Function at 0x4ad0bf46
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ad0c710
push 0x4ad1c167
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
mov eax, 0x20334
call fcn.4ad01e21
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov esi, 0x4ad0c700
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ebx
mov word [ebp - 0x4040], bx
mov word [ebp - 0x8040], bx
mov dword [ebp - 0x8044], ebx
mov dword [ebp - 0x8048], 0x10
mov dword [ebp - 0x808c], 0x44
mov dword [ebp - 0x8088], ebx
mov dword [ebp - 0x8084], ebx
mov dword [ebp - 0x8080], ebx
mov dword [ebp - 0x807c], ebx
mov dword [ebp - 0x8078], ebx
mov dword [ebp - 0x8074], ebx
mov dword [ebp - 0x8070], ebx
mov dword [ebp - 0x8060], ebx
mov word [ebp - 0x805c], 1
mov word [ebp - 0x805a], bx
mov dword [ebp - 0x8058], ebx
push 0xfffffffffffffff6
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
call esi
mov dword [ebp - 0x8054], eax
push 0xfffffffffffffff5
call esi
mov dword [ebp - 0x8050], eax
push 0xfffffffffffffff4
call esi
mov dword [ebp - 0x804c], eax
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x4ad14f25
cmp word [eax], bx
je 0x4ad0c0b5
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
xor edi, edi
inc edi
push ebx
push eax
call fcn.4ad01b82
mov dword [ebp - 0x8090], eax
mov cx, word [eax]
cmp cx, 0x22
je 0x4ad14f2d
push 0x2000
cmp cx, word [0x4ad30b7c]
je 0x4ad0c483
lea eax, [ebp - 0x4040]
push eax
lea eax, [ebp - 0x8090]
push eax
push ebx
call fcn.4ad0c405
cmp eax, edi
je 0x4ad0f857
mov esi, dword [ebp - 0x8090]
cmp word [esi], bx
jne 0x4ad0e4b9
push ebx
push esi
call fcn.4ad012e4
mov dword [ebp - 0x8090], eax
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
mov eax, dword [ebp - 0x8090]
cmp word [eax], bx
jne 0x4ad0c040
mov edi, dword [sym.imp.msvcrt.dll_wcscpy]
cmp word [ebp - 0x4040], bx
je 0x4ad15103
cmp word [ebp - 0x4040], 0x22
je 0x4ad0c0eb
push 0x20
lea eax, [ebp - 0x4040]
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x4ad15117
lea eax, [ebp - 0x4040]
push eax
lea eax, [ebp - 0x18298]
push eax
call edi
pop ecx
pop ecx
lea eax, [ebp - 0x4040]
push eax
call fcn.4ad0171e
test eax, eax
je 0x4ad0c125
lea eax, [ebp - 0x4040]
push eax
call fcn.4ad0171e
push eax
lea eax, [ebp - 0x4040]
push eax
call edi
pop ecx
pop ecx
mov esi, dword [sym.imp.msvcrt.dll_wcscat]
mov byte [ebp - 0x18299], bl
mov byte [ebp - 0x1829a], bl
lea eax, [ebp - 0x182a0]
push eax
lea eax, [ebp - 0x4040]
push eax
push 0x2b
call fcn.4ad018e5
cmp eax, 0xffffffff
jne 0x4ad0e615
lea eax, [ebp - 0x4040]
push eax
lea eax, [ebp - 0x1c2a0]
push eax
call edi
pop ecx
pop ecx
lea eax, [ebp - 0x4040]
mov dword [ebp - 0x1c2b0], eax
lea eax, [ebp - 0x4040]
push eax
lea eax, [ebp - 0x1c2e8]
push eax
call fcn.4ad02193
cmp eax, ebx
je 0x4ad151e9
cmp eax, 3
je 0x4ad151e9
cmp eax, 2
je 0x4ad0e615
cmp eax, 5
je 0x4ad151d4
cmp byte [ebp - 0x1829a], bl
jne 0x4ad0c1f0
cmp byte [ebp - 0x18299], bl
jne 0x4ad0e621
lea eax, [ebp - 0x18298]
push eax
lea eax, [ebp - 0x202f0]
push eax
call edi
push 0x4ad0ba0c
lea eax, [ebp - 0x202f0]
push eax
call esi
add esp, 0x10
cmp dword [ebp - 0x24], ebx
jne 0x4ad0e4a6
lea eax, [ebp - 0x202f0]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x3c], ebx
jne 0x4ad15287
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov dword [ebp - 0x202f4], eax
