Function at 0x448950
Capabilities:
Create process on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push 0
push 0
push 0xf0
push 0x2a2f
push dword [0x4e6030]
call ebp
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call edi
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
test eax, eax
je 0x4489a0
push 1
push 0
push 0x4ba070
push 0x4b67b4
push str.open
push dword [0x4e6030]
call ebx
push esi
push 0
push 0
push 0xf0
push 0x2a30
push dword [0x4e6030]
call ebp
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x448a77
push str.Kernel32.dll
mov dword [esp + 0x14], 0
call esi
mov esi, eax
test esi, esi
jne 0x4489f4
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x448a0e
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x448a0b
lea ecx, [esp + 0x10]
push ecx
call eax
push esi
call edi
mov esi, dword [esp + 0x10]
push 1
push 0
push str._T:97__C_nbtstat__R
push 0x4b67b4
push str.open
push dword [0x4e6030]
mov dword [esp + 0x2c], esi
call ebx
test esi, esi
je 0x448a71
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Kernel32.dll
call eax
mov esi, eax
test esi, esi
jne 0x448a58
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x448a71
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x448a6e
push dword [esp + 0x14]
call eax
push esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
push 0xf0
push 0x2a31
push dword [0x4e6030]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x448b3f
push str.Kernel32.dll
mov dword [esp + 0x14], 0
call esi
mov esi, eax
test esi, esi
jne 0x448ac2
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x448adc
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x448ad9
lea ecx, [esp + 0x10]
push ecx
call eax
push esi
call edi
mov esi, dword [esp + 0x10]
push 1
push 0
push str._T:97__C_nbtstat__RR
push 0x4b67b4
push str.open
push dword [0x4e6030]
mov dword [esp + 0x2c], esi
call ebx
test esi, esi
je 0x448b3f
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Kernel32.dll
call eax
mov esi, eax
test esi, esi
jne 0x448b26
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x448b3f
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x448b3c
push dword [esp + 0x14]
call eax
push esi
call edi
push 0
push 0
push 0xf0
push 0x2a32
push dword [0x4e6030]
call ebp
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call edi
pop esi
test eax, eax
je 0x448b7e
push 1
push 0
push str._T:97__C_netsh_int_ip_reset
push 0x4b67b4
push str.open
push dword [0x4e6030]
call ebx
push 0
push 0
push 0xf0
push 0x2a33
push dword [0x4e6030]
call ebp
push eax
call edi
test eax, eax
je 0x448bb6
push 1
push 0
push str._T:97__C_netsh_winsock_reset
push 0x4b67b4
push str.open
push dword [0x4e6030]
call ebx
pop edi
pop ebp
pop ebx
add esp, 8
ret