mov ecx, dword [eax + ecx + 0x1c]
push ecx
mov eax, dword [ecx]
call dword [eax]
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x40a049
lea ecx, [ebp - 0x234]
push ecx
lea ecx, [ebp - 0x228]
push ecx
lea ecx, [ebp - 0x24c]
push ecx
push eax
call fcn.0040bbda
add esp, 0x10
test eax, eax
js 0x40a043
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x40a043
cmp dword [ebp - 0x234], eax
jne 0x40a043
mov eax, dword [ebp - 0x238]
cmp word [ebp - 0x228], ax
je 0x40a103
mov eax, dword [ebp - 0x220]
mov byte [ebp - 4], 5
test eax, eax
je 0x40a057
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 6
test esi, esi
je 0x40a065
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov edx, dword [ebp - 0x230]
xor ecx, ecx
mov eax, dword [ebp - 0x224]
inc edx
add eax, dword [ebp - 0x250]
mov byte [ebp - 4], cl
mov dword [ebp - 0x230], edx
mov dword [ebp - 0x224], eax
cmp edx, dword [ebp - 0x244]
jb 0x409f92
mov edi, dword [ebp - 0x238]
mov esi, dword [ebp - 0x254]
cmp dword [ebx + 8], 2
je 0x40a0e6
mov eax, dword [ebp - 0x254]
mov esi, dword [esi]
mov dword [ebp - 0x248], 0x18
mov dword [ebp - 0x228], esi
mov eax, dword [eax + 4]
sub eax, esi
cdq
idiv dword [ebp - 0x248]
mov edx, eax
test edx, edx
je 0x40a0e6
mov eax, ecx
cmp dword [esi + 0x10], ecx
je 0x40a127
inc eax
add esi, 0x18
mov dword [ebp - 0x228], esi
cmp eax, edx
jb 0x40a0d3
mov edi, 0x80004005
lea ecx, [ebp - 0x290]
call fcn.004066e2
mov eax, edi
mov ecx, dword [ebp - 0x14]
call fcn.0040cd4e
ret 0x10
mov ecx, dword [ebp - 0x258]
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x220], edi
mov dword [ecx], eax
mov byte [ebp - 4], 4
test esi, esi
je 0x40a0eb
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x40a0eb
or dword [esi + 0x10], 0xffffffff
lea eax, [ebp - 0x1f8]
push 0x190
push ecx
push eax
call fcn.0040f250
add esp, 0xc
lea ecx, [ebp - 0x234]
push esi
call fcn.0040789f
xor esi, esi
mov edx, 0x421368
inc esi
mov ecx, 0x421360
cmp di, si
push dword [eax]
cmovne ecx, edx
lea eax, [ebp - 0x1f8]
push ecx
push str._s__Automation__guid:_s
push 0xc7
push 0xc8
push eax
mov dword [ebp - 0x24c], ecx
call fcn.0040b933
add esp, 0x18
push dword [ebp - 0x234]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x40
xor esi, esi
mov dword [ebp - 0x318], 0x44
lea eax, [ebp - 0x314]
push esi
push eax
call fcn.0040f250
xor eax, eax
lea edi, [ebp - 0x2b0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x238]
xor edi, edi
movzx eax, ax
push eax
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x224], edi
push eax
call fcn.00403bd1
add esp, 0x14
mov eax, dword [ebp - 0x25c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [eax - 0xc], edi
jle 0x40a227
lea ecx, [ebp - 0x2b0]
push ecx
lea ecx, [ebp - 0x318]
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
lea ecx, [ebp - 0x1f8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x224], eax
test eax, eax
je 0x40a22d
push dword [ebp - 0x2b0]
call esi
push dword [ebp - 0x2ac]
call esi
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x230], edi
mov byte [ebp - 4], 8
test eax, eax
je 0x40a7bb
mov ecx, dword [ebp - 0x228]
lea edi, [ebp - 0x68]
mov eax, dword [ebp - 0x2a8]
mov esi, str.192751BF_2639_487d_B97E_67EFFFC62822
push 0x13
mov dword [ecx + 0x10], eax
pop eax
mov ecx, eax
lea eax, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
test esi, esi
je 0x40a287
push 0x5dc
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x22c], edi
mov esi, dword [ebp - 0x228]
lea eax, [ebp - 0x22c]
push eax
push 0x42091c
push 4
push edi
push esi
mov byte [ebp - 4], 0xa
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x244], edi
mov dword [ebp - 0x284], edi
test eax, eax
js 0x40a698
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x22c]
call fcn.0040bbda
add esp, 0x10
test eax, eax
js 0x40a698
cmp dword [ebp - 0x244], 0
jne 0x40a7a2
mov eax, dword [ebp - 0x234]
cmp eax, dword [ebp - 0x2a8]
jne 0x40a7a2
xor eax, eax
lea ecx, [ebp - 0x2d0]
push str.Property
mov word [ebp - 0x2d0], ax
call fcn.004092af
mov dword [ebp - 0x224], edi
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x224]
push edx
sub esp, 0x10
mov byte [ebp - 4], 0xf
mov edi, esp
lea esi, [ebp - 0x2d0]
mov ecx, dword [eax]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x24]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
je 0x40a370
mov ecx, dword [ebp - 0x228]
xor esi, esi
mov dword [ecx + 0x10], esi
jmp 0x40a5fe
xor esi, esi
mov dword [ebp - 0x220], esi
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x220]
push edx
push 0x421350
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x13
call dword [ecx]
test eax, eax
je 0x40a3a5
mov ecx, dword [ebp - 0x228]
mov dword [ecx + 0x10], esi
jmp 0x40a5ea
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x23c], eax
push 3
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x240], eax
pop eax
mov word [ebp - 0x280], ax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x248]
lea esi, [ebp - 0x280]
lea edi, [ebp - 0x2c0]
mov byte [ebp - 4], al
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x270]
xor eax, eax
push 0x421404
mov word [ebp - 0x270], ax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004092af
