Function at 0x41e6f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10d0c
call fcn.004444f0
mov eax, dword [ebp + 0x1c]
test eax, eax
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
je 0x41e716
mov dword [eax], 0
mov ecx, dword [ebp + 0x24]
test ecx, ecx
je 0x41e728
push 0
push 0xffffffffffffffff
push 0
call fcn.0043e8a0
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x41efea
cmp byte [ebx], 0
je 0x41efea
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41e741
sub eax, edx
cmp eax, 0x4001
jb 0x41e774
mov al, byte [ebp + 0x14]
test al, al
je 0x41e769
push 0x44f4f8
push str.The_string_to_be_run_is_too_long.__The_current_thread_will_exit.
mov ecx, esi
call fcn.0041e570
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41e787
cmp byte [eax], 0
jne 0x41e787
mov dword [ebp + 0x10], 0
mov eax, dword [ebp + 0xc]
test eax, eax
mov dword [esp + 0x1c], ebx
je 0x41e81c
push str.find
push ebx
mov dword [esp + 0x18], eax
call fcn.0044e5aa
add esp, 8
test eax, eax
je 0x41e860
push str.explore
push ebx
call fcn.0044e5aa
add esp, 8
test eax, eax
je 0x41e860
push str.open
push ebx
call fcn.0044e5aa
add esp, 8
test eax, eax
je 0x41e860
push str.edit
push ebx
call fcn.0044e5aa
add esp, 8
test eax, eax
je 0x41e860
push str.print
push ebx
call fcn.0044e5aa
add esp, 8
test eax, eax
je 0x41e860
push str.properties
push ebx
call fcn.0044e5aa
add esp, 8
test eax, eax
je 0x41e860
mov byte [esp + 0xe], 0
jmp 0x41ea6e
push 0x4000
lea eax, [esp + 0x504]
push ebx
push eax
mov dword [esp + 0x1c], 0x44f4f8
call fcn.00443880
mov al, byte [esp + 0x50c]
add esp, 0xc
cmp al, 0x22
mov byte [esp + 0x4500], 0
jne 0x41e86a
lea esi, [esp + 0x501]
mov ecx, esi
push 0x22
push ecx
call fcn.00443dd0
jmp 0x41e87e
mov byte [esp + 0xe], 1
jmp 0x41ea6e
lea esi, [esp + 0x500]
mov edx, esi
push 0x451538
push edx
call fcn.00409fc0
add esp, 8
test eax, eax
je 0x41e88d
mov byte [eax], 0
lea edi, [eax + 1]
jmp 0x41e88f
xor edi, edi
push str.find
push esi
call fcn.0044e5aa
add esp, 8
test eax, eax
je 0x41eafb
push str.explore
push esi
call fcn.0044e5aa
add esp, 8
test eax, eax
je 0x41eafb
push str.open
push esi
call fcn.0044e5aa
add esp, 8
test eax, eax
je 0x41eafb
push str.edit
push esi
call fcn.0044e5aa
add esp, 8
test eax, eax
je 0x41eafb
push str.print
push esi
call fcn.0044e5aa
add esp, 8
test eax, eax
je 0x41eafb
push str.properties
push esi
call fcn.0044e5aa
add esp, 8
test eax, eax
je 0x41eafb
push 0x4001
lea eax, [esp + 0x504]
push ebx
push eax
mov byte [esp + 0x1a], 0
call fcn.00401050
lea ecx, [esp + 0x50c]
push str..exe
push ecx
call fcn.0043c570
add esp, 0x14
test eax, eax
jne 0x41ea39
lea edx, [esp + 0x500]
push str..exe_
push edx
call fcn.0043c570
add esp, 8
test eax, eax
jne 0x41ea39
lea eax, [esp + 0x500]
push str..bat
push eax
call fcn.0043c570
add esp, 8
test eax, eax
jne 0x41ea39
lea ecx, [esp + 0x500]
push str..bat_
push ecx
call fcn.0043c570
add esp, 8
test eax, eax
jne 0x41ea39
lea edx, [esp + 0x500]
push str..com
push edx
call fcn.0043c570
add esp, 8
test eax, eax
jne 0x41ea39
lea eax, [esp + 0x500]
push str..com_
push eax
call fcn.0043c570
add esp, 8
test eax, eax
jne 0x41ea39