lea ecx, [ebp - 0x20]
push ecx
push ebx
push ebx
push 2
push eax
mov edi, dword [sym.imp.USER32.dll_GetUserObjectInformationW]
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 0x202f8], eax
lea ecx, [ebp - 0x1c]
push ecx
push ebx
push ebx
push 2
push eax
call edi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax + 0x20]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x202fc], eax
cmp eax, ebx
je 0x4ad0c2a8
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push esi
push 2
push dword [ebp - 0x202f4]
call edi
test eax, eax
je 0x4ad0c2a8
mov eax, dword [ebp - 0x20]
cmp eax, ebx
jbe 0x4ad0c286
shr eax, 1
mov ecx, esi
lea esi, [ecx + eax*2 - 2]
mov word [esi], 0x5c
inc esi
inc esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push esi
push 2
push dword [ebp - 0x202f8]
call edi
test eax, eax
je 0x4ad0c2a8
mov eax, dword [ebp - 0x202fc]
mov dword [ebp - 0x8084], eax
cmp byte [ebp - 0x1829a], bl
jne 0x4ad15295
lea eax, [ebp - 0x2030c]
push eax
lea eax, [ebp - 0x808c]
push eax
push dword [ebp - 0x8044]
push dword [ebp - 0x28]
mov eax, dword [ebp - 0x8048]
or eax, 0x400
push eax
push 1
push ebx
push ebx
push dword [ebp - 0x24]
lea eax, [ebp - 0x4040]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
cmp dword [ebp - 0x3c], ebx
jne 0x4ad1529c
push dword [ebp - 0x202fc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, ebx
je 0x4ad0c628
push dword [ebp - 0x20308]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2030c], ebx
je 0x4ad0c33f
push dword [ebp - 0x2030c]
cmp dword [ebp - 0x40], ebx
je 0x4ad0f84c
call fcn.4ad0189e
mov dword [0x4ad2ca20], eax
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4
inc eax
inc eax
mov dword [ebp - 0x8090], eax
lea eax, [ebp - 0x10090]
push eax
lea eax, [ebp - 0x8090]
push eax
push edi
call fcn.4ad0c405
cmp eax, edi
je 0x4ad0f857
push 0x4ad0c7bc
lea eax, [ebp - 0x10090]
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x4ad14f97
push 0x4ad0c7a4
lea eax, [ebp - 0x10090]
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x4ad14fa3
push 0x4ad0c7a0
lea eax, [ebp - 0x10090]
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x4ad14faf
push dword [ebp - 0x10090]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x44
je 0x4ad14fce
push 0x4ad0c794
lea eax, [ebp - 0x10090]
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x4ad15080
push dword [ebp - 0x10090]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x49
je 0x4ad1508c
push dword [ebp - 0x10090]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x3f
je 0x4ad15163
push 0x4ad0c78c
lea eax, [ebp - 0x10090]
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x4ad150a3
push 0x4ad0c784
lea eax, [ebp - 0x10090]
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x4ad150af
push 0x4ad0c77c
lea eax, [ebp - 0x10090]
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x4ad150c1
push 0x4ad0c76c
lea eax, [ebp - 0x10090]
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x4ad150d3
push 0x4ad0c758
lea eax, [ebp - 0x10090]
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x4ad150df
push 0x4ad0c744
lea eax, [ebp - 0x10090]
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x4ad150eb
push 0x4ad0c734
lea eax, [ebp - 0x10090]
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x4ad150f7
push 0x4ad0c728
lea eax, [ebp - 0x10090]
