Function at 0x431df0
Capabilities:
Create process on windows
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9cc
mov eax, dword [0x449314]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x968], eax
xor edi, edi
xor eax, eax
mov dword [ebp - 0x93c], esi
push 0x110
mov dword [ebp - 0x940], eax
lea eax, [ebp - 0x934]
push edi
push eax
mov dword [ebp - 0x954], ebx
mov dword [ebp - 0x95c], 0
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x414]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x24
mov dword [ebp - 0x958], edi
mov dword [ebp - 0x96c], edi
test esi, esi
je 0x4333a4
test ebx, ebx
je 0x4333a4
cmp word [esi], di
je 0x4333a4
mov dword [ebx], edi
movzx eax, word [esi]
add eax, esi
mov dword [ebp - 0x938], 0x114
mov dword [ebp - 0x948], eax
lea eax, [ebp - 0x938]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x431eca
mov eax, 5
cmp eax, dword [ebp - 0x934]
sbb edi, edi
neg edi
mov esi, dword [0x44a4f0]
mov edx, 0x44a4f4
test esi, esi
jne 0x431f00
mov ecx, 1
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x431ef2
push 0x449270
call fcn.0042d070
mov esi, dword [0x44a4f0]
test esi, esi
je 0x431faf
mov edx, dword [esi]
mov eax, edx
mov ebx, dword [esi + 4]
or eax, ebx
je 0x431faf
test byte [esi + 8], 2
je 0x431faf
cmp byte [esi + 0xf], 0x10
jb 0x431faf
mov eax, dword [ebp - 0x948]
test eax, eax
je 0x431f81
movzx esi, word [eax]
test si, si
je 0x431f6b
mov ecx, eax
lea eax, [ecx + 2]
mov dword [ebp - 0x960], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431f40
sub ecx, dword [ebp - 0x960]
mov eax, str._NULL_
sar ecx, 1
test si, si
cmovne eax, dword [ebp - 0x948]
lea ecx, [ecx*2 + 2]
jmp 0x431f8b
test si, si
mov eax, str._NULL_
mov ecx, 0xe
cmovne eax, dword [ebp - 0x948]
jmp 0x431f8b
mov ecx, 0xa
mov eax, str.NULL
push 0
push ecx
push eax
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x36
push 0x4416a8
push 0x2b
push ebx
push edx
call fcn.0042d0e0
mov esi, dword [0x44a4f0]
add esp, 0x28
mov ebx, dword [ebp - 0x93c]
movzx eax, word [ebx + 2]
test ax, ax
je 0x432437
mov esi, ebx
cmp word [esi + 6], 0
lea ebx, [esi + eax]
mov dword [ebp - 0x944], ebx
jne 0x432843
test ebx, ebx
je 0x432843
cmp word [ebx], 0
je 0x432843
mov edi, dword [ebp - 0x948]
lea eax, [ebp - 0x414]
push 0x104
push eax
push edi
mov dword [ebp - 0x970], 0x208
call fcn.00427510
test eax, eax
je 0x4323c7
push edi
call fcn.00427960
test eax, eax
je 0x4323c7
lea eax, [ebp - 0x970]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push dword [esi + 8]
lea eax, [ebp - 0x414]
push eax
call fcn.00428020
test eax, eax
jne 0x4322fd
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432052
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 0x105]
lea eax, [esi + esi]
push eax
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call eax
add esp, 4
mov dword [ebp - 0x940], eax
test eax, eax
je 0x432274
push esi
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x432274
mov esi, ebx
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4320a0
mov eax, dword [sym.imp.SHLWAPI.dll_StrStrIW]
sub esi, ecx
push ebx
push dword [ebp - 0x940]
sar esi, 1
call eax
mov ecx, eax
mov dword [ebp - 0x958], ecx
test ecx, ecx
jne 0x43222d
mov ecx, dword [0x44a4f0]
test ecx, ecx
je 0x43210e
mov edx, dword [ecx]
mov eax, edx
mov ebx, dword [ecx + 4]
or eax, ebx
mov dword [ebp - 0x94c], edx
mov dword [ebp - 0x950], ebx
je 0x432209
test byte [ecx + 8], 1
