Function at 0x4b7020
Capabilities:
Create process on windows
Create thread
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x4f5994
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
xor ebp, ebp
cmp dword [esi + 0x78], ebp
je 0x4b7116
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x50bd94
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x30], ebp
or edi, 0xffffffff
mov dword [esp + 0x30], edi
call fcn.00495040
add esp, 4
cmp eax, 1
jne 0x4b7116
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov dword [esp + 0x2c], 1
push 0x6d1
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_4431]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push str.__set__subcategory:_
push ecx
call fcn.00410070
mov bl, 2
mov byte [esp + 0x38], bl
push str.___success:disable
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.00402a60
add esp, 0x18
mov byte [esp + 0x2c], 3
mov eax, dword [eax]
push ebp
push ebp
push eax
push str.auditpol
push str.open
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [esp + 0x2c], bl
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x2c], 1
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dword [esp + 0x2c], edi
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [0x10dc9f4]
cmp eax, ebp
je 0x4b712c
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [0x10dc9f4], ebp
mov byte [0x742def], 1
mov eax, dword [esi + 0x32480]
cmp eax, ebp
je 0x4b7222
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x10dca08]
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
push 0x7f8a
push eax
call dword [sym.imp.USER32.dll_SetSystemCursor]
mov ecx, dword [0x10dca08]
push ecx
call dword [sym.imp.USER32.dll_DestroyCursor]
push str.restorecursor
push 8
call fcn.0043d500
add esp, 8
cmp dword [0x53f200], 0x501
mov eax, str.WerSvc
jg 0x4b7193
mov eax, str.ERSvc
push 1
push eax
call fcn.00494aa0
mov eax, dword [0x53f200]
add esp, 8
cmp eax, 0x501
jne 0x4b71c4
push ebp
push str.ErrorMode
push str.SYSTEMCurrentControlSetControlWindows
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
add esp, 0x10
jmp 0x4b7215
jge 0x4b71e1
push 1
push str.VisualNotification
push str.SOFTWAREMicrosoftDrWatson
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
add esp, 0x10
jmp 0x4b7215
cmp eax, 0x501
jle 0x4b7215
push ebp
push str.Disabled
push str.SOFTWAREMicrosoftWindowsWindows_Error_Reporting
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
push ebp
push str.DontShowUI
push str.SOFTWAREMicrosoftWindowsWindows_Error_Reporting
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
add esp, 0x20
push str.MyDdesktop
call fcn.004a7b80
add esp, 4
cmp dword [0x1042d5c], ebp
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x4b724a
xor ebx, ebx
cmp dword [0x1042d7c], ebx
jne 0x4b724c
cmp dword [0x1042d64], ebx
je 0x4b7278
jmp 0x4b724c
xor ebx, ebx
mov byte [0x10da2c3], 1
mov eax, dword [esi + 0x324a8]
cmp eax, ebx
je 0x4b7265
push 0xbb8
push eax
call edi
mov eax, dword [esi + 0x324a8]
cmp eax, ebx
je 0x4b7272
push eax
call ebp
mov dword [esi + 0x324a8], ebx
cmp dword [0x10707b4], ebx
je 0x4b72ac
mov byte [0x10da2c4], 1
mov eax, dword [esi + 0x324b0]
cmp eax, ebx
je 0x4b7299