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x4ad0c620
push 0x4ad0c724
lea eax, [ebp - 0x10090]
push eax
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4ad15194
mov dword [ebp - 0x40], edi
jmp 0x4ad0c0aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4ad28a04], eax
cmp byte [ebp - 0x1829a], bl
jne 0x4ad0c652
cmp byte [0x4ad2ca64], bl
je 0x4ad152fc
cmp eax, 0xc1
jne 0x4ad152fc
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x20348]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20348], 0x3c
mov dword [ebp - 0x20344], 0x88140
test byte [ebp - 0x8048], 0x10
je 0x4ad0c686
mov dword [ebp - 0x20344], 0x80140
lea eax, [ebp - 0x4040]
mov dword [ebp - 0x20338], eax
mov eax, dword [ebp - 0x8080]
mov dword [ebp - 0x20320], eax
lea eax, [ebp - 0x8040]
mov dword [ebp - 0x20334], eax
mov eax, dword [ebp - 0x8044]
mov dword [ebp - 0x20330], eax
movzx eax, word [ebp - 0x805c]
mov dword [ebp - 0x2032c], eax
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x20348]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x2034c], eax
cmp eax, ebx
je 0x4ad152a9
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x4ad152fc
mov eax, dword [ebp - 0x20310]
mov dword [ebp - 0x2030c], eax
jmp 0x4ad0c31e
push dword [ebp - 0x24]
lea eax, [ebp - 0x202f0]
push eax
call esi
pop ecx
pop ecx
jmp 0x4ad0c1e7
push esi
lea eax, [ebp - 0x8040]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0x8040]
mov dword [ebp - 0x24], eax
jmp 0x4ad0c097
mov byte [ebp - 0x18299], 1
jmp 0x4ad0c1a9
push str.COMSPEC
call fcn.4ad0133f
mov dword [ebp - 0x1c2ec], eax
cmp eax, ebx
je 0x4ad15207
mov edi, 0x4ad0e9ac
push edi
lea eax, [ebp - 0x14298]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x18298]
push eax
lea eax, [ebp - 0x14298]
push eax
call esi
push dword [ebp - 0x1c2ec]
lea eax, [ebp - 0x4040]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x4040]
push eax
lea eax, [ebp - 0x18298]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
push edi
lea eax, [ebp - 0x14298]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 0x28
test eax, eax
je 0x4ad0e6a5
cmp word [ebp - 0x8040], bx
jne 0x4ad15219
lea eax, [ebp - 0x14298]
mov dword [ebp - 0x24], eax
mov edi, dword [sym.imp.msvcrt.dll_wcscpy]
jmp 0x4ad0c1bd
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4ad0c33f
mov eax, edi
jmp 0x4ad0c341
lea eax, [ebp - 0x38]
jmp 0x4ad0c032
cmp dword [ebp - 0x8080], ebx
jne 0x4ad0c05a
push 0x4000
lea eax, [ebp - 0xc090]
push eax
lea eax, [ebp - 0x8090]
push eax
push edi
call fcn.4ad0c405
cmp eax, edi
je 0x4ad0f857
lea eax, [ebp - 0xc090]
push eax
call fcn.4ad0171e
test eax, eax
je 0x4ad14f86
lea eax, [ebp - 0xc090]
push eax
call fcn.4ad0171e
push eax
lea eax, [ebp - 0xc090]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0xc090]
mov dword [ebp - 0x8080], eax
jmp 0x4ad0c0aa
or byte [ebp - 0x8047], 0x80
jmp 0x4ad0c0aa
or byte [ebp - 0x8047], 0x40
jmp 0x4ad0c0aa
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], edi
mov eax, dword [ebp - 0x8048]
and eax, 0xffffffef
or eax, 0x200
mov dword [ebp - 0x8048], eax
jmp 0x4ad0c0aa
lea eax, [ebp - 0x1008e]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
test eax, eax
jbe 0x4ad14fe8
lea esi, [ebp - 0x1008e]
jmp 0x4ad15021
push ebx
push dword [ebp - 0x8090]
call fcn.4ad01b82
mov dword [ebp - 0x8090], eax