je 0x432209
cmp byte [ecx + 0xf], 9
jb 0x432209
mov ebx, dword [ebp - 0x944]
jmp 0x432167
mov ecx, 1
xor eax, eax
mov esi, 0x44a4f4
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x43212c
push 0x449270
call fcn.0042d070
mov ecx, dword [0x44a4f0]
test ecx, ecx
je 0x432209
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x94c], eax
or eax, edx
mov dword [ebp - 0x950], edx
je 0x432209
test byte [ecx + 8], 1
je 0x432209
cmp byte [ecx + 0xf], 9
jb 0x432209
movzx esi, word [ebx]
test si, si
je 0x43218c
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432174
sub ecx, edx
sar ecx, 1
lea edi, [ecx*2 + 2]
jmp 0x432191
mov edi, 0xe
test si, si
mov edx, str._NULL_
mov si, word [ebp - 0x20c]
cmovne edx, ebx
test si, si
je 0x4321c9
lea ecx, [ebp - 0x20c]
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4321b1
sub ecx, ebx
sar ecx, 1
lea ecx, [ecx*2 + 2]
jmp 0x4321ce
mov ecx, 0xe
push 0
push edi
push edx
push ecx
test si, si
lea eax, [ebp - 0x20c]
mov ebx, str._NULL_
cmove eax, ebx
push eax
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x39
push 0x4416a8
push 0x2b
push dword [ebp - 0x950]
push dword [ebp - 0x94c]
call fcn.0042d0e0
add esp, 0x30
push dword [ebp - 0x940]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [ebp - 0x940], 0
mov ebx, dword [ebp - 0x93c]
jmp 0x432845
mov ebx, dword [ebp - 0x940]
cmp ecx, ebx
jne 0x43223e
cmp word [ecx + esi*2], 0x20
je 0x432254
lea eax, [ebx + 2]
cmp ecx, eax
jne 0x43225f
cmp word [ecx + esi*2], 0x22
jne 0x43225f
cmp word [ecx + esi*2 + 2], 0x20
jne 0x43225f
mov dword [ebp - 0x93c], ebx
jmp 0x432a9b
mov ebx, dword [ebp - 0x93c]
mov dword [ebp - 0x958], 0
jmp 0x432845
mov eax, dword [0x44a4f0]
test eax, eax
jne 0x4322a2
mov ecx, 1
mov esi, 0x44a4f4
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x432299
push 0x449270
call fcn.0042d070
mov eax, dword [0x44a4f0]
test eax, eax
je 0x4322f3
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x4322f3
test byte [eax + 8], 1
je 0x4322f3
cmp byte [eax + 0xf], 9
jb 0x4322f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 4
mov dword [ebp - 0x954], eax
lea eax, [ebp - 0x954]
push eax
mov eax, dword [0x44a4f0]
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x38
push 0x4416a8
push 0x2b
push dword [eax + 4]
push dword [eax]
call fcn.0042d0e0
mov eax, dword [0x44a4f0]
add esp, 0x28
mov esi, 0xffe7
jmp 0x433303
mov ecx, dword [0x44a4f0]
test ecx, ecx
jne 0x432333
mov ecx, 1
xor eax, eax
mov esi, 0x44a4f4
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x432325
push 0x449270
call fcn.0042d070
mov ecx, dword [0x44a4f0]
test ecx, ecx
je 0x432222
mov edx, dword [ecx]
mov eax, edx
mov esi, dword [ecx + 4]
or eax, esi
je 0x432222
test byte [ecx + 8], 1
je 0x432222
cmp byte [ecx + 0xf], 9
jb 0x432222
mov di, word [ebp - 0x414]
test di, di
je 0x432388
lea ecx, [ebp - 0x414]
lea ebx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432370
sub ecx, ebx
sar ecx, 1
lea ecx, [ecx*2 + 2]
jmp 0x43238d
mov ecx, 0xe
push 0
push ecx
test di, di
lea eax, [ebp - 0x414]
mov ebx, str._NULL_
cmove eax, ebx
push eax
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x3a
push 0x4416a8
push 0x2b
push esi
push edx
call fcn.0042d0e0
mov ebx, dword [ebp - 0x93c]
add esp, 0x28
jmp 0x432845
mov eax, dword [0x44a4f0]
test eax, eax
jne 0x4323f5
mov ecx, 1
mov esi, 0x44a4f4
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x4323ec
push 0x449270
call fcn.0042d070
