Function at 0x4842b0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x18a8
call fcn.0049e430
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x18a4], eax
push ebx
mov ecx, 0x4e0c08
call fcn.00411260
mov bl, byte [esp + 0x18b4]
test bl, bl
je 0x4842fc
test al, 1
jne 0x4842fc
xor al, al
pop ebx
mov ecx, dword [esp + 0x18a4]
xor ecx, esp
call fcn.0049dea6
add esp, 0x18a8
ret 0x10
push ebp
push esi
call fcn.00486ab0
xor esi, esi
push esi
mov ebp, eax
mov byte [0x4f8070], 0
call fcn.0047b410
lea eax, [esp + 0x10]
push eax
mov ecx, 0x4e0c08
call fcn.004136e0
push 0x4e798c
push 0x4e758c
mov ecx, 0x4e0c08
call fcn.00413690
mov ecx, dword [esp + 0x20]
mov dword [0x4e613c], ecx
mov byte [0x4e585a], bl
mov dword [0x4e5d1c], 1
mov dword [0x4e57fc], esi
mov dword [0x4e5820], esi
call fcn.00482090
push esi
lea edx, [esp + 0xcb4]
push edx
mov ecx, 0x4e0c08
call fcn.00413690
push esi
lea eax, [esp + 0x4b4]
push eax
mov ecx, 0x4e0c08
call fcn.00413650
cmp dword [esp + 0x84], esi
mov ecx, dword [esp + 0x18c4]
mov ebx, dword [esp + 0x18b8]
push ecx
setne dl
movzx eax, dl
push eax
push ebx
lea ecx, [esp + 0xcbc]
push ecx
push 0x4b1914
push 0x4f8070
call fcn.00482c00
test bl, bl
je 0x4843d0
push 1
call fcn.00483970
test al, al
je 0x484705
cmp byte [esp + 0x4b0], 0
push edi
jne 0x484408
mov ecx, 0x4dfee0
call fcn.0043ebe0
mov ecx, 0x4dfee0
mov edi, eax
call fcn.0043ec40
cmp edi, eax
jne 0x484408
cmp dword [esp + 0x88], esi
je 0x484412
cmp byte [esp + 0xa9], 0
jne 0x484412
cmp byte [esp + 0x18c4], 0
je 0x484419
push 0x4b175c
jmp 0x48448b
mov edx, dword [0x4e818c]
push esi
push edx
mov ecx, 0x4dfee0
call fcn.0043ee00
test al, al
je 0x484592
mov eax, dword [0x4e818c]
cmp dword [eax + 0x30], esi
jne 0x484496
xor eax, eax
nop
mov cl, byte [esp + eax + 0x4b4]
mov byte [esp + eax + 0xb4], cl
inc eax
test cl, cl
jne 0x484440
cmp byte [esp + 0xb4], cl
je 0x484469
lea ecx, [esp + 0xb4]
push ecx
call fcn.0044dfb0
lea edi, [esp + 0xb4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x484471
mov dx, word [0x4b175c]
lea eax, [esp + 0xb4]
mov word [edi], dx
push eax
mov ecx, dword [0x4e818c]
call fcn.00465910
cmp dword [esp + 0x88], esi
je 0x484512
cmp byte [esp + 0xa9], 0
jne 0x484512
mov ecx, 0x4dfee0
call fcn.0043ebe0
mov esi, eax
test esi, esi
je 0x484502
cmp byte [esp + 0x4b4], 0
jne 0x484512
mov ecx, 0x4dfee0
call fcn.0043ec40
cmp esi, eax
jne 0x484512
mov ecx, dword [0x4dc1c8]
mov edx, dword [0x4c9360]
push 0x4e758c
push 0x482b50
push ecx
push str.ASKPROCESSVOLDLG
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 0xffffffff
je 0x484592
cmp eax, 1
jne 0x484512
mov ecx, dword [0x4e818c]
push 0x4b175c
call fcn.00465910
mov bl, byte [esp + 0x18c0]
xor eax, eax
mov byte [esp + 0x8b4], 0
mov word [esp + 0x10b4], ax
test bl, bl
jne 0x484599
cmp byte [0x4f8070], bl
je 0x484599
cmp dword [0x4e5768], 5
je 0x484599
push 0x400
lea ecx, [esp + 0x10b8]
push ecx
lea edx, [esp + 0x8bc]
push edx
call fcn.0047e400
push 0
push 0
push 0x4f8070
call fcn.00430250
push 0x4f8070
call fcn.004ac458
add esp, 4
cmp eax, 0xffffffff
jne 0x484599
push 0x4f8070
push 0x1f7
call fcn.0045bde0
push eax
call fcn.0048e100
add esp, 8
xor al, al
jmp 0x484704
push 0
push 0
mov ecx, 0x4e0c08
call fcn.00416240
cmp byte [esp + 0x8b4], 0
jne 0x4845bc
cmp word [esp + 0x10b4], 0
je 0x4845d1
lea eax, [esp + 0x10b4]
push eax
lea ecx, [esp + 0x8b8]
push ecx
call fcn.0047e3b0
call fcn.00486ab0
cmp ebp, eax
jne 0x484613
cmp dword [0x4db840], 0
jne 0x484613
mov byte [esp + 0x13], 1
test bl, bl
je 0x48461a
push 0x40
push 0x3a7
call fcn.0045bde0
push eax
push 0x3a8
call fcn.0045bde0
mov edx, dword [0x4dc1c8]
push eax
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x484652
mov byte [esp + 0x13], 0
jmp 0x484652
cmp dword [0x4e6950], 0
je 0x484652
push 0x4e798c
push 0x4e758c
call fcn.0042f950
test al, al
jne 0x484652
mov ecx, 0x4dfee0
call fcn.00440a40
test al, al
je 0x484652
push 0
push 0
mov ecx, 0x4dfee0
call fcn.00440fc0
mov ecx, 0x4dc1d0
mov byte [0x4dc1fc], 0
call fcn.00464f70
test bl, bl
jne 0x484700
cmp dword [0x4db840], 0
jne 0x484700
cmp byte [0x4f806c], bl
je 0x484700
mov eax, 0x4f8070
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x484690
sub eax, edx
cmp eax, 0x3fe
jae 0x484700
xor eax, eax
mov cl, byte [eax + 0x4f8070]
mov byte [esp + eax + 0xb4], cl
inc eax
test cl, cl
jne 0x4846a2
lea eax, [esp + 0xb4]
push eax
call fcn.0044dfb0
lea edi, [esp + 0xb4]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4846d0
mov cx, word [0x4b2160]
push 1
push 0x4b1914
push 0
lea edx, [esp + 0xc0]
push edx
push str.open
push 0
mov word [edi], cx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov al, byte [esp + 0x13]
pop edi
mov ecx, dword [esp + 0x18b0]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049dea6
add esp, 0x18a8
ret 0x10