push 0x2000
lea eax, [ebp - 0x10090]
push eax
lea eax, [ebp - 0x8090]
push eax
push edi
call fcn.4ad0c405
cmp eax, edi
je 0x4ad0f857
lea esi, [ebp - 0x10090]
push esi
call fcn.4ad0171e
test eax, eax
je 0x4ad15041
push esi
call fcn.4ad0171e
push eax
lea eax, [ebp - 0x10298]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0x10298]
mov dword [ebp - 0x8044], eax
lea eax, [ebp - 0x10298]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
cmp eax, 0x104
jbe 0x4ad0c0a4
lea eax, [ebp - 0x10298]
push eax
push edi
push 0x2362
call fcn.4ad0b54d
add esp, 0xc
jmp 0x4ad0f857
or byte [ebp - 0x8048], 0x80
jmp 0x4ad0c0aa
mov eax, dword [0x4ad2ca7c]
cmp eax, ebx
je 0x4ad0c0aa
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
jmp 0x4ad0c0aa
or dword [ebp - 0x8048], 0x40
jmp 0x4ad0c0aa
or dword [ebp - 0x8060], edi
or byte [ebp - 0x805c], 7
jmp 0x4ad0c0aa
or dword [ebp - 0x8060], edi
or byte [ebp - 0x805c], 3
jmp 0x4ad0c0aa
or dword [ebp - 0x8048], 0x20
jmp 0x4ad0c0aa
or byte [ebp - 0x8047], 1
jmp 0x4ad0c0aa
or byte [ebp - 0x8047], 8
jmp 0x4ad0c0aa
or byte [ebp - 0x8047], 0x10
jmp 0x4ad0c0aa
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x4040]
push eax
call edi
pop ecx
pop ecx
jmp 0x4ad0c0c8
mov word [ebp - 0x18298], 0x22
lea eax, [ebp - 0x4040]
push eax
call fcn.4ad0171e
test eax, eax
je 0x4ad15148
lea eax, [ebp - 0x4040]
push eax
call fcn.4ad0171e
push eax
lea eax, [ebp - 0x18296]
push eax
call edi
pop ecx
pop ecx
push 0x4ad0ba08
lea eax, [ebp - 0x18298]
push eax
mov esi, dword [sym.imp.msvcrt.dll_wcscat]
call esi
pop ecx
pop ecx
jmp 0x4ad0c12b
call fcn.4ad1b35c
push ebx
push 0x2397
call fcn.4ad0d276
pop ecx
pop ecx
cmp byte [0x4ad2ca64], bl
je 0x4ad1518a
push ebx
push 0x23bf
call fcn.4ad0d276
pop ecx
pop ecx
call fcn.4ad1b3b0
jmp 0x4ad0f857
push 0x4ad1c280
lea eax, [ebp - 0x14298]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x10090]
push eax
lea eax, [ebp - 0x14298]
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x14298]
push eax
push edi
push 0x2375
call fcn.4ad0b54d
add esp, 0x1c
jmp 0x4ad0f857
cmp eax, 2
je 0x4ad0e615
mov byte [ebp - 0x1829a], 1
jmp 0x4ad0c1a9
mov byte [ebp - 0x1829a], 1
lea eax, [ebp - 0x1c2a0]
push eax
lea eax, [ebp - 0x4040]
push eax
call edi
pop ecx
pop ecx
jmp 0x4ad0c1a9
push ebx
push 0x23d2
call fcn.4ad0b54d
pop ecx
pop ecx
jmp 0x4ad15308
lea eax, [ebp - 0x8040]
push eax
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
call edi
mov dword [ebp - 0x1c2f0], eax
lea eax, [ebp - 0x14298]
push eax
call edi
pop ecx
pop ecx
add eax, dword [ebp - 0x1c2f0]
cmp eax, 0x2000
jae 0x4ad1526c
push 0x4ad0ba0c
lea eax, [ebp - 0x14298]
push eax
call esi
lea eax, [ebp - 0x8040]
push eax
lea eax, [ebp - 0x14298]
push eax
call esi
add esp, 0x10
jmp 0x4ad0e6a5
lea eax, [ebp - 0x8040]
push eax
push 1
push 0x2363
call fcn.4ad0b54d
add esp, 0xc
jmp 0x4ad0e6a5
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
jmp 0x4ad0c1f9
xor esi, esi
jmp 0x4ad0c2ed
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
jmp 0x4ad0c2f6
mov ecx, dword [ebp - 0x20328]
cmp ecx, ebx
jne 0x4ad152c2
mov dword [0x4ad28a04], 8
jmp 0x4ad0c6e1
cmp ecx, 0x20
mov dword [0x4ad28a04], 2
je 0x4ad0c6e1
mov dword [0x4ad28a04], ecx
jmp 0x4ad0c6e1
lea eax, [ebp - 0x4040]
push eax
call fcn.4ad1683f
xor eax, eax
inc eax
jmp 0x4ad0c341