mov eax, dword [0x44a4f0]
test eax, eax
je 0x43242d
mov esi, dword [eax]
mov ecx, esi
mov edx, dword [eax + 4]
or ecx, edx
je 0x43242d
test byte [eax + 8], 1
je 0x43242d
cmp byte [eax + 0xf], 9
jb 0x43242d
push 0
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x37
push 0x4416a8
push 0x2b
push edx
push esi
call fcn.0042d0e0
mov eax, dword [0x44a4f0]
add esp, 0x20
mov esi, 0xffef
jmp 0x433325
push 0x208
lea eax, [ebp - 0x824]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x94c], 0
test esi, esi
je 0x432477
mov ebx, dword [esi]
mov eax, ebx
mov edx, dword [esi + 4]
or eax, edx
je 0x4324d4
test byte [esi + 8], 1
je 0x4324d4
cmp byte [esi + 0xf], 9
mov esi, 0x44a4f4
jmp 0x4324b4
mov ecx, 1
xor eax, eax
mov esi, 0x44a4f4
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x432495
push 0x449270
call fcn.0042d070
mov ecx, dword [0x44a4f0]
test ecx, ecx
je 0x4324df
mov ebx, dword [ecx]
mov eax, ebx
mov edx, dword [ecx + 4]
or eax, edx
je 0x4324d9
test byte [ecx + 8], 1
je 0x4324d9
cmp byte [ecx + 0xf], 9
jb 0x4324d9
push 0
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x3b
push 0x4416a8
push 0x2b
push edx
push ebx
call fcn.0042d0e0
add esp, 0x20
jmp 0x4324d9
mov esi, 0x44a4f4
mov ebx, dword [ebp - 0x93c]
push dword [ebp - 0x948]
call fcn.00427960
cmp eax, 1
je 0x43255a
mov eax, dword [0x44a4f0]
test eax, eax
jne 0x432518
mov ecx, 1
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x43250f
push 0x449270
call fcn.0042d070
mov eax, dword [0x44a4f0]
test eax, eax
je 0x432550
mov esi, dword [eax]
mov ecx, esi
mov edx, dword [eax + 4]
or ecx, edx
je 0x432550
test byte [eax + 8], 2
je 0x432550
cmp byte [eax + 0xf], 0x10
jb 0x432550
push 0
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x3c
push 0x4416a8
push 0x2b
push edx
push esi
call fcn.0042d0e0
mov eax, dword [0x44a4f0]
add esp, 0x20
mov esi, 0xffec
jmp 0x433325
mov ecx, dword [0x44a4f0]
test ecx, ecx
jne 0x43258c
mov ecx, 1
xor eax, eax
mov esi, 0x44a4f4
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x432582
push 0x449270
call fcn.0042d070
mov ecx, dword [0x44a4f0]
test ecx, ecx
je 0x4325c4
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x4325bf
test byte [ecx + 8], 2
je 0x4325bf
cmp byte [ecx + 0xf], 0x10
jb 0x4325bf
push 0
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x3d
push 0x4416a8
push 0x2b
push edx
push esi
call fcn.0042d0e0
add esp, 0x20
mov esi, 0x44a4f4
push 0x104
lea eax, [ebp - 0x824]
push eax
push dword [ebp - 0x948]
call fcn.00427510
test eax, eax
jne 0x4326c2
mov eax, dword [0x44a4f0]
test eax, eax
jne 0x432610
mov ecx, 1
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x432603
push 0x449270
call fcn.0042d070
mov eax, dword [0x44a4f0]
test eax, eax
je 0x4326b8
mov edx, dword [eax]
mov ecx, edx
mov esi, dword [eax + 4]
or ecx, esi
je 0x4326b8
test byte [eax + 8], 1
je 0x4326b8
cmp byte [eax + 0xf], 9
jb 0x4326b8
mov eax, dword [ebp - 0x948]
test eax, eax
je 0x43268b
movzx edi, word [eax]
test di, di
je 0x432679
mov ecx, eax
lea ebx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432650
mov eax, dword [ebp - 0x948]
sub ecx, ebx
sar ecx, 1
mov ebx, str._NULL_
test di, di
cmovne ebx, eax
lea ecx, [ecx*2 + 2]
jmp 0x432695
test di, di
mov ebx, str._NULL_
mov ecx, 0xe
cmovne ebx, eax
jmp 0x432695
mov ecx, 0xa
mov ebx, str.NULL
push 0
push ecx
push ebx
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x3e
push 0x4416a8
push 0x2b
push esi
