Function at 0x48b27c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1c1
push 0
push 0
dec ecx
jne 0x48b284
push ecx
push ebx
push esi
push edi
mov ebx, eax
lea eax, [ebp - 0xdac]
mov edx, dword [0x407428]
call fcn.00404a4c
xor eax, eax
push ebp
push 0x48b866
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x48b87c
lea eax, [ebp - 0xdb0]
call fcn.0048abb8
push dword [ebp - 0xdb0]
push 0x48b8a0
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404440
lea eax, [ebp - 0xdb4]
mov ecx, 0x48b8e4
mov edx, dword [ebp - 8]
call fcn.004043cc
mov eax, dword [ebp - 0xdb4]
lea ecx, [ebp - 0xdac]
mov edx, 0x3f
call fcn.00408cb0
test eax, eax
jne 0x48b4d1
lea ecx, [ebp - 0xdb8]
mov edx, 4
mov eax, dword [ebp - 0xda0]
call fcn.0042d618
mov edx, dword [ebp - 0xdb8]
mov eax, 0x48b8f0
call fcn.004044cc
jne 0x48b4be
push 0
lea eax, [ebp - 0xdbc]
mov ecx, dword [ebp - 0xda0]
mov edx, dword [ebp - 8]
call fcn.004043cc
mov edx, dword [ebp - 0xdbc]
lea ecx, [ebp - 0x630]
mov eax, ebx
call fcn.0048bdd4
test al, al
je 0x48b4be
lea eax, [ebp - 0xdc4]
lea edx, [ebp - 0x630]
mov ecx, 0x105
call fcn.00404330
mov eax, dword [ebp - 0xdc4]
lea edx, [ebp - 0xdc0]
call fcn.00408150
mov edx, dword [ebp - 0xdc0]
mov eax, 0x48b900
call fcn.004046c4
test eax, eax
jle 0x48b4be
lea eax, [ebp - 0xdcc]
lea edx, [ebp - 0x21b]
mov ecx, 0x105
call fcn.00404330
mov eax, dword [ebp - 0xdcc]
lea edx, [ebp - 0xdc8]
call fcn.00408150
mov edx, dword [ebp - 0xdc8]
mov eax, 0x48b918
call fcn.004046c4
test eax, eax
jle 0x48b4be
lea eax, [ebp - 4]
mov ecx, dword [ebp - 0xda0]
mov edx, dword [ebp - 8]
call fcn.004043cc
lea eax, [ebp - 0xdd0]
lea edx, [ebp - 0x630]
mov ecx, 0x105
call fcn.00404330
mov edx, dword [ebp - 0xdd0]
lea eax, [ebp - 0xc54]
call fcn.00409050
lea esi, [ebp - 0x52b]
lea edi, [ebp - 0xb4f]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x42b]
lea edi, [ebp - 0xa4f]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x948], eax
lea esi, [ebp - 0x320]
lea edi, [ebp - 0x944]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x48b920
lea edi, [ebp - 0x83f]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ax, word [ebp - 0x116]
mov word [ebp - 0x73a], ax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x738], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x734], eax
mov esi, 0x48ba28
lea edi, [ebp - 0x730]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0xc54]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0048c088
lea eax, [ebp - 0xdac]
call fcn.00408d00
test eax, eax
je 0x48b309
lea eax, [ebp - 0xdac]
call fcn.00408d24
lea eax, [ebp - 8]
mov edx, 0x48bb30
call fcn.00404158
lea eax, [ebp - 0xdd4]
mov ecx, 0x48b8e4
mov edx, dword [ebp - 8]
call fcn.004043cc
mov eax, dword [ebp - 0xdd4]
lea ecx, [ebp - 0xdac]
mov edx, 0x3f
call fcn.00408cb0
test eax, eax
jne 0x48b6e2
lea ecx, [ebp - 0xdd8]
mov edx, 4
mov eax, dword [ebp - 0xda0]
call fcn.0042d618
mov edx, dword [ebp - 0xdd8]
mov eax, 0x48b8f0
call fcn.004044cc
jne 0x48b6cf
push 0
lea eax, [ebp - 0xddc]
mov ecx, dword [ebp - 0xda0]
mov edx, dword [ebp - 8]
call fcn.004043cc
mov edx, dword [ebp - 0xddc]
lea ecx, [ebp - 0x630]
mov eax, ebx
call fcn.0048bdd4
test al, al
je 0x48b6cf
lea eax, [ebp - 0xde4]
