Function at 0x4e433c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x3d
push 0
push 0
dec ecx
jne 0x4e4344
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405c1c
xor eax, eax
push ebp
push 0x4e4f17
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea eax, [ebp - 0x164]
mov ecx, dword [ebp - 4]
mov edx, 0x4e4f2c
call fcn.00405a78
mov edx, dword [ebp - 0x164]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x168]
mov eax, dword [ebp - 4]
call fcn.00409ad4
mov ecx, dword [ebp - 0x168]
mov edx, 0x4e4f5c
mov eax, 0x80000001
call fcn.00488b2c
cmp dword [ebp - 0x10], 0
je 0x4e43d8
mov eax, dword [ebp - 0x10]
call fcn.0040a8f4
test al, al
jne 0x4e43d8
lea eax, [ebp - 0x10]
call fcn.00405758
cmp dword [ebp - 0x10], 0
jne 0x4e442d
lea edx, [ebp - 0x16c]
mov eax, 0x26
call fcn.00488534
push dword [ebp - 0x16c]
push 0x4e4f74
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 4]
call fcn.0040adc4
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x170]
xor edx, edx
call fcn.0040abf0
push dword [ebp - 0x170]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405aec
mov eax, dword [ebp - 0x10]
call fcn.0040a8f4
test al, al
je 0x4e4462
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x178]
mov ecx, dword [ebp - 4]
mov edx, 0x4e4f80
call fcn.00405a78
mov eax, dword [ebp - 0x178]
mov cl, 1
mov edx, dword [ebp - 0x10]
call fcn.00488470
jmp 0x4e44bf
mov eax, dword [ebp - 0x10]
call fcn.0040afc4
lea eax, [ebp - 8]
push eax
push 0x4e4f80
push dword [ebp - 4]
push 0x4e4fb8
push 0x4e4fc4
push 0x4e4fb8
push 0x4e5010
lea eax, [ebp - 0x17c]
mov edx, 6
call fcn.00405aec
mov eax, dword [ebp - 0x17c]
mov cl, 1
mov edx, dword [ebp - 0x10]
call fcn.00488470
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00405b78
je 0x4e44bf
mov eax, dword [ebp - 0x10]
call fcn.0040afe0
cmp dword [ebp - 8], 0
jne 0x4e44ef
mov eax, 0x4e5044
call fcn.0043e398
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e5064
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4e4eec
lea edx, [ebp - 0x180]
mov eax, dword [ebp - 8]
call fcn.00409ad4
mov edx, dword [ebp - 0x180]
lea eax, [ebp - 8]
call fcn.004057f0
mov eax, dword [ebp - 8]
test eax, eax
je 0x4e4517
sub eax, 4
mov eax, dword [eax]
cmp eax, 4
jge 0x4e4528
mov eax, 0x4e5084
call fcn.0043e398
xor ebx, ebx
mov eax, dword [ebp - 8]
call fcn.00405c2c
mov esi, eax
mov eax, esi
mov edx, 0x4e50e8
call fcn.0040b1cc
test eax, eax
jne 0x4e4552
mov eax, esi
mov edx, 0x4e50f0
call fcn.0040b1cc
test eax, eax
je 0x4e455e
mov eax, 0x4e5100
call fcn.0043e398
xor ebx, ebx
mov eax, esi
mov edx, 0x4e5154
call fcn.0040b1cc
test eax, eax
je 0x4e457a
mov eax, 0x4e5168
call fcn.0043e398
xor ebx, ebx
mov eax, dword [ebp - 8]
call fcn.00405c2c
mov esi, eax
mov eax, esi
mov edx, 0x4e51e4
call fcn.0040b1cc
test eax, eax
jne 0x4e45c4
mov eax, esi
mov edx, 0x4e51ec
call fcn.0040b1cc
test eax, eax
jne 0x4e45c4
mov eax, esi
mov edx, 0x4e51f4
call fcn.0040b1cc
test eax, eax
jne 0x4e45c4
mov eax, esi
mov edx, 0x4e51f8
call fcn.0040b1cc
test eax, eax
je 0x4e45d0
mov eax, 0x4e5208
call fcn.0043e398
xor ebx, ebx
test bl, bl
je 0x4e4366
lea eax, [ebp - 8]
mov edx, 0x4e4f74
call fcn.00405a34
lea eax, [ebp - 0x184]
mov ecx, dword [ebp - 4]
mov edx, 0x4e5278
call fcn.00405a78
