Function at 0x4e05e8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
xor ecx, ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e082d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4e0844
lea edx, [ebp - 0x68]
mov eax, ebx
call fcn.004080dc
push dword [ebp - 0x68]
push 0x4e0854
call sub.kernel32.dll_GetCurrentProcessId
lea edx, [ebp - 0x6c]
call fcn.004080dc
push dword [ebp - 0x6c]
lea eax, [ebp - 8]
mov edx, 4
call fcn.00403f28
push 0x4e085c
push 0x4e085c
call sub.user32.dll_FindWindowA
mov dword [0x4f60bc], eax
cmp dword [0x4f60bc], 0
jne 0x4e071e
mov eax, 0x4e0874
call fcn.004082d4
test al, al
je 0x4e067f
lea eax, [ebp - 4]
mov edx, 0x4e0874
call fcn.00403c84
jmp 0x4e069e
mov eax, 0x4e088c
call fcn.004082d4
test al, al
je 0x4e0805
lea eax, [ebp - 4]
mov edx, 0x4e088c
call fcn.00403c84
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x10
call fcn.00402d2c
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00402d2c
mov dword [ebp - 0x54], 0x44
mov word [ebp - 0x24], 5
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x4000020
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040402c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4e0740
push 0x2710
mov eax, dword [ebp - 0x64]
push eax
call sub.user32.dll_WaitForInputIdle
push 0x4e085c
push 0x4e085c
call sub.user32.dll_FindWindowA
mov dword [0x4f60bc], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xc], eax
jmp 0x4e0740
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x4f60bc]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0x400
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
cmp dword [0x4f60bc], 0
je 0x4e0805
push 0
mov eax, dword [ebp - 8]
call fcn.00403e68
inc eax
push eax
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x4e07a8
mov eax, dword [ebp - 8]
call fcn.00403e68
inc eax
push eax
push 0
push 0
push 2
push ebx
call sub.kernel32.dll_MapViewOfFile
test eax, eax
je 0x4e078e
mov edx, dword [ebp - 8]
call fcn.00408a40
push 2
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_DuplicateHandle
push 2
push 0
push 0
push 0x4f60c0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_DuplicateHandle
mov eax, dword [0x4f60c0]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0x401
mov eax, dword [0x4f60bc]
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x4f60c0]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e0834
lea eax, [ebp - 0x6c]
mov edx, 2
call fcn.00403c10
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403c10
ret