lea edx, [ebp - 0x630]
mov ecx, 0x105
call fcn.00404330
mov eax, dword [ebp - 0xde4]
lea edx, [ebp - 0xde0]
call fcn.00408150
mov edx, dword [ebp - 0xde0]
mov eax, 0x48b900
call fcn.004046c4
test eax, eax
jle 0x48b6cf
lea eax, [ebp - 0xdec]
lea edx, [ebp - 0x21b]
mov ecx, 0x105
call fcn.00404330
mov eax, dword [ebp - 0xdec]
lea edx, [ebp - 0xde8]
call fcn.00408150
mov edx, dword [ebp - 0xde8]
mov eax, 0x48b918
call fcn.004046c4
test eax, eax
jle 0x48b6cf
lea eax, [ebp - 4]
mov ecx, dword [ebp - 0xda0]
mov edx, dword [ebp - 8]
call fcn.004043cc
lea eax, [ebp - 0xdf0]
lea edx, [ebp - 0x630]
mov ecx, 0x105
call fcn.00404330
mov edx, dword [ebp - 0xdf0]
lea eax, [ebp - 0xc54]
call fcn.00409050
lea esi, [ebp - 0x52b]
lea edi, [ebp - 0xb4f]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x42b]
lea edi, [ebp - 0xa4f]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x948], eax
lea esi, [ebp - 0x320]
lea edi, [ebp - 0x944]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x48b920
lea edi, [ebp - 0x83f]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ax, word [ebp - 0x116]
mov word [ebp - 0x73a], ax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x738], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x734], eax
mov esi, 0x48ba28
lea edi, [ebp - 0x730]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0xc54]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0048c088
lea eax, [ebp - 0xdac]
call fcn.00408d00
test eax, eax
je 0x48b51a
lea eax, [ebp - 0xdac]
call fcn.00408d24
lea edx, [ebp - 0xc]
mov eax, dword [0x48f4d0]
mov eax, dword [eax]
call fcn.0045d5cc
mov al, byte [0x48bb90]
push eax
lea eax, [ebp - 0xdf4]
push eax
mov ecx, 0x48bb9c
mov edx, 0x48bbac
mov eax, dword [ebp - 0xc]
call fcn.0040d5e8
mov edx, dword [ebp - 0xdf4]
lea eax, [ebp - 0xc]
call fcn.00404158
mov al, byte [0x48bb90]
push eax
lea eax, [ebp - 0xdf8]
push eax
mov ecx, 0x48bb9c
mov edx, 0x48bbbc
mov eax, dword [ebp - 0xc]
call fcn.0040d5e8
mov edx, dword [ebp - 0xdf8]
lea eax, [ebp - 0xc]
call fcn.00404158
mov al, byte [0x48bb90]
push eax
lea eax, [ebp - 0xdfc]
push eax
lea edx, [ebp - 0xe04]
mov eax, dword [0x48f4d0]
mov eax, dword [eax]
call fcn.0045d5cc
mov eax, dword [ebp - 0xe04]
lea edx, [ebp - 0xe00]
call fcn.00408e54
mov edx, dword [ebp - 0xe00]
xor ecx, ecx
mov eax, dword [ebp - 0xc]
call fcn.0040d5e8
mov edx, dword [ebp - 0xdfc]
lea eax, [ebp - 0xc]
call fcn.00404158
cmp dword [0x490f20], 0
je 0x48b7e5
push 0
push 0x48bbcc
push dword [ebp - 0xc]
push 0x48bbe0
push dword [0x490f20]
lea eax, [ebp - 0xe08]
mov edx, 4
call fcn.00404440
mov eax, dword [ebp - 0xe08]
call fcn.00404580
push eax
call sub.kernel32.dll_WinExec
jmp 0x48b815
push 0
push 0x48bbcc
push dword [ebp - 0xc]
push 0x48bbec
lea eax, [ebp - 0xe0c]
mov edx, 3
call fcn.00404440
mov eax, dword [ebp - 0xe0c]
call fcn.00404580
push eax
call sub.kernel32.dll_WinExec
cmp dword [0x490f14], 0
je 0x48b82a
mov eax, dword [0x48f4d0]
mov eax, dword [eax]
call fcn.0045d0a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b86d
lea eax, [ebp - 0xe0c]
mov edx, 0x18
call fcn.004040e4
lea eax, [ebp - 0xdac]
mov edx, dword [0x407428]
call fcn.00404b1c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004040e4
ret