Function at 0x4caa34
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x10
push 0
push 0
dec ecx
jne 0x4caa3c
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cadbb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebx + 0x350]
call fcn.0043608c
xor edx, edx
mov eax, dword [ebx + 0x36c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
lea edx, [ebp - 0x58]
mov eax, 0x4cadcc
call fcn.004aad90
mov edx, dword [ebp - 0x58]
mov eax, dword [ebx + 0x344]
call fcn.004bd960
mov eax, dword [ebx + 0x340]
mov edx, dword [ebx + 0x4c]
sub edx, dword [eax + 0x4c]
sar edx, 1
jns 0x4caa9c
adc edx, 0
call fcn.0045caa8
mov eax, dword [ebx + 0x340]
mov edx, dword [ebx + 0x48]
sub edx, dword [eax + 0x48]
sar edx, 1
jns 0x4caab4
adc edx, 0
call fcn.0045ca84
mov dl, 1
mov eax, dword [ebx + 0x340]
call fcn.0045d234
mov eax, dword [0x4d6700]
mov eax, dword [eax]
call fcn.0047d568
call fcn.004b5b40
mov eax, dword [ebx + 0x310]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4caaf3
mov eax, dword [0x4d65b8]
cmp byte [eax], 0
je 0x4cab07
mov eax, dword [0x4d65b8]
cmp byte [eax], 0
je 0x4cab68
mov eax, dword [0x4d64ec]
cmp byte [eax], 0
je 0x4cab68
lea eax, [ebp - 0x44]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
mov word [ebp - 0x14], 1
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
mov eax, dword [0x4d643c]
mov eax, dword [eax]
call fcn.00403614
push eax
push 0
push 8
push 0
push 0
push 0
push 0x4cae34
mov eax, dword [0x4d643c]
push dword [eax]
push 0x4cae40
push 0x4cae34
lea eax, [ebp - 0x5c]
mov edx, 4
call fcn.0040350c
mov eax, dword [ebp - 0x5c]
call fcn.00403614
push eax
push 0
call sub.kernel32.dll_CreateProcessA
mov eax, dword [ebx + 0x314]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4cabf5
mov eax, dword [0x4d64c4]
cmp byte [eax], 0
je 0x4cabc6
push 0
push 0
push 0x4cae58
mov ecx, 0x4cae40
mov edx, dword [0x4d643c]
mov edx, dword [edx]
lea eax, [ebp - 0x60]
call fcn.00403498
mov ecx, dword [ebp - 0x60]
xor edx, edx
mov eax, 0x4cae6c
call fcn.004b7138
push 0x4cae58
xor ecx, ecx
xor edx, edx
mov eax, 0x4cae88
call fcn.004afe50
jmp 0x4cac25
push 0
push 0
push 0x4cae58
mov ecx, 0x4cae40
mov edx, dword [0x4d643c]
mov edx, dword [edx]
lea eax, [ebp - 0x64]
call fcn.00403498
mov ecx, dword [ebp - 0x64]
xor edx, edx
mov eax, 0x4cae88
call fcn.004b7138
jmp 0x4cac25
push 0x4cae58
xor ecx, ecx
xor edx, edx
mov eax, 0x4cae88
call fcn.004afe50
mov eax, dword [0x4d64c4]
cmp byte [eax], 0
je 0x4cac25
push 0x4cae58
xor ecx, ecx
xor edx, edx
mov eax, 0x4cae6c
call fcn.004afe50
mov eax, dword [ebx + 0x318]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4cac66
push 0
push 0
push 0x4cae58
mov ecx, 0x4cae40
mov edx, dword [0x4d643c]
mov edx, dword [edx]
lea eax, [ebp - 0x68]
call fcn.00403498
mov ecx, dword [ebp - 0x68]
mov dl, 1
mov eax, 0x4cae88
call fcn.004b7138
jmp 0x4cac79
push 0x4cae58
xor ecx, ecx
mov dl, 1
mov eax, 0x4cae88
call fcn.004afe50
mov eax, dword [0x4d64c4]
cmp byte [eax], 0
je 0x4cad8e
mov eax, dword [ebx + 0x320]
mov edx, dword [eax]
call dword [edx + 0xc8]
and eax, 0x7f
lea edx, [ebp - 0x6c]
call fcn.004085cc
mov ecx, dword [ebp - 0x6c]
mov edx, 0x4caea4
mov eax, 0x4caeb8
call fcn.004b5d68
mov eax, dword [ebx + 0x324]
mov edx, dword [eax]
call dword [edx + 0xc8]
and eax, 0x7f
lea edx, [ebp - 0x70]
call fcn.004085cc
mov ecx, dword [ebp - 0x70]
mov edx, 0x4caed0
mov eax, 0x4caeb8
call fcn.004b5d68
mov eax, dword [ebx + 0x328]
mov edx, dword [eax]
call dword [edx + 0xc8]
and eax, 0x7f
lea edx, [ebp - 0x74]
call fcn.004085cc
mov ecx, dword [ebp - 0x74]
mov edx, 0x4caee0
mov eax, 0x4caeb8
call fcn.004b5d68
mov eax, dword [ebx + 0x320]
mov edx, dword [eax]
call dword [edx + 0xc8]
and eax, 0x7f
lea edx, [ebp - 0x78]
call fcn.004085cc
mov ecx, dword [ebp - 0x78]
mov edx, 0x4caea4
mov eax, 0x4caeb8
call fcn.004b5fcc
mov eax, dword [ebx + 0x324]
mov edx, dword [eax]
call dword [edx + 0xc8]
and eax, 0x7f
lea edx, [ebp - 0x7c]
call fcn.004085cc
mov ecx, dword [ebp - 0x7c]
mov edx, 0x4caed0
mov eax, 0x4caeb8
call fcn.004b5fcc
mov eax, dword [ebx + 0x328]
mov edx, dword [eax]
call dword [edx + 0xc8]
and eax, 0x7f
lea edx, [ebp - 0x80]
call fcn.004085cc
mov ecx, dword [ebp - 0x80]
mov edx, 0x4caee0
mov eax, 0x4caeb8
call fcn.004b5fcc
call fcn.004b440c
mov eax, dword [0x4d68d4]
call fcn.0040f100
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cadc2
lea eax, [ebp - 0x80]
mov edx, 0xa
call fcn.0040317c
lea eax, [ebp - 0x58]
call fcn.004038f0
ret