push edx
call fcn.0042d0e0
mov eax, dword [0x44a4f0]
add esp, 0x28
mov esi, 0xffef
jmp 0x433325
test edi, edi
je 0x4326e0
lea eax, [ebp - 0x96c]
push eax
lea eax, [ebp - 0x964]
push eax
call fcn.00431980
xor ecx, ecx
test eax, eax
cmovne edi, ecx
lea eax, [ebp - 0x94c]
test edi, edi
push eax
push 0
push 1
push dword [ebx + 8]
lea esi, [ebp - 0x824]
cmovne esi, dword [ebp - 0x96c]
push esi
call fcn.00428020
cmp eax, 0xffef
jne 0x433257
push dword [ebp - 0x94c]
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call eax
mov edi, eax
add esp, 4
mov dword [ebp - 0x95c], edi
test edi, edi
jne 0x43279a
mov eax, dword [0x44a4f0]
test eax, eax
jne 0x432758
mov ecx, 1
mov esi, 0x44a4f4
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x43274f
push 0x449270
call fcn.0042d070
mov eax, dword [0x44a4f0]
test eax, eax
je 0x432790
mov esi, dword [eax]
mov ecx, esi
mov edx, dword [eax + 4]
or ecx, edx
je 0x432790
test byte [eax + 8], 1
je 0x432790
cmp byte [eax + 0xf], 9
jb 0x432790
push 0
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x3f
push 0x4416a8
push 0x2b
push edx
push esi
call fcn.0042d0e0
mov eax, dword [0x44a4f0]
add esp, 0x20
mov esi, 0xffeb
jmp 0x4332c2
lea eax, [ebp - 0x94c]
push eax
push edi
push 1
push dword [ebx + 8]
push esi
call fcn.00428020
mov esi, eax
test esi, esi
je 0x43283b
mov eax, dword [0x44a4f0]
test eax, eax
jne 0x4327e9
mov ecx, 1
mov edx, 0x44a4f4
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4327dc
push 0x449270
call fcn.0042d070
mov eax, dword [0x44a4f0]
test eax, eax
je 0x4332bd
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x4332bd
test byte [eax + 8], 1
je 0x4332bd
cmp byte [eax + 0xf], 9
jb 0x4332bd
push 0
push 4
lea ecx, [ebp - 0x970]
mov dword [ebp - 0x970], esi
push ecx
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x41
push 0x4416a8
push 0x2b
push dword [eax + 4]
push dword [eax]
call fcn.0042d0e0
add esp, 0x28
jmp 0x4332b8
mov dword [ebp - 0x944], edi
jmp 0x432845
mov ebx, esi
mov ecx, dword [ebp - 0x944]
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432850
movzx eax, word [ebx + 6]
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
test ax, ax
je 0x432885
lea edi, [ebx + eax]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432873
sub ecx, edx
inc esi
sar ecx, 1
add esi, ecx
lea ebx, [esi + esi]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp - 0x93c], eax
test eax, eax
jne 0x432912
mov eax, dword [0x44a4f0]
test eax, eax
jne 0x4328ca
mov ecx, 1
mov edx, 0x44a4f4
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4328c1
push 0x449270
call fcn.0042d070
mov eax, dword [0x44a4f0]
test eax, eax
je 0x432902
mov esi, dword [eax]
mov ecx, esi
mov edx, dword [eax + 4]
or ecx, edx
je 0x432902
test byte [eax + 8], 1
je 0x432902
cmp byte [eax + 0xf], 9
jb 0x432902
push 0
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x42
push 0x4416a8
push 0x2b
push edx
push esi
call fcn.0042d0e0
mov eax, dword [0x44a4f0]
add esp, 0x20
mov edi, dword [ebp - 0x93c]
mov esi, 0xffeb
jmp 0x4332c4
push ebx
mov ebx, dword [ebp - 0x93c]
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
push dword [ebp - 0x944]
push esi
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0x18
test edi, edi
je 0x43294f
push 0x43db6c
push esi
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push edi
push esi
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x18
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432954