mov edx, dword [ebp - 0x184]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4e4620
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
sub ecx, 4
jno 0x4e4630
call fcn.00404728
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405c8c
mov eax, dword [ebp - 4]
mov edx, 0x4e529c
call fcn.00405b78
jne 0x4e466c
push 0x4e52b4
push dword [ebp - 0x14]
push 0x4e52c8
push dword [0x4f65f0]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00405aec
mov eax, dword [ebp - 4]
mov edx, 0x4e52d4
call fcn.00405b78
jne 0x4e469b
push 0x4e52b4
push dword [ebp - 0x14]
push 0x4e52c8
push dword [0x4f65f4]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00405aec
mov eax, dword [ebp - 4]
mov edx, 0x4e52e8
call fcn.00405b78
jne 0x4e46ca
push 0x4e52b4
push dword [ebp - 0x14]
push 0x4e52c8
push dword [0x4f65f8]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00405aec
mov eax, dword [ebp - 4]
mov edx, 0x4e5300
call fcn.00405b78
jne 0x4e46e6
lea eax, [ebp - 0x14]
mov edx, 0x4e531c
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5350
call fcn.00405b78
jne 0x4e4702
lea eax, [ebp - 0x14]
mov edx, 0x4e531c
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5368
call fcn.00405b78
jne 0x4e471e
lea eax, [ebp - 0x14]
mov edx, 0x4e5384
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e53b0
call fcn.00405b78
jne 0x4e473a
lea eax, [ebp - 0x14]
mov edx, 0x4e53cc
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e53f8
call fcn.00405b78
jne 0x4e4756
lea eax, [ebp - 0x14]
mov edx, 0x4e5414
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5440
call fcn.00405b78
jne 0x4e4772
lea eax, [ebp - 0x14]
mov edx, 0x4e545c
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5488
call fcn.00405b78
jne 0x4e478e
lea eax, [ebp - 0x14]
mov edx, 0x4e54a4
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e54d0
call fcn.00405b78
jne 0x4e47aa
lea eax, [ebp - 0x14]
mov edx, 0x4e54ec
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5518
call fcn.00405b78
jne 0x4e47c6
lea eax, [ebp - 0x14]
mov edx, 0x4e5534
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5560
call fcn.00405b78
jne 0x4e47e2
lea eax, [ebp - 0x14]
mov edx, 0x4e5578
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e55a0
call fcn.00405b78
jne 0x4e47fe
lea eax, [ebp - 0x14]
mov edx, 0x4e55b8
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e55e0
call fcn.00405b78
jne 0x4e481a
lea eax, [ebp - 0x14]
mov edx, 0x4e55f8
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5620
call fcn.00405b78
jne 0x4e4836
lea eax, [ebp - 0x14]
mov edx, 0x4e5638
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5660
call fcn.00405b78
jne 0x4e4852
lea eax, [ebp - 0x14]
mov edx, 0x4e5678
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e56a0
call fcn.00405b78
jne 0x4e486e
lea eax, [ebp - 0x14]
mov edx, 0x4e56b8
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e56e0
call fcn.00405b78
jne 0x4e488a
lea eax, [ebp - 0x14]
mov edx, 0x4e56f8
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5720
call fcn.00405b78
jne 0x4e48a6
lea eax, [ebp - 0x14]
mov edx, 0x4e573c
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5768
call fcn.00405b78
jne 0x4e48c2
lea eax, [ebp - 0x14]
mov edx, 0x4e5784
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e57b0
call fcn.00405b78
jne 0x4e48de
lea eax, [ebp - 0x14]