lea ecx, [esp + 0x500]
push str..cmd
push ecx
call fcn.0043c570
add esp, 8
test eax, eax
jne 0x41ea39
lea edx, [esp + 0x500]
push str..cmd_
push edx
call fcn.0043c570
add esp, 8
test eax, eax
jne 0x41ea39
lea eax, [esp + 0x500]
push str..hta
push eax
call fcn.0043c570
add esp, 8
test eax, eax
jne 0x41ea39
lea ecx, [esp + 0x500]
push str..hta_
push ecx
call fcn.0043c570
add esp, 8
test eax, eax
je 0x41ea6e
mov cl, byte [eax + 4]
add eax, 4
cmp cl, 0x22
lea edx, [esp + 0x500]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], eax
jne 0x41ea58
inc eax
mov dword [esp + 0x10], eax
cmp byte [eax], 0
je 0x41ea6e
mov byte [eax], 0
inc eax
push eax
mov dword [esp + 0x14], eax
call fcn.0040e2d0
add esp, 4
mov edx, dword [ebp + 0x18]
xor eax, eax
mov byte [esp + 0xf8], 0
mov ecx, 0x7f
lea edi, [esp + 0xf9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [ebp + 0x20]
test al, al
mov byte [esp + 0xf], 0
mov dword [esp + 0x18], 0
je 0x41eb1e
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x380]
test eax, eax
je 0x41eb1e
cmp word [eax], 0
jne 0x41eacc
mov eax, dword [ecx + 0x384]
cmp word [eax], 0
jne 0x41eacc
mov ecx, dword [ecx + 0x388]
cmp word [ecx], 0
je 0x41eb1e
mov al, byte [esp + 0xe]
test al, al
mov bl, 1
je 0x41eb2c
mov al, byte [ebp + 0x14]
test al, al
je 0x41eaf0
mov ecx, dword [esp + 0x14]
push 0x44f4f8
push str.System_verbs_arent_supported_when_RunAs_is_in_effect.__The_current_thread_will_exit.
call fcn.0041e570
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
test edi, edi
mov byte [esp + 0xe], 1
mov dword [esp + 0x1c], esi
je 0x41eb11
mov dword [esp + 0x10], edi
jmp 0x41ea6e
mov dword [esp + 0x10], 0x44f4f8
jmp 0x41ea6e
mov al, byte [esp + 0xe]
xor bl, bl
test al, al
jne 0x41ee48
xor eax, eax
xor esi, esi
cmp edx, esi
mov ecx, 0x10
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
mov eax, 1
mov dword [esp + 0x30], 0x44
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x5c], eax
je 0x41eb71
cmp byte [edx], 0
je 0x41eb71
mov edx, dword [ebp + 0x18]
push edx
call fcn.0040fdc0
add esp, 4
mov word [esp + 0x60], ax
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0xc]
cmp eax, esi
mov dword [esp + 0x20], esi
je 0x41ebb5
cmp byte [eax], 0
je 0x41ebb5
mov ecx, dword [ebp + 8]
push eax
push ecx
push str._s__s
lea edx, [esp + 0x4d14]
push 0x4001
push edx
call fcn.0043c2b0
add esp, 0x14
jmp 0x41ebce
mov eax, dword [ebp + 8]
push 0x4001
push eax
lea ecx, [esp + 0x4d10]
push ecx
call fcn.00401050
add esp, 0xc
test bl, bl
je 0x41edb5
push str.advapi32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, esi
jne 0x41ec0c
mov al, byte [ebp + 0x14]
test al, al
je 0x41ec01
mov ecx, dword [esp + 0x14]
push 0x44f4f8
push str.RunAs:_Could_not_load_advapi32.dll.__The_current_thread_will_exit.
call fcn.0041e570
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
push str.CreateProcessWithLogonW
push edi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x41ec4c
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov al, byte [ebp + 0x14]
test al, al
je 0x41ec41
mov ecx, dword [esp + 0x14]
push 0x44f4f8
push str.RunAs:_Bad_CreateProcessWithLogonW.__The_current_thread_will_exit.