mov ebx, dword [ebp - 0x940]
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 0x105]
test ebx, ebx
jne 0x432a95
lea eax, [esi + esi]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
mov dword [ebp - 0x940], ebx
test ebx, ebx
jne 0x4329f5
mov eax, dword [0x44a4f0]
test eax, eax
jne 0x4329c2
mov ecx, 1
mov edx, 0x44a4f4
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4329b5
push 0x449270
call fcn.0042d070
mov eax, dword [0x44a4f0]
test eax, eax
je 0x432902
mov esi, dword [eax]
mov ecx, esi
mov edx, dword [eax + 4]
or ecx, edx
je 0x432902
test byte [eax + 8], 1
je 0x432902
cmp byte [eax + 0xf], 9
jb 0x432902
push 0
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x43
jmp 0x4328ec
mov edi, dword [ebp - 0x93c]
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x432a95
mov eax, dword [0x44a4f0]
test eax, eax
jne 0x432a3a
mov ecx, 1
mov edx, 0x44a4f4
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x432a31
push 0x449270
call fcn.0042d070
mov eax, dword [0x44a4f0]
test eax, eax
je 0x432a8b
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x432a8b
test byte [eax + 8], 1
je 0x432a8b
cmp byte [eax + 0xf], 9
jb 0x432a8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 4
mov dword [ebp - 0x954], eax
lea eax, [ebp - 0x954]
push eax
mov eax, dword [0x44a4f0]
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x44
push 0x4416a8
push 0x2b
push dword [eax + 4]
push dword [eax]
call fcn.0042d0e0
mov eax, dword [0x44a4f0]
add esp, 0x28
mov esi, 0xffe7
jmp 0x4332c4
mov edi, dword [ebp - 0x948]
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432aa0
sub ecx, edx
mov edx, edi
sar ecx, 1
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x432ab4
sub edx, esi
lea esi, [ecx + 2]
sar edx, 1
add esi, edx
lea eax, [esi + esi]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
mov dword [ebp - 0x944], ebx
test ebx, ebx
jne 0x432b46
mov eax, dword [0x44a4f0]
test eax, eax
jne 0x432b13
mov ecx, 1
mov edx, 0x44a4f4
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x432b06
push 0x449270
call fcn.0042d070
mov eax, dword [0x44a4f0]
test eax, eax
je 0x432902
mov esi, dword [eax]
mov ecx, esi
mov edx, dword [eax + 4]
or ecx, edx
je 0x432902
test byte [eax + 8], 1
je 0x432902
cmp byte [eax + 0xf], 9
jb 0x432902
push 0
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x45
jmp 0x4328ec
push 0x44
lea eax, [ebp - 0x9cc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [ebp - 0x988], xmm0
push 1
push esi
push ebx
push edi
push dword [ebp - 0x940]
call fcn.00427ae0
test eax, eax
jne 0x432bed
push dword [ebp - 0x940]
push esi
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
mov ecx, dword [0x44a4f0]
test ecx, ecx
jne 0x432bba
mov ecx, 1
xor eax, eax
mov edx, 0x44a4f4
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x432bb0
push 0x449270
call fcn.0042d070
mov ecx, dword [0x44a4f0]
test ecx, ecx
je 0x432bed
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x432bed
test byte [ecx + 8], 2
je 0x432bed
cmp byte [ecx + 0xf], 0x10
jb 0x432bed
push 0
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x46
push 0x4416a8
push 0x2b
push edx
push esi
call fcn.0042d0e0
add esp, 0x20
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.chrome.exe_
push dword [ebp - 0x940]
call esi
test eax, eax
jne 0x432c19
push str.msedge.exe_
push dword [ebp - 0x940]
call esi
test eax, eax
je 0x432e00
mov eax, dword [ebp - 0x968]