sub esp, 0x10
mov byte [ebp - 4], 0x19
mov edi, esp
lea esi, [ebp - 0x2c0]
sub esp, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0x270]
push dword [ebp - 0x23c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [ebp - 0x240]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x270]
push eax
call esi
lea eax, [ebp - 0x280]
push eax
call esi
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x240], eax
push 0x13
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x23c], eax
pop eax
mov word [ebp - 0x270], ax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x268], eax
lea esi, [ebp - 0x270]
mov byte [ebp - 4], 0x1a
lea edi, [ebp - 0x2c0]
xor eax, eax
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x280]
push str.UUin
mov word [ebp - 0x280], ax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004092af
sub esp, 0x10
mov byte [ebp - 4], 0x1b
mov edi, esp
lea esi, [ebp - 0x2c0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
lea esi, [ebp - 0x280]
mov edi, esp
push dword [ebp - 0x240]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [ebp - 0x23c]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x280]
push eax
call esi
lea eax, [ebp - 0x270]
push eax
call esi
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x240], eax
push 2
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x23c], eax
pop eax
mov word [ebp - 0x270], ax
mov eax, dword [ebp - 0x238]
mov word [ebp - 0x268], ax
lea esi, [ebp - 0x270]
mov byte [ebp - 4], 0x1c
lea edi, [ebp - 0x2c0]
xor eax, eax
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x280]
push str.AppType
mov word [ebp - 0x280], ax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004092af
sub esp, 0x10
mov byte [ebp - 4], 0x1d
mov edi, esp
lea esi, [ebp - 0x2c0]
sub esp, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0x280]
push dword [ebp - 0x240]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [ebp - 0x23c]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x280]
push eax
call edi
lea eax, [ebp - 0x270]
push eax
call edi
push 0x10
xor esi, esi
lea eax, [ebp - 0x2a0]
push esi
push eax
call fcn.0040f250
add esp, 0xc
lea eax, [ebp - 0x2a0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 9
pop eax
mov word [ebp - 0x2a0], ax
mov eax, dword [ebp - 0x220]
mov byte [ebp - 4], 0x1e
mov ecx, dword [eax]
lea edx, [ebp - 0x298]
push edx
push 0x42150c
push eax
call dword [ecx]
test eax, eax
je 0x40a620
mov ecx, dword [ebp - 0x228]
xor eax, eax
mov word [ebp - 0x2a0], ax
lea eax, [ebp - 0x2a0]
push eax
mov dword [ecx + 0x10], esi
call edi
mov eax, dword [ebp - 0x220]
mov byte [ebp - 4], 0x1f
test eax, eax
je 0x40a5fe
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x224]
mov byte [ebp - 4], 0x20
test eax, eax
je 0x40a612
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x2d0]
push eax
call edi
jmp 0x40a7a5
mov eax, dword [ebp - 0x22c]
lea esi, [ebp - 0x2a0]
sub esp, 0x10
mov edi, esp
mov ecx, dword [eax]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x20]
test eax, eax
js 0x40a651
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x230]
call fcn.00409244
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x2a0]
push eax
call esi
mov eax, dword [ebp - 0x220]
mov byte [ebp - 4], 0x23
test eax, eax
je 0x40a674
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x250]
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x40a68d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x2d0]
push eax
call esi
xor edi, edi
mov eax, dword [ebp - 0x22c]
mov byte [ebp - 4], 0x25
test eax, eax
je 0x40a6ac
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [ebp - 0x230]
mov byte [ebp - 4], 8
test esi, esi
je 0x40a7bb
lea ecx, [ebp - 0x21c]
call fcn.00402263
push 0x420f6c
mov byte [ebp - 4], 0x26
call fcn.00411a4f
pop ecx
push eax
push 0x420f6c
lea ecx, [ebp - 0x208]
call fcn.00405ebd
push dword [ebp - 0x24c]
lea ecx, [ebp - 0x204]
call fcn.00405e94
mov ecx, dword [ebp - 0x228]
mov eax, dword [ecx + 0x10]
push eax
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x24c]
push esi
push eax
call fcn.0040c27c
add esp, 0xc
lea ecx, [ebp - 0x200]
push eax
call fcn.004025a7
mov eax, dword [ebp - 0x24c]
mov byte [ebp - 4], 0x27
test eax, eax
je 0x40a73a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
mov byte [ebp - 4], 0x26
inc eax
mov dword [ebp - 0x20c], edi
mov byte [ebp - 0x1fc], al
xor eax, eax
mov word [ebp - 0x218], ax
mov eax, dword [ebp - 0x238]
mov word [ebp - 0x216], ax
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x254]
mov ecx, dword [eax + 0xc]
call fcn.00401d40
mov ecx, dword [ebp - 0x228]
lea eax, [ebp - 0x230]
push eax
lea ecx, [ecx + 0x14]
call fcn.00409244
mov ecx, dword [ebp - 0x258]
mov dword [ecx], esi
lea ecx, [ebp - 0x21c]
call fcn.0040254d
jmp 0x40a7c9
mov dword [esi + 0x10], edi
mov eax, dword [ebp - 0x22c]
mov byte [ebp - 4], 0x21
test eax, eax
je 0x40a7c4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x40a7c4
mov eax, dword [ebp - 0x228]
mov dword [eax + 0x10], edi
mov edi, 0x80004005
mov ecx, dword [ebp - 0x25c]
lea ecx, [ecx - 0x10]
call fcn.00405d50
jmp 0x40a0eb