push 0xbb8
push eax
call edi
mov eax, dword [esi + 0x324b0]
cmp eax, ebx
je 0x4b72a6
push eax
call ebp
mov dword [esi + 0x324b0], ebx
push ebx
push ebx
push ebx
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
test dword [0x10430f4], 0x2000000
jne 0x4b72e3
mov edx, dword [0x10da2d0]
push str.UnInstallRecord
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10dca04], eax
cmp eax, ebx
je 0x4b72e3
call eax
push 1
call fcn.0044a850
add esp, 4
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 0x32478]
cmp eax, ebx
je 0x4b7319
push 0xbb8
push eax
call edi
mov eax, dword [esi + 0x32478]
push eax
call ebp
mov dword [esi + 0x32478], ebx
mov eax, dword [0x10da0a8]
cmp eax, ebx
je 0x4b7339
push 0xbb8
push eax
call edi
mov ecx, dword [0x10da0a8]
push ecx
call ebp
mov dword [0x10da0a8], ebx
test dword [0x1043084], 0x800
je 0x4b735e
lea edx, [esp + 0x20]
push edx
push ebx
push ebx
push 0x4b6de0
push ebx
push ebx
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
jmp 0x4b7379
mov eax, dword [esi + 0x324bc]
cmp eax, ebx
je 0x4b7379
push 0xbb8
push eax
call edi
mov eax, dword [esi + 0x324bc]
push eax
call ebp
test byte [0x1043044], 1
je 0x4b74d0
mov byte [0x10da2c1], 1
mov dword [esi + 0x324a4], ebx
mov byte [0x10da2c5], 1
mov eax, dword [esi + 0x324b4]
cmp eax, ebx
je 0x4b73be
push 0xbb8
push eax
call edi
mov ecx, dword [esi + 0x324b4]
push ecx
call ebp
push ebx
call fcn.0045a300
add esp, 4
mov dword [esi + 0x324b4], ebx
mov byte [0x10da2c7], 1
mov eax, dword [esi + 0x324b8]
cmp eax, ebx
je 0x4b73e6
push 0xbb8
push eax
call edi
mov edx, dword [esi + 0x324b8]
push edx
call ebp
mov byte [0x10da2c0], 1
mov eax, dword [esi + 0x78]
cmp eax, ebx
je 0x4b7402
push 0xbb8
push eax
call edi
mov eax, dword [esi + 0x78]
push eax
call ebp
mov dword [esi + 0x78], ebx
mov eax, dword [0x10da0a8]
mov byte [0x10da09a], 1
cmp eax, ebx
je 0x4b7426
push 0xbb8
push eax
call edi
mov ecx, dword [0x10da0a8]
push ecx
call ebp
mov eax, dword [0x10da0b4]
mov dword [0x10da0a8], ebx
mov byte [0x10da09b], 1
cmp eax, ebx
je 0x4b744d
push 0xbb8
push eax
call edi
mov edx, dword [0x10da0b4]
push edx
call ebp
mov dword [0x10da0b4], ebx
mov byte [0x10da2c2], 1
mov eax, dword [esi + 0x3249c]
cmp eax, ebx
je 0x4b7475
push 0xbb8
push eax
call edi
mov eax, dword [esi + 0x3249c]
push eax
call ebp
mov eax, dword [esi + 0x324a0]
mov dword [esi + 0x3249c], ebx
cmp eax, ebx
je 0x4b7496
push 0xbb8
push eax
call edi
mov ecx, dword [esi + 0x324a0]
push ecx
call ebp
mov dword [esi + 0x324a0], ebx
test dword [0x1042d84], 0x1000
je 0x4b74d0
mov byte [0x10da2bb], 1
mov eax, dword [esi + 0x32498]
cmp eax, ebx
je 0x4b74ca
push 0xbb8
push eax
call edi
mov edx, dword [esi + 0x32498]
push edx
call ebp
mov dword [esi + 0x32498], ebx
push ebx
push ebx
push ebx
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
mov edi, dword [0x10dd290]
cmp edi, ebx
mov esi, dword [0x10dd288]
jle 0x4b750d
mov edi, edi
cmp esi, ebx
je 0x4b750d
mov eax, esi
mov eax, dword [eax + 8]
mov esi, dword [esi]
cmp eax, ebx
je 0x4b7508
push eax
call sub.mfc90.dll_Ordinal_800
add esp, 4
dec edi
cmp edi, ebx
jg 0x4b74f0
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret