Function at 0x48d5ba
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffc14
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push ebx
call fcn.0048b997
test eax, eax
je 0x48dc6a
cmp dword [ebx + 0x380], 0
jne 0x48dc6a
mov dword [ebx + 0x380], 1
push 0
call fcn.0055ca2c
pop ecx
mov esi, eax
mov dword [ebx + 0x38c], esi
mov eax, dword [ebx + 0x388]
cmp esi, eax
jne 0x48d616
inc eax
mov dword [ebx + 0x38c], eax
mov eax, dword [ebx + 0x35c]
test eax, eax
je 0x48d628
cmp eax, dword [ebx + 0x350]
ja 0x48d63c
mov dword [ebx + 0x33c], 9
mov dword [ebx + 0x344], 1
push ebx
call fcn.0048d3b9
mov edx, dword [ebp + 0x10]
cmp byte [edx], 0
je 0x48d65b
push dword [ebp + 0x10]
push 1
push 1
push 1
push 1
push ebx
call fcn.005191c5
mov dword [ebx + 0x370], 0xffffffff
push dword [ebx]
call fcn.0051fafa
push eax
call fcn.004172e2
push ebx
call fcn.0048d436
push 0
push dword [ebx]
call fcn.0051fafa
push eax
call fcn.005171cc
xor ecx, ecx
mov edi, ecx
mov esi, ecx
cmp dword [ebx + 0x344], 0
je 0x48d85d
cmp dword [ebx + 0x35c], 0
jbe 0x48d6e4
mov eax, dword [ebx + 0x38c]
sub eax, dword [ebx + 0x388]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jae 0x48d6bf
mov dword [ebp - 4], 1
mov eax, dword [ebx + 0x350]
mov edx, dword [ebx + 0x360]
cmp eax, edx
jae 0x48d6d3
mov ecx, eax
jmp 0x48d6d7
mov ecx, eax
sub ecx, edx
mov eax, ecx
xor edx, edx
div dword [ebp - 4]
mov dword [ebx + 0x364], eax
cmp dword [0x55e624], 0
je 0x48d6f5
push 0x1e
push ebx
call fcn.0048bad7
mov eax, dword [ebx + 0x338]
test eax, eax
jl 0x48d706
push eax
call fcn.005516dc
pop ecx
mov dword [ebx + 0x338], 0xffffffff
cmp dword [0x56cdd8], 0
je 0x48d778
push 0x7f8
push 0
lea edx, [ebp - 0xbec]
push edx
call fcn.0054e10c
add esp, 0xc
mov dword [ebp - 0xbe8], ebx
lea ecx, [ebx + 0x234]
push ecx
lea eax, [ebx + 0x130]
push eax
push 0x5664b6
lea edx, [ebp - 0xbc4]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0x10
lea ecx, [ebp - 0xbec]
push ecx
push 0
push 0
push 0x19
push 0x5664bc
push 0
push 0
push dword [ebx + 0x3b0]
call fcn.004fecf0
push 0
push 1
lea eax, [ebp - 0x3f4]
push eax
lea edx, [ebx + 0x234]
push edx
call fcn.00481b78
cmp byte [ebp - 0x3f4], 0
je 0x48d930
lea ecx, [ebp - 0x3f4]
push ecx
call fcn.0054e28c
pop ecx
add eax, 0xa
push eax
call fcn.00559d70
pop ecx
mov esi, eax
test esi, esi
je 0x48d930
push esi
lea edi, [ebp - 0x3f4]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
lea eax, [ebx + 0x234]
push eax
lea edx, [ebx + 0x130]
push edx
push 0x5664c6
lea ecx, [ebp - 0x3f4]
push ecx
call sub.USER32.dll_wsprintfA
add esp, 0x10
lea eax, [ebp - 0x3f4]
push eax
call fcn.0054e28c
pop ecx
add eax, 0xa
push eax
call fcn.00559d70
pop ecx
mov edi, eax
test edi, edi
je 0x48d84f
push esi
push edi
mov esi, edi
lea edi, [ebp - 0x3f4]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x48d930
push esi
call fcn.00559c5c
pop ecx
xor esi, esi
