Function at 0x40d0ec
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
movsx eax, byte [esi]
cmp eax, 0x61
jb 0x40d109
sub eax, 0x20
cmp eax, 0x41
jb 0x40d119
cmp eax, 0x5a
ja 0x40d119
cmp byte [esi + 1], 0x3a
je 0x40d137
push 0x2f
push esi
call fcn.0040c07c
add esp, 8
test eax, eax
jne 0x40d137
push 0x5c
push esi
call fcn.0040c07c
add esp, 8
test eax, eax
je 0x40d13c
xor edx, edx
mov dword [ebp + 0x18], edx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
push 0x5c
push esi
call fcn.0040c280
add esp, 8
mov edi, eax
test eax, eax
je 0x40d155
inc edi
jmp 0x40d157
mov edi, esi
push 0x2e
push edi
call fcn.0040c280
add esp, 8
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40d1bf
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x118]
push edx
push 0x414505
push ecx
push esi
call fcn.0040cee4
add esp, 0x10
mov edi, eax
test eax, eax
je 0x40d21e
push 0x414506
mov edx, dword [ebp - 0x10]
push edx
call fcn.0040c124
add esp, 8
test eax, eax
je 0x40d1b6
push 0x41450b
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0040c124
add esp, 8
test eax, eax
jne 0x40d21e
mov dword [ebp - 0x14], 1
jmp 0x40d21e
mov eax, dword [ebp + 0x18]
lea edx, [ebp - 0x118]
push eax
push str..EXE
push edx
push esi
call fcn.0040cee4
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x40d21e
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x118]
push edx
push str..BAT
push ecx
push esi
call fcn.0040cee4
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x40d21e
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x118]
push edx
push str..CMD
push ecx
push esi
call fcn.0040cee4
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x14], eax
test edi, edi
je 0x40d23a
cmp dword [ebp - 0x14], 0
je 0x40d24c
push 0x41451f
call fcn.0040c72c
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x40d24c
mov dword [0x4143b0], 2
or eax, 0xffffffff
jmp 0x40d510
cmp dword [ebp - 0x14], 0
je 0x40d26b
mov edx, dword [ebp + 0x10]
push edx
push 0x414527
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0040cf9c
add esp, 0xc
mov edi, eax
jmp 0x40d284
mov eax, dword [ebp + 0x10]
add eax, 4
push eax
push 0
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx]
push ecx
call fcn.0040cf9c
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x40d29a
mov dword [0x4143b0], 8
or eax, 0xffffffff
jmp 0x40d510
cmp dword [ebp + 0x14], 0
jne 0x40d2a7
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x40d2d1
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.0040d088
pop ecx
mov dword [ebp - 8], eax
test eax, eax
jne 0x40d2d1
mov dword [0x4143b0], 8
push edi
call fcn.004028b4
pop ecx
or eax, 0xffffffff
jmp 0x40d510
call dword [0x414410]
push 0x44
push 0
lea edx, [ebp - 0x168]
push edx
call fcn.00403bf8
add esp, 0xc
mov dword [ebp - 0x168], 0x44
mov word [ebp - 0x138], 0xa
cmp dword [0x412bcc], 0
je 0x40d33a
push 0
call dword [0x412bc4]
pop ecx
mov esi, eax
mov word [ebp - 0x136], si
movzx eax, si
push eax
call fcn.004028a4
pop ecx
mov dword [ebp - 0x134], eax
test eax, eax
je 0x40d2b8
mov edx, dword [ebp - 0x134]
push edx
call dword [0x412bc4]
pop ecx
mov dword [ebp - 0x124], 0xc
xor ecx, ecx
xor esi, esi
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], 1
test bl, 0x20
je 0x40d362
or esi, 0x10
jmp 0x40d36a
test bl, 0x10
je 0x40d36a
or esi, 8
test bl, 0x40
je 0x40d375
or esi, 0x200
test bl, 0x80
je 0x40d37d
or esi, 4
test bh, 2
je 0x40d38a
or esi, 0x800
jmp 0x40d395
test bh, 4
je 0x40d395
or esi, 0x1000
test bh, 8
je 0x40d3a0
or esi, 0x4000000
test bh, 0x20
je 0x40d3aa
or esi, 0x20
jmp 0x40d3cc
test bh, 0x10
je 0x40d3b4
or esi, 0x40
jmp 0x40d3cc
test bh, 0x40
je 0x40d3c1
or esi, 0x80
jmp 0x40d3cc
test bh, 0x80
je 0x40d3cc
or esi, 0x100
lea eax, [ebp - 0x178]
lea edx, [ebp - 0x168]
push eax
push edx
push 0
lea eax, [ebp - 0x124]
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x124]
push ecx
push esi
push 1
push eax
push edx
push edi
cmp dword [ebp - 0x14], 0
je 0x40d3fd
mov ecx, dword [ebp - 0xc]
jmp 0x40d403
lea ecx, [ebp - 0x118]
push ecx
call sub.KERNEL32.DLL_CreateProcessA
dec eax
je 0x40d44a
call sub.KERNEL32.DLL_GetLastError
and eax, 0xffff
dec eax
je 0x40d42a
sub eax, 7
je 0x40d431
sub eax, 0x51
jne 0x40d438
mov eax, 0x2a
jmp 0x40d43d
mov eax, 0x13
jmp 0x40d43d
mov eax, 8
jmp 0x40d43d
mov eax, 0x15
mov dword [0x4143b0], eax
or esi, 0xffffffff
jmp 0x40d4fd
cmp ebx, 0x10
jne 0x40d454
mov ebx, 4
mov eax, ebx
and eax, 7
sub eax, 1
jb 0x40d46b
je 0x40d4b0
dec eax
je 0x40d4cb
dec eax
sub eax, 2
jb 0x40d49f
jmp 0x40d4e4
push 0xffffffffffffffff
mov edx, dword [ebp - 0x178]
push edx
call sub.KERNEL32.DLL_WaitForSingleObject
lea ecx, [ebp - 4]
push ecx
mov eax, dword [ebp - 0x178]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
test bh, 1
jne 0x40d49a
mov edx, dword [ebp - 0x178]
push edx
call sub.KERNEL32.DLL_CloseHandle
mov esi, dword [ebp - 4]
jmp 0x40d4e7
test bh, 1
jne 0x40d4b0
mov eax, dword [ebp - 0x178]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov edx, dword [ebp - 0x178]
push edx
mov ecx, dword [ebp - 0x170]
push ecx
call dword [0x4144fc]
add esp, 8
mov esi, eax
jmp 0x40d4e7
mov eax, dword [ebp - 8]
push eax
call fcn.004028b4
pop ecx
push edi
call fcn.004028b4
pop ecx
push 0
call fcn.0040c6dc
pop ecx
or esi, 0xffffffff
test bl, 0x80
jne 0x40d4fd
test bh, 1
jne 0x40d4fd
mov eax, dword [ebp - 0x174]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov edx, dword [ebp - 8]
push edx
call fcn.004028b4
pop ecx
push edi
call fcn.004028b4
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret