Function at 0x14009940
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, ecx
call fcn.1400b5cb
xor ebx, ebx
test al, al
je 0x1400998a
mov ecx, dword [esi + 0x124]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x8c]
mov ecx, dword [esi + 0x128]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x8c]
mov ecx, dword [esi + 0x12c]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x8c]
mov ecx, dword [esi + 0x130]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x8c]
mov eax, dword [esp + 0xc]
cmp eax, dword [esi + 0x50]
jne 0x14009c4d
push ebp
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push edi
mov edi, dword [esp + 0x1c]
cmp edi, 5
jne 0x140099da
mov ecx, dword [esi + 0x134]
mov byte [esi + 0x92], bl
call fcn.1401a776
mov edi, dword [esi + 0x50]
call fcn.1401abd9
call fcn.1400b5cb
test al, al
jne 0x14009a9e
push 0xfffffffffffffffe
push esi
call fcn.140096bf
mov edi, dword [esp + 0x1c]
cmp edi, 0x1c
jne 0x14009a0a
call fcn.1400b5cb
test al, al
je 0x140099f5
push 5
push esi
call fcn.140096bf
jmp 0x14009aa2
push dword [esi + 0x50]
xor al, al
call fcn.1401e5fe
mov ecx, dword [0x14047ccc]
mov eax, dword [ecx]
call dword [eax + 8]
cmp edi, 0xf
jne 0x14009a27
push dword [0x14047be0]
xor al, al
call fcn.1401e5fe
mov ecx, dword [0x1404805c]
mov eax, dword [ecx]
call dword [eax + 8]
cmp edi, 3
jne 0x14009a44
push 6
push dword [esi + 0x50]
call ebp
call fcn.1400b5cb
test al, al
jne 0x14009aa2
push 0xfffffffffffffffe
push esi
call fcn.140096bf
cmp edi, 0x1b
jne 0x14009a83
call fcn.1400b5cb
push 0xa
push ebx
test al, al
je 0x14009a6d
push str.http:__www.onlinecentersupport.net
push str.iexplore
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x14009aa2
push str.http:__www.supportonlinecenter.com
push str.iexplore
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp edi, 0x1d
jne 0x14009aa2
call fcn.1400b5cb
test al, al
jne 0x14009aa2
mov ecx, dword [0x14047cd0]
mov eax, dword [ecx]
call dword [eax + 8]
jmp 0x14009aa2
mov edi, dword [esp + 0x1c]
mov eax, edi
sub eax, 0x14
je 0x14009be9
dec eax
je 0x14009bbe
dec eax
je 0x14009b7f
dec eax
je 0x14009b2b
dec eax
jne 0x14009c4b
mov eax, dword [esi + 0x120]
mov dword [esi + 0x114], 4
push ebx
push dword [eax + 0x50]
mov byte [eax + 0x92], bl
call ebp
mov eax, dword [esi + 0x124]
push ebx
push dword [eax + 0x50]
mov byte [eax + 0x92], bl
call ebp
mov eax, dword [esi + 0x128]
push ebx
push dword [eax + 0x50]
mov byte [eax + 0x92], bl
call ebp
mov eax, dword [esi + 0x12c]
push ebx
push dword [eax + 0x50]
mov byte [eax + 0x92], bl
call ebp
mov esi, dword [esi + 0x130]
mov byte [esi + 0x92], 1
push 1
jmp 0x14009c46
mov eax, dword [esi + 0x120]
mov dword [esi + 0x114], 3
push ebx
push dword [eax + 0x50]
mov byte [eax + 0x92], bl
call ebp
mov eax, dword [esi + 0x124]
push ebx
push dword [eax + 0x50]
mov byte [eax + 0x92], bl
call ebp
mov eax, dword [esi + 0x128]
push ebx
push dword [eax + 0x50]
mov byte [eax + 0x92], bl
call ebp
mov eax, dword [esi + 0x12c]
mov byte [eax + 0x92], 1
push 1
jmp 0x14009c34
mov eax, dword [esi + 0x120]
mov dword [esi + 0x114], 2
push ebx
push dword [eax + 0x50]
mov byte [eax + 0x92], bl
call ebp
mov eax, dword [esi + 0x124]
push ebx
push dword [eax + 0x50]
mov byte [eax + 0x92], bl
call ebp
mov eax, dword [esi + 0x128]
mov byte [eax + 0x92], 1
push 1
jmp 0x14009c22
mov eax, dword [esi + 0x120]
xor edi, edi
inc edi
mov dword [esi + 0x114], edi
push ebx
push dword [eax + 0x50]
mov byte [eax + 0x92], bl
call ebp
mov eax, dword [esi + 0x124]
mov byte [eax + 0x92], 1
push edi
jmp 0x14009c10
mov eax, dword [esi + 0x120]
mov dword [esi + 0x114], ebx
push 1
push dword [eax + 0x50]
mov byte [eax + 0x92], 1
call ebp
mov eax, dword [esi + 0x124]
mov byte [eax + 0x92], bl
push ebx
push dword [eax + 0x50]
call ebp
mov eax, dword [esi + 0x128]
push ebx
mov byte [eax + 0x92], bl
push dword [eax + 0x50]
call ebp
mov eax, dword [esi + 0x12c]
mov byte [eax + 0x92], bl
push ebx
push dword [eax + 0x50]
call ebp
mov esi, dword [esi + 0x130]
push ebx
mov byte [esi + 0x92], bl
push dword [esi + 0x50]
call ebp
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
ret 0xc