test eax, eax
je 0x432e00
cmp word [eax], 0
je 0x432e00
mov edi, dword [ebp - 0x940]
push str.chrome.exe_
push edi
call esi
test eax, eax
je 0x432c4f
mov ebx, str.chrome.exe_
mov esi, str.GoogleChromeUser_Data_
jmp 0x432c59
mov ebx, str.msedge.exe_
mov esi, str.MicrosoftEdgeUser_Data_
push 0x208
lea eax, [ebp - 0x61c]
mov dword [ebp - 0x960], esi
push 0
push eax
mov dword [ebp - 0x978], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x61c]
push 0
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x432eb0
mov eax, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push ebx
push edi
call eax
mov dword [ebp - 0x950], eax
test eax, eax
je 0x432eb0
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x432cb0
sub ebx, ecx
lea edi, [ebp - 0x61c]
sar ebx, 1
lea ecx, [edi + 2]
nop dword [eax + eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x432cd0
mov edx, esi
sub edi, ecx
sar edi, 1
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x432ce4
sub edx, ecx
mov ecx, dword [ebp - 0x968]
sar edx, 1
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432d00
sub ecx, esi
mov esi, dword [ebp - 0x948]
sar ecx, 1
lea eax, [esi + 2]
mov dword [ebp - 0x974], eax
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x432d20
mov eax, dword [ebp - 0x950]
sub eax, dword [ebp - 0x940]
sub esi, dword [ebp - 0x974]
sar eax, 1
mov dword [ebp - 0x950], eax
add eax, edx
add eax, edi
sar esi, 1
add eax, ebx
lea edi, [ecx + 0x15]
add eax, esi
add edi, eax
lea eax, [edi + edi]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x432eb0
mov eax, dword [ebp - 0x950]
push eax
push dword [ebp - 0x940]
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
push dword [ebp - 0x978]
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push dword [ebp - 0x944]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push str.___user_data_dir_
push edi
mov ebx, esi
push esi
mov dword [ebp - 0x944], ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea eax, [ebp - 0x61c]
push eax
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push dword [ebp - 0x960]
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x44
push dword [ebp - 0x968]
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push 0x441a14
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push dword [ebp - 0x948]
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x24
jmp 0x432eb6
push str.iexplore.exe_
push dword [ebp - 0x940]
call esi
test eax, eax
je 0x432eb6
push str.iexplore.exe_
push dword [ebp - 0x940]
call esi
mov ebx, eax
test ebx, ebx
je 0x432eb0
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432e31
sub ebx, dword [ebp - 0x940]
sub ecx, edx
sar ebx, 1
sar ecx, 1
lea edi, [ebx + 0x26]
add edi, ecx
lea eax, [edi + edi]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x432eb0
push ebx
push dword [ebp - 0x940]
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
push str.iexplore.exe_
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push dword [ebp - 0x944]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push str._nohome__noframemerging
push edi
mov ebx, esi
push esi
mov dword [ebp - 0x944], ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push dword [ebp - 0x948]
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x38
jmp 0x432eb6
mov ebx, dword [ebp - 0x944]
mov ecx, dword [0x44a4f0]
test ecx, ecx
je 0x432ee5
mov edx, dword [ecx]
mov eax, edx
mov esi, dword [ecx + 4]
