Function at 0x4c1063
Capabilities:
Create process on windows

Disassembly:
push 0x3c0
mov eax, 0x543c75
call fcn.00506b61
push 0x55
pop ecx
mov esi, str.ZeySbCDlvrigj1WpAyHAIgzeOmq2L0sapWPGp5aTs2O2nAxKkmoFuNYIruLrTDYG6g8ssl99O94ULHgwH39EjpUOPy9chHOdSGzhTct8h5RxJuKuEXKsGtzfl5ibd4CnsVjIbsTVUOQrnWDOJlTNYYMtpwkkIVqbAAQKAEDZfbPjovn4AtXyfiXPZ63R2fsAIIvrvMaqY5gGA6oAX2OoGijaRZxvfse60AScv6L9CaGNbrfFkTsDoFUUUQK2GDP0LuwGapybZejTzoIYOAeS5KjiUQvvmnBRJKzwyCuyfdTqTGdhj2u4Two3nj1h1Bzu6dcI9wwqGJq3oeelpIDX
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x168]
mov ebx, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
push 0x6d
pop ecx
mov dword [ebp - 0x36c], eax
xor eax, eax
movsb byte es:[edi], byte [esi]
mov esi, str.qYogmpAFsrW9B71N0LQ00r7jXVXTBcm4MoSYoLvawirYHmokR7qWhgOJgyoHeOx0ObTPmg93ox4rN5TiTMrCAbBWjWiL554OVbmfkLhjBzSOlV20E7reLePWxZg9ntXg36aiygbq3xFFY93WWgHLZJVrt4VkLAc0GkRDE06AvdWt5cqZehgjaDolQyfUHG6MP3k7AQlciYwCHJ7Po108WUCTb6fPiobRVwWoImi4biMGTCBzLgOkHv8noZjBjMjWWvAMmm7CrGm4nIWK6gQfTKb5p93iNINUjzBMoh8b6Ql8IG5dVjsw1aney4pTBumVDOdipZOb9UUan65EDfAlLgJU2otC14PWJbPOhAkNpWI4YjiVbvKfLZ6NZ9y6qnbBj1i0RlUmwUWG84Z0w9cIe9JP0UdxJDR3EWjZboZlTPGaHKBEXHRT8k
mov dword [ebp - 0x378], eax
lea edi, [ebp - 0x320]
mov dword [ebp - 0x374], eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x370], eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x368]
lea eax, [ebp - 0x168]
push eax
call fcn.00405820
lea eax, [ebp - 0x368]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x378]
call fcn.00407e30
push 0
push 1
lea ecx, [ebp - 0x368]
mov byte [ebp - 4], 0
call fcn.0046d37e
lea eax, [ebp - 0x320]
push eax
lea ecx, [ebp - 0x368]
call fcn.00405820
lea eax, [ebp - 0x368]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x378]
call fcn.00407e30
xor edi, edi
lea ecx, [ebp - 0x368]
push edi
push 1
call fcn.0046d37e
push 0x44
pop esi
push esi
lea eax, [ebp - 0x3cc]
push edi
push eax
call fcn.004e37a0
push 0x10
lea eax, [ebp - 0x388]
mov dword [ebp - 0x3cc], esi
push edi
push eax
call fcn.004e37a0
add esp, 0x18
xor edx, edx
xor eax, eax
mov dword [ebp - 0x328], edx
mov word [ebp - 0x338], ax
push 7
pop ecx
mov dword [ebp - 0x324], ecx
mov dword [ebp - 0x33c], ecx
mov dword [ebp - 0x340], edx
mov word [ebp - 0x350], ax
mov edi, dword [ebp - 0x36c]
or esi, 0xffffffff
mov byte [ebp - 4], 4
test edi, edi
je 0x4c1224
cmp word [edi], dx
jne 0x4c11a0
mov eax, edx
jmp 0x4c11a7
push edi
call fcn.004f3a59
pop ecx
push eax
push edi
lea ecx, [ebp - 0x350]
call fcn.00402650
cmp dword [ebp - 0x340], 0
je 0x4c1222
mov edi, 0x588d1c
push edi
call fcn.004f3a59
pop ecx
push eax
push edi
lea ecx, [ebp - 0x338]
call fcn.00402650
xor eax, eax
cmp word [ebx], ax
je 0x4c11e4
push ebx
call fcn.004f3a59
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x338]
call fcn.00404290
mov edi, 0x5a7f8c
push edi
call fcn.004f3a59
pop ecx
push eax
push edi
lea ecx, [ebp - 0x338]
call fcn.00404290
push esi
xor ebx, ebx
lea eax, [ebp - 0x350]
push ebx
push eax
lea ecx, [ebp - 0x338]
call fcn.004043c0
jmp 0x4c1243
xor edx, edx
cmp word [ebx], dx
jne 0x4c122d
mov eax, edx
jmp 0x4c1234
push ebx
call fcn.004f3a59
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x338]
call fcn.00402650
xor ebx, ebx
cmp dword [ebp - 0x324], 8
lea ecx, [ebp - 0x388]
push ecx
lea ecx, [ebp - 0x3cc]
push ecx
push ebx
push ebx
lea eax, [ebp - 0x338]
cmovae eax, dword [ebp - 0x338]
xor edi, edi
push ebx
inc edi
push edi
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4c127e
mov esi, ebx
jmp 0x4c12b1
cmp byte [ebp + 0x10], 0
je 0x4c1299
cmp dword [ebp + 0x14], 0
cmovg esi, dword [ebp + 0x14]
push esi
push dword [ebp - 0x388]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x388]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x384]
call esi
mov esi, edi
push ebx
push edi
lea ecx, [ebp - 0x350]
call fcn.00402590
push ebx
push edi
lea ecx, [ebp - 0x338]
call fcn.00402590
lea ecx, [ebp - 0x378]
call fcn.0046d3d0
mov eax, esi
call fcn.00506b0b
ret