mov edx, 0x4e57cc
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e57f8
call fcn.00405b78
jne 0x4e48fa
lea eax, [ebp - 0x14]
mov edx, 0x4e5814
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5840
call fcn.00405b78
jne 0x4e4916
lea eax, [ebp - 0x14]
mov edx, 0x4e585c
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5888
call fcn.00405b78
jne 0x4e4932
lea eax, [ebp - 0x14]
mov edx, 0x4e58a4
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e58d0
call fcn.00405b78
jne 0x4e494e
lea eax, [ebp - 0x14]
mov edx, 0x4e58ec
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5918
call fcn.00405b78
jne 0x4e496a
lea eax, [ebp - 0x14]
mov edx, 0x4e5934
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5954
call fcn.00405b78
jne 0x4e4986
lea eax, [ebp - 0x14]
mov edx, 0x4e5970
call fcn.004057f0
lea eax, [ebp - 0x188]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405a78
mov eax, dword [ebp - 0x188]
push eax
lea eax, [ebp - 0x18c]
mov ecx, dword [ebp - 0x14]
mov edx, 0x4e5994
call fcn.00405a78
mov eax, dword [ebp - 0x18c]
mov cl, 1
pop edx
call fcn.00486398
test al, al
je 0x4e4ad4
lea eax, [ebp - 0x190]
mov ecx, dword [ebp - 4]
mov edx, 0x4e59b4
call fcn.00405a78
mov edx, dword [ebp - 0x190]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x194]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405a78
mov eax, dword [ebp - 0x194]
call fcn.0040a8d0
test al, al
je 0x4e4ab7
lea eax, [ebp - 0x198]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405a78
mov edx, dword [ebp - 0x198]
lea eax, [ebp - 0x160]
call fcn.004035a0
mov edx, 1
lea eax, [ebp - 0x160]
call fcn.00403d68
call fcn.00402ef0
lea eax, [ebp - 0x160]
call fcn.004039a8
call fcn.00402ef0
mov ebx, eax
lea edx, [ebp - 0x1a0]
mov eax, ebx
call fcn.0040a2e8
mov ecx, dword [ebp - 0x1a0]
lea eax, [ebp - 0x19c]
mov edx, 0x4e59dc
call fcn.00405a78
mov edx, dword [ebp - 0x19c]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x160]
call fcn.00403668
call fcn.00402ef0
jmp 0x4e4b52
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e59f8
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4e4b52
push 0x4e5a7c
push dword [ebp - 4]
push 0x4e5a9c
lea eax, [ebp - 0x1a4]
mov edx, 3
call fcn.00405aec
mov edx, dword [ebp - 0x1a4]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e5aa8
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e5af8
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, 0x4e5b18
call fcn.0043e398
jmp 0x4e4eec
mov eax, 1
mov edx, dword [ebp - 4]
dec eax
test edx, edx
je 0x4e4b64
cmp eax, dword [edx - 4]
jb 0x4e4b69
call fcn.00404720
inc eax
cmp byte [edx + eax - 1], 0x70
jne 0x4e4bb1
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e5c9c
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x1a8]
mov ecx, 0x4e5cc8
mov edx, dword [ebp - 8]
call fcn.00405a78
mov edx, dword [ebp - 0x1a8]
mov cl, 1
mov eax, 0x4e5ce0
call fcn.00486398
mov eax, 1
mov edx, dword [ebp - 4]
dec eax
test edx, edx
je 0x4e4bc3
cmp eax, dword [edx - 4]
jb 0x4e4bc8
call fcn.00404720
inc eax
cmp byte [edx + eax - 1], 0x6f
jne 0x4e4c10
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e5d14
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x1ac]
mov ecx, 0x4e5d3c
mov edx, dword [ebp - 8]
call fcn.00405a78
mov edx, dword [ebp - 0x1ac]