or eax, esi
je 0x432faa
test byte [ecx + 8], 2
je 0x432faa
cmp byte [ecx + 0xf], 0x10
jb 0x432faa
jmp 0x432f36
mov edi, 1
xor eax, eax
mov ecx, edi
mov esi, 0x44a4f4
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x432f05
push 0x449270
call fcn.0042d070
mov ecx, dword [0x44a4f0]
test ecx, ecx
je 0x432fb4
mov edx, dword [ecx]
mov eax, edx
mov esi, dword [ecx + 4]
or eax, esi
je 0x432faf
test byte [ecx + 8], 2
je 0x432faf
cmp byte [ecx + 0xf], 0x10
jb 0x432faf
test ebx, ebx
je 0x432f82
movzx edi, word [ebx]
test di, di
je 0x432f70
mov ecx, ebx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432f47
sub ecx, ebx
mov eax, str._NULL_
mov ebx, dword [ebp - 0x944]
sar ecx, 1
test di, di
cmovne eax, ebx
lea ecx, [ecx*2 + 2]
jmp 0x432f8c
test di, di
mov eax, str._NULL_
mov ecx, 0xe
cmovne eax, ebx
jmp 0x432f8c
mov ecx, 0xa
mov eax, str.NULL
push 0
push ecx
push eax
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x47
push 0x4416a8
push 0x2b
push esi
push edx
call fcn.0042d0e0
add esp, 0x28
mov edi, 1
mov esi, 0x44a4f4
lea eax, [ebp - 0x964]
push eax
push dword [ebp + 0x10]
call sub.CCMSDK.dll_CCMGetSessionInfo_V2
mov eax, dword [ebp - 0x964]
cmp dword [eax + 0x7c], 0
je 0x433066
mov ecx, dword [0x44a4f0]
test ecx, ecx
jne 0x432ffd
mov ecx, edi
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x432ff3
push 0x449270
call fcn.0042d070
mov ecx, dword [0x44a4f0]
test ecx, ecx
je 0x433030
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x433030
test byte [ecx + 8], 2
je 0x433030
cmp byte [ecx + 0xf], 0x10
jb 0x433030
push 0
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x48
push 0x4416a8
push 0x2b
push edx
push esi
call fcn.0042d0e0
add esp, 0x20
push 1
push 0
push 0
push dword [ebp - 0x948]
push str.Open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x95c]
mov dword [ebp - 0x95c], eax
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0x958], eax
jmp 0x43322c
mov ecx, dword [0x44a4f0]
test ecx, ecx
jne 0x433090
mov ecx, edi
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x433086
push 0x449270
call fcn.0042d070
mov ecx, dword [0x44a4f0]
test ecx, ecx
je 0x4330c8
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x4330c3
test byte [ecx + 8], 2
je 0x4330c3
cmp byte [ecx + 0xf], 0x10
jb 0x4330c3
push 0
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x49
push 0x4416a8
push 0x2b
push edx
push esi
call fcn.0042d0e0
add esp, 0x20
mov esi, 0x44a4f4
lea eax, [ebp - 0x988]
mov dword [ebp - 0x9cc], 0x44
push eax
lea eax, [ebp - 0x9cc]
mov dword [ebp - 0x9a0], 1
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0
mov word [ebp - 0x99c], di
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x433172
mov eax, dword [0x44a4f0]
test eax, eax
jne 0x433130
mov ecx, edi
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x433127
push 0x449270
call fcn.0042d070
mov eax, dword [0x44a4f0]
test eax, eax
je 0x433168
mov esi, dword [eax]
mov ecx, esi
mov edx, dword [eax + 4]
or ecx, edx
je 0x433168
test byte [eax + 8], 1
je 0x433168
cmp byte [eax + 0xf], 9
jb 0x433168
push 0
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x4a
push 0x4416a8
push 0x2b
push edx
push esi
call fcn.0042d0e0
mov eax, dword [0x44a4f0]
add esp, 0x20
mov esi, 0xffea
jmp 0x433233
mov ecx, dword [ebp - 0x954]
mov eax, dword [ebp - 0x980]
push dword [ebp - 0x988]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ecx], eax
call esi
push dword [ebp - 0x984]
