Function at 0x4f9b8c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x4f9b94
push ebx
push esi
mov eax, 0x4f959c
call fcn.00406b50
mov ebx, dword [0x52cc98]
xor eax, eax
push ebp
push 0x4f9f1f
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040a42c
fstp qword [ebp - 0x14]
wait
call fcn.0040a458
fadd qword [ebp - 0x14]
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.004095c8
mov edx, dword [0x52ce9c]
mov dword [edx], eax
lea edx, [ebp - 0x1c]
mov eax, 1
call fcn.00402914
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00408910
mov edx, dword [ebp - 0x18]
mov eax, 0x558e40
call fcn.00403c8c
mov eax, dword [0x558e40]
mov edx, 0x4f9f38
call fcn.00403fc8
jne 0x4f9c51
push 0x4f9f44
lea edx, [ebp - 0x20]
mov eax, dword [ebx]
call fcn.00452128
push dword [ebp - 0x20]
push 0x4f9f50
mov eax, 0x558e48
mov edx, 3
call fcn.00403f78
mov ecx, dword [0x558e48]
mov edx, 0x4f9f60
mov eax, 0x4f9f74
call fcn.00466058
mov eax, dword [0x558e40]
mov edx, 0x4f9fc0
call fcn.00403fc8
jne 0x4f9c6a
mov eax, dword [0x52cbf0]
mov byte [eax], 1
lea edx, [ebp - 0x28]
mov eax, 2
call fcn.00402914
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00408910
mov edx, dword [ebp - 0x24]
mov eax, 0x558e44
call fcn.00403c8c
cmp dword [0x558e44], 0
jne 0x4f9d0f
lea eax, [ebp - 0x2c]
call fcn.004f950c
mov edx, dword [ebp - 0x2c]
mov eax, 0x558e44
call fcn.00403c8c
cmp dword [0x558e40], 0
jne 0x4f9cc5
mov eax, 0x558e40
mov edx, 0x4f9fcc
call fcn.00403c8c
push 1
push 0x4f9f44
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.00402914
push dword [ebp - 0x34]
push 0x4f9fd8
push dword [0x558e40]
push 0x4f9fe4
push dword [0x558e44]
lea eax, [ebp - 0x30]
mov edx, 6
call fcn.00403f78
mov eax, dword [ebp - 0x30]
call fcn.0040407c
push eax
call sub.kernel32.dll_WinExec
jmp 0x4f9f04
mov dl, 1
mov eax, dword [0x452e60]
call fcn.00402ebc
mov esi, eax
mov eax, dword [0x52cdd4]
mov eax, dword [eax]
call fcn.00403eb8
push eax
mov eax, dword [0x52cdd4]
call fcn.00404088
pop edx
call fcn.004678c4
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x3c]
call fcn.00408e6c
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp - 0x38]
mov edx, 0x4f9ff0
call fcn.00403f04
mov edx, dword [ebp - 0x38]
mov eax, esi
call fcn.00452eec
test eax, eax
jne 0x4f9d93
mov eax, esi
call fcn.00402eec
mov eax, 0x4fa004
xor edx, edx
call fcn.0046765c
test eax, eax
je 0x4f9f04
push 0
push 0
push 0x600
push eax
call sub.user32.dll_PostMessageA
jmp 0x4f9f04
mov eax, dword [0x52cbf0]
cmp byte [eax], 0
je 0x4f9db6
mov edx, 0x4fa018
mov eax, 0x4fa02c
call fcn.0046670c
test eax, eax
jle 0x4f9db6
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [0x52cdd4]
mov edx, dword [edx]
mov eax, dword [0x52cd64]
mov ecx, 0x4fa060
call fcn.00403f04
lea edx, [ebp - 0x48]
xor eax, eax
call fcn.00402914
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
call fcn.00409468
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.00408910
mov eax, dword [ebp - 0x40]
mov edx, 0x4fa078
call fcn.00403fc8
mov eax, dword [0x52c7c0]
setne byte [eax]
mov eax, dword [0x52cdd4]
mov eax, dword [eax]
cmp byte [eax], 0x5c
mov eax, dword [0x52c9e0]
setne byte [eax]
call fcn.004029b0
mov eax, dword [ebx]
call fcn.00451bc8
mov ecx, dword [0x52cbb0]
mov eax, dword [ebx]
mov edx, dword [0x4e6d90]
call fcn.00451be0
mov ecx, dword [0x52c8d4]
mov eax, dword [ebx]
mov edx, dword [0x4df42c]
call fcn.00451be0
mov ecx, dword [0x52cb68]
mov eax, dword [ebx]
mov edx, dword [0x4cac48]
call fcn.00451be0
mov ecx, dword [0x52d034]
mov eax, dword [ebx]
mov edx, dword [0x4c1988]
call fcn.00451be0
mov ecx, dword [0x52c7b4]
mov eax, dword [ebx]
mov edx, dword [0x4cff54]
call fcn.00451be0
mov ecx, dword [0x52cbd0]
mov eax, dword [ebx]
mov edx, dword [0x4d6684]
call fcn.00451be0
mov ecx, dword [0x52c62c]
mov eax, dword [ebx]
mov edx, dword [0x4d7884]
call fcn.00451be0
mov ecx, dword [0x52cc90]
mov eax, dword [ebx]
mov edx, dword [0x4c5384]
call fcn.00451be0
mov ecx, dword [0x52d030]
mov eax, dword [ebx]
mov edx, dword [0x4c5b54]
call fcn.00451be0
mov ecx, dword [0x52d028]
mov eax, dword [ebx]
mov edx, dword [0x4e19c4]
call fcn.00451be0
mov ecx, dword [0x52c7c8]
mov eax, dword [ebx]
mov edx, dword [0x4d9e84]
call fcn.00451be0
call fcn.004dbbf0
mov eax, dword [ebx]
call fcn.00451c60
mov eax, esi
call fcn.00402eec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f9f26
lea eax, [ebp - 0x48]
mov edx, 0xd
call fcn.00403c5c
ret