mov cl, 1
mov eax, 0x4e5d50
call fcn.00486398
push 0x4e5d84
push dword [ebp - 8]
push dword [ebp - 4]
lea eax, [ebp - 0x1b0]
mov edx, 3
call fcn.00405aec
mov edx, dword [ebp - 0x1b0]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0xc]
mov edx, 0x4e5da8
mov eax, dword [ebp - 4]
call fcn.0040abf0
lea eax, [ebp - 0x1b4]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4e5db8
call fcn.00405a78
mov edx, dword [ebp - 0x1b4]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 2
lea eax, [ebp - 0x1b8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405a78
mov eax, dword [ebp - 0x1b8]
mov ecx, 0x4e5de8
mov edx, dword [ebp - 0xc]
call fcn.00488568
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e5e00
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 8]
push eax
lea edx, [ebp - 0x1bc]
mov eax, dword [ebp - 4]
call fcn.00409ad4
mov ecx, dword [ebp - 0x1bc]
mov edx, 0x4e4f5c
mov eax, 0x80000001
call fcn.00488a64
lea eax, [ebp - 0x1c0]
mov ecx, dword [ebp - 4]
mov edx, 0x4e5e38
call fcn.00405a78
mov edx, dword [ebp - 0x1c0]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
call fcn.00488978
test al, al
je 0x4e4e7f
lea eax, [ebp - 0x1c8]
mov edx, 1
mov ecx, dword [ebp - 4]
dec edx
test ecx, ecx
je 0x4e4d42
cmp edx, dword [ecx - 4]
jb 0x4e4d47
call fcn.00404720
inc edx
movzx edx, byte [ecx + edx - 1]
call fcn.00405940
mov eax, dword [ebp - 0x1c8]
lea edx, [ebp - 0x1c4]
call fcn.00409ad4
mov eax, dword [ebp - 0x1c4]
mov edx, 0x4e5e74
call fcn.00405b78
jne 0x4e4d9b
lea eax, [ebp - 0x1cc]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405a78
mov ecx, dword [ebp - 0x1cc]
mov edx, 0x4e5e80
mov eax, 0x4e5e9c
call fcn.0048874c
lea eax, [ebp - 0x1d4]
mov edx, 1
mov ecx, dword [ebp - 4]
dec edx
test ecx, ecx
je 0x4e4db3
cmp edx, dword [ecx - 4]
jb 0x4e4db8
call fcn.00404720
inc edx
movzx edx, byte [ecx + edx - 1]
call fcn.00405940
mov eax, dword [ebp - 0x1d4]
lea edx, [ebp - 0x1d0]
call fcn.00409ad4
mov eax, dword [ebp - 0x1d0]
mov edx, 0x4e5eac
call fcn.00405b78
jne 0x4e4e0c
lea eax, [ebp - 0x1d8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405a78
mov ecx, dword [ebp - 0x1d8]
mov edx, 0x4e5eb8
mov eax, 0x4e5ed4
call fcn.0048874c
lea eax, [ebp - 0x1e0]
mov edx, 1
mov ecx, dword [ebp - 4]
dec edx
test ecx, ecx
je 0x4e4e24
cmp edx, dword [ecx - 4]
jb 0x4e4e29
call fcn.00404720
inc edx
movzx edx, byte [ecx + edx - 1]
call fcn.00405940
mov eax, dword [ebp - 0x1e0]
lea edx, [ebp - 0x1dc]
call fcn.00409ad4
mov eax, dword [ebp - 0x1dc]
mov edx, 0x4e5ee4
call fcn.00405b78
jne 0x4e4ea4
lea eax, [ebp - 0x1e4]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405a78
mov ecx, dword [ebp - 0x1e4]
mov edx, 0x4e5ef0
mov eax, 0x4e5f08
call fcn.0048874c
jmp 0x4e4ea4
mov eax, 0x4e5f18
call fcn.0043e398
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e6134
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e5af8
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp byte [0x4f65fd], 0
je 0x4e4eec
push 5
lea eax, [ebp - 0x1e8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405a78
mov eax, dword [ebp - 0x1e8]
call fcn.00405c2c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4f1e
lea eax, [ebp - 0x1e8]
mov edx, 0x22
call fcn.0040577c
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040577c
ret