call esi
mov eax, dword [0x44a4f0]
test eax, eax
je 0x4331bf
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x433231
test byte [eax + 8], 2
je 0x433231
cmp byte [eax + 0xf], 0x10
jae 0x4331f6
jmp 0x433231
mov ecx, edi
xor eax, eax
mov edx, 0x44a4f4
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4331da
push 0x449270
call fcn.0042d070
mov eax, dword [0x44a4f0]
test eax, eax
je 0x433231
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x433231
test byte [eax + 8], 2
je 0x433231
cmp byte [eax + 0xf], 0x10
jb 0x433231
mov ecx, dword [ebp - 0x954]
push 0
push 4
mov ecx, dword [ecx]
mov dword [ebp - 0x974], ecx
lea ecx, [ebp - 0x974]
push ecx
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x4b
push 0x4416a8
push 0x2b
push dword [eax + 4]
push dword [eax]
call fcn.0042d0e0
add esp, 0x28
mov eax, dword [0x44a4f0]
xor esi, esi
mov edi, dword [ebp - 0x93c]
test ebx, ebx
je 0x4332c4
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call ebx
mov eax, dword [0x44a4f0]
add esp, 4
jmp 0x4332ca
mov eax, dword [0x44a4f0]
test eax, eax
jne 0x433285
mov ecx, 1
mov edx, 0x44a4f4
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x43327c
push 0x449270
call fcn.0042d070
mov eax, dword [0x44a4f0]
test eax, eax
je 0x4332bd
mov esi, dword [eax]
mov ecx, esi
mov edx, dword [eax + 4]
or ecx, edx
je 0x4332bd
test byte [eax + 8], 1
je 0x4332bd
cmp byte [eax + 0xf], 9
jb 0x4332bd
push 0
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x40
push 0x4416a8
push 0x2b
push edx
push esi
call fcn.0042d0e0
add esp, 0x20
mov eax, dword [0x44a4f0]
mov esi, 0xffef
xor edi, edi
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [ebp - 0x96c]
test ecx, ecx
je 0x4332df
push ecx
call ebx
mov eax, dword [0x44a4f0]
add esp, 4
mov ecx, dword [ebp - 0x95c]
test ecx, ecx
je 0x4332f4
push ecx
call ebx
mov eax, dword [0x44a4f0]
add esp, 4
test edi, edi
je 0x433303
push edi
call ebx
mov eax, dword [0x44a4f0]
add esp, 4
mov ecx, dword [ebp - 0x940]
test ecx, ecx
je 0x433325
cmp dword [ebp - 0x958], 0
jne 0x433325
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [0x44a4f0]
add esp, 4
test eax, eax
jne 0x43334e
mov ecx, 1
mov edx, 0x44a4f4
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x433345
push 0x449270
call fcn.0042d070
mov eax, dword [0x44a4f0]
test eax, eax
je 0x43338f
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x43338f
test byte [eax + 8], 2
je 0x43338f
cmp byte [eax + 0xf], 0xd
jb 0x43338f
push 0
push 4
lea ecx, [ebp - 0x964]
mov dword [ebp - 0x964], esi
push ecx
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x4c
push 0x4416a8
push 0x2b
push dword [eax + 4]
push dword [eax]
call fcn.0042d0e0
add esp, 0x28
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043624e
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [0x44a4f0]
test ecx, ecx
jne 0x4333d6
mov ecx, 1
mov edx, 0x44a4f4
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4333cc
push 0x449270
call fcn.0042d070
mov ecx, dword [0x44a4f0]
test ecx, ecx
je 0x433409
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x433409
test byte [ecx + 8], 1
je 0x433409
cmp byte [ecx + 0xf], 9
jb 0x433409
push 0
push 0x1e
push str.RedirectHelper_ShellLaunchCmd
push 0x35
push 0x4416a8
push 0x2b
push edx
push esi
call fcn.0042d0e0
add esp, 0x20
mov ecx, dword [ebp - 4]
mov eax, 0xffec
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043624e
mov esp, ebp
pop ebp
ret 0x10