call fcn.0041e570
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
mov dx, word [esp + 0x60]
push 0x8002
lea eax, [esp + 0x4d0c]
push eax
lea ecx, [esp + 0x8d18]
push ecx
mov dword [esp + 0x84], 0x44
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0xb0], 1
mov word [esp + 0xb6], bx
mov dword [esp + 0xb8], ebx
mov word [esp + 0xb4], dx
call fcn.00445048
mov eax, dword [ebp + 0x10]
add esp, 0xc
cmp eax, ebx
je 0x41ecdc
cmp byte [eax], 0
je 0x41ecdc
push 0x208
push eax
lea edx, [esp + 0x300]
push edx
call fcn.00445048
mov ax, word [esp + 0x304]
add esp, 0xc
jmp 0x41ece7
xor ax, ax
mov word [esp + 0x2f8], ax
neg ax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x7c]
push edx
lea ecx, [esp + 0x300]
lea edx, [esp + 0x8d18]
sbb eax, eax
and eax, ecx
push eax
push ebx
push ebx
push edx
push ebx
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0x384]
mov ecx, dword [ebx + 0x388]
mov edx, dword [ebx + 0x380]
push 1
push eax
push ecx
push edx
call esi
test eax, eax
je 0x41ed5b
mov eax, dword [esp + 0x24]
test eax, eax
mov byte [esp + 0xf], 1
je 0x41ed40
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp + 0x24]
test ecx, ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], eax
je 0x41ed80
mov edx, dword [esp + 0x28]
push edx
call fcn.0043fab0
jmp 0x41ed80
push 0
push 0x1ff
lea eax, [esp + 0x100]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov al, byte [esp + 0xf]
test al, al
jne 0x41ee04
mov al, byte [ebp + 0x14]
test al, al
je 0x41edaa
lea edx, [esp + 0xf8]
push edx
push str.Launch_Error__possibly_related_to_RunAs_.__The_current_thread_will_exit.
mov ecx, ebx
call fcn.0041e570
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
mov eax, dword [ebp + 0x10]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push eax
push esi
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x4d28]
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x41ee23
mov eax, dword [esp + 0x24]
cmp eax, esi
je 0x41edea
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp + 0x24], esi
mov edx, dword [esp + 0x20]
mov dword [esp + 0x18], edx
je 0x41ee04
mov eax, dword [esp + 0x28]
mov ecx, dword [ebp + 0x24]
push eax
call fcn.0043fab0
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x41efdb
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
push esi
push 0x1ff
lea ecx, [esp + 0x100]
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push esi
push 0x1000
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
mov edx, dword [ebp + 0x18]
xor eax, eax
mov ecx, 0xe
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
cmp edx, ebx
mov dword [esp + 0x30], 0x3c
mov dword [esp + 0x34], 0x440
mov dword [esp + 0x48], eax
je 0x41ee89
cmp byte [edx], 0
je 0x41ee89
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.0040fdc0
add esp, 4
mov dword [esp + 0x4c], eax
jmp 0x41ee91
mov dword [esp + 0x4c], 1
mov al, byte [esp + 0xe]
test al, al
mov edi, dword [esp + 0x1c]
je 0x41eec6
push str.properties
push edi
mov dword [esp + 0x44], edi
call fcn.0044e5aa
add esp, 8
test eax, eax
jne 0x41eeb8
or dword [esp + 0x34], 0xc
mov esi, dword [esp + 0x10]
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], ebx
jmp 0x41eed6
mov esi, dword [esp + 0x10]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], esi
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x41eef2
mov eax, dword [esp + 0x68]
mov dword [esp + 0x18], eax
jmp 0x41ee04
push ebx
push 0x1ff
lea ecx, [esp + 0x100]
push ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
mov al, byte [ebp + 0x14]
test al, al
je 0x41efd0
mov al, byte [esp + 0xe]
test al, al
je 0x41ef44
push edi
push str._nVerb:___s_
lea edx, [esp + 0x80]
push 0x80
push edx
call fcn.0043c2b0
add esp, 0x10
jmp 0x41ef49
mov byte [esp + 0x78], 0
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ef50
sub eax, edx
cmp eax, 0x190
mov esi, 0x451578
ja 0x41ef6a
mov esi, 0x44f4f8
mov edi, dword [esp + 0x1c]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ef73
sub eax, edx
cmp eax, 0x190
mov eax, 0x451578
ja 0x41ef8d
mov eax, 0x44f4f8
mov ecx, dword [esp + 0x10]
push esi
push ecx
lea edx, [esp + 0x80]
push edx
push eax
push edi
push str.Failed_attempt_to_launch_program_or_document:_nAction:____0.400s_s__s_nParams:____0.400s_s__n_nThe_current_thread_will_exit.
lea eax, [esp + 0x4520]
push 0x800
push eax
call fcn.0043c2b0
add esp, 0x20
lea ecx, [esp + 0xf8]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x450c]
push edx
call fcn.0041e570
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41efea
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x20