Function at 0x4a4e44
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x34
push 0
push 0
dec ecx
jne 0x4a4e4c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x170]
mov edx, dword [0x407638]
call fcn.00404b80
xor eax, eax
push ebp
push 0x4a531d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4a52bc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.004040a4
lea ecx, [ebp - 0x170]
mov edx, 0x10
mov eax, 0x4a5334
call fcn.00408d24
test eax, eax
jne 0x4a4eca
cmp dword [ebp - 0x10], 0
jne 0x4a4eca
push 0x4a5344
push dword [ebp - 0x164]
push 0x4a5350
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404424
lea ecx, [ebp - 0x170]
mov edx, 0x10
mov eax, 0x4a535c
call fcn.00408d24
test eax, eax
jne 0x4a4f06
cmp dword [ebp - 0x10], 0
jne 0x4a4f06
push 0x4a5370
push dword [ebp - 0x164]
push 0x4a5350
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404424
lea ecx, [ebp - 0x170]
mov edx, 0x10
mov eax, 0x4a537c
call fcn.00408d24
test eax, eax
jne 0x4a4f42
cmp dword [ebp - 0x10], 0
jne 0x4a4f42
push 0x4a5390
push dword [ebp - 0x164]
push 0x4a5350
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404424
lea eax, [ebp - 0x170]
call fcn.00408d74
mov eax, 0x4a5344
call fcn.00408bb4
test al, al
je 0x4a4f6e
cmp dword [ebp - 0x10], 0
jne 0x4a4f6e
lea eax, [ebp - 0x10]
mov edx, 0x4a5344
call fcn.0040413c
mov eax, 0x4a5370
call fcn.00408bb4
test al, al
je 0x4a4f8f
cmp dword [ebp - 0x10], 0
jne 0x4a4f8f
lea eax, [ebp - 0x10]
mov edx, 0x4a5370
call fcn.0040413c
mov eax, 0x4a5390
call fcn.00408bb4
test al, al
je 0x4a4fb0
cmp dword [ebp - 0x10], 0
jne 0x4a4fb0
lea eax, [ebp - 0x10]
mov edx, 0x4a5390
call fcn.0040413c
lea edx, [ebp - 0x178]
mov eax, dword [0x4a7f98]
mov eax, dword [eax]
call fcn.00459690
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x174]
call fcn.00408e44
mov ecx, dword [ebp - 0x174]
mov eax, 0x4a9e18
mov edx, 0x4a539c
call fcn.004043b0
lea eax, [ebp - 0x14]
mov ecx, 0x4a53ac
mov edx, dword [ebp - 0x10]
call fcn.004043b0
lea eax, [ebp - 0x10]
mov edx, dword [0x4a9e18]
call fcn.0040436c
mov dl, 1
mov eax, dword [0x4168e0]
call fcn.00403324
mov dword [ebp - 8], eax
lea edx, [ebp - 0x17c]
xor eax, eax
call fcn.00402ab8
mov edx, dword [ebp - 0x17c]
mov eax, dword [ebp - 8]
call fcn.0041a98c
mov dl, 1
mov eax, dword [0x4168e0]
call fcn.00403324
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004a4dd8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a5072
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0041a8b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a507c
mov eax, dword [ebp - 0x10]
call fcn.00408ba4
test al, al
jne 0x4a519d
lea edx, [ebp - 0x184]
mov eax, dword [0x4a7f98]
mov eax, dword [eax]
call fcn.00459690
mov eax, dword [ebp - 0x184]
lea edx, [ebp - 0x180]
call fcn.00408e10
push dword [ebp - 0x180]
push 0x4a53c0
lea edx, [ebp - 0x18c]
mov eax, dword [0x4a7f98]
mov eax, dword [eax]
call fcn.00459690
mov eax, dword [ebp - 0x18c]
lea edx, [ebp - 0x188]
call fcn.00408e44
push dword [ebp - 0x188]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404424
lea edx, [ebp - 0x194]
mov eax, dword [0x4a7f98]
mov eax, dword [eax]
call fcn.00459690
mov eax, dword [ebp - 0x194]
lea edx, [ebp - 0x190]
call fcn.00408e10
lea eax, [ebp - 0x190]
mov edx, 0x4a53c0
call fcn.0040436c
mov eax, dword [ebp - 0x190]
call fcn.00408bb4
test al, al
jne 0x4a5170
lea edx, [ebp - 0x19c]
mov eax, dword [0x4a7f98]
mov eax, dword [eax]
call fcn.00459690
mov eax, dword [ebp - 0x19c]
lea edx, [ebp - 0x198]
call fcn.00408e10
lea eax, [ebp - 0x198]
mov edx, 0x4a53c0
call fcn.0040436c
mov eax, dword [ebp - 0x198]
call fcn.00408bd8
xor eax, eax
push ebp
push 0x4a5193
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0041a8b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a519d
mov eax, dword [ebp - 0x10]
call fcn.00408ba4
test al, al
je 0x4a52a2
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x4a51c6
cmp eax, 0x186a0
jae 0x4a52a2
jmp 0x4a51cc
jge 0x4a52a2
xor eax, eax
push ebp
push 0x4a5236
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4165f0]
call fcn.00403324
mov dword [ebp - 0x18], eax
mov edx, dword [0x4a7c60]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x74]
lea eax, [ebp - 0x1a0]
mov edx, dword [ebp - 0x14]
call fcn.00404928
mov edx, dword [ebp - 0x1a0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x318]
call fcn.00486cb8
mov eax, dword [ebp - 0x18]
call fcn.00403354
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a5248
push 0x80
push 0xffffffffffffffec
mov eax, dword [0x4a7f98]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetWindowLongA
xor edx, edx
mov eax, dword [0x4a9e14]
call fcn.00456458
push 5
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404564
push eax
push 0x4a53c8
mov eax, dword [ebp - 4]
call fcn.0043ff34
push eax
call sub.shell32.dll_ShellExecuteA
mov edx, 0x1f4
mov eax, dword [ebp - 4]
call fcn.004a495c
mov eax, dword [ebp - 4]
call fcn.004a498c
mov eax, dword [ebp - 0xc]
call fcn.00403354
mov eax, dword [ebp - 8]
call fcn.00403354
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a52d6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5324
lea eax, [ebp - 0x1a0]
call fcn.004047b0
lea eax, [ebp - 0x19c]
mov edx, 0xb
call fcn.004040c8
lea eax, [ebp - 0x170]
mov edx, dword [0x407638]
call fcn.00404c50
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004040c8
ret