jmp 0x48d930
cmp dword [0x55e624], 0
je 0x48d86e
push 0x1d
push ebx
call fcn.0048bad7
cmp dword [0x56c2ec], 0
je 0x48d8ad
cmp dword [0x56bf0c], 1
jne 0x48d88d
push dword [0x56c2f8]
call fcn.0042c69a
jmp 0x48d8ad
cmp dword [0x56bf0c], 2
jne 0x48d8ad
push dword [ebx + 0x3b0]
push 1
push 0
push 7
call fcn.00477504
push eax
call fcn.0050d13a
mov eax, dword [ebx + 0x338]
test eax, eax
jl 0x48d8be
push eax
call fcn.005516dc
pop ecx
mov dword [ebx + 0x338], 0xffffffff
cmp dword [0x56cdd8], 0
je 0x48d930
push 0x7f8
push 0
lea edx, [ebp - 0x13e4]
push edx
call fcn.0054e10c
add esp, 0xc
mov dword [ebp - 0x13e0], ebx
lea ecx, [ebx + 0x234]
push ecx
lea eax, [ebx + 0x130]
push eax
push 0x5664cc
lea edx, [ebp - 0x13bc]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0x10
lea ecx, [ebp - 0x13e4]
push ecx
push 0
push 0
push 0x1b
push 0x5664d2
push 0
push 0
push dword [ebx + 0x3b0]
call fcn.004fecf0
push ebx
call fcn.0048b997
test eax, eax
je 0x48dc6a
cmp dword [ebp + 0xc], 0
jne 0x48db7b
cmp dword [ebx + 0x384], 0
je 0x48db7b
mov eax, dword [ebx]
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 0xc], edx
push dword [ebx + 0x3b0]
call fcn.0041261f
test eax, eax
je 0x48d979
mov ecx, dword [ebx + 0x3b0]
mov eax, dword [ecx]
mov dword [ebp - 8], eax
push dword [0x5618e8]
push dword [ebp - 8]
call fcn.004ef455
cmp dword [ebx + 0x344], 0
je 0x48d9c3
lea edx, [ebx + 4]
push edx
lea ecx, [ebx + 0x234]
push ecx
push 0
push 0xb6b
call fcn.0042c771
push eax
lea eax, [ebp - 0x3f4]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
mov dword [ebp - 0xc], 1
jmp 0x48da55
cmp dword [ebx + 0x33c], 5
jne 0x48d9f5
lea edx, [ebx + 4]
push edx
lea ecx, [ebx + 0x234]
push ecx
push 0
push 0x1008
call fcn.0042c771
push eax
lea eax, [ebp - 0x3f4]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x48da55
cmp dword [ebx + 0x33c], 4
jne 0x48da2e
lea edx, [ebx + 4]
push edx
lea ecx, [ebx + 0x234]
push ecx
push 0
push 0xb68
call fcn.0042c771
push eax
lea eax, [ebp - 0x3f4]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
mov dword [ebp - 0xc], 1
jmp 0x48da55
lea edx, [ebx + 4]
push edx
lea ecx, [ebx + 0x234]
push ecx
push 0
push 0xb69
call fcn.0042c771
push eax
lea eax, [ebp - 0x3f4]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
cmp dword [ebp - 0xc], 0
je 0x48db37
push 0x5664db
lea edx, [ebp - 0x3f4]
push edx
call fcn.0054e1b0
add esp, 8
mov eax, dword [ebx + 0x388]
test eax, eax
jle 0x48dac8
mov edx, dword [ebx + 0x38c]
sub edx, eax
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 1
jae 0x48da95
mov dword [ebp - 4], 1
push 1
push dword [ebp - 4]
push 0x5664df
call fcn.00512d37
push eax
lea ecx, [ebp - 0x3f4]
push ecx
call fcn.0054e1b0
add esp, 8
push 0x5664e3
lea eax, [ebp - 0x3f4]
push eax
call fcn.0054e1b0
add esp, 8
push 1
push 0
push 1
push 1
push 0
push 0
lea edx, [ebp - 0x3f4]
push edx
call fcn.0054e28c
pop ecx
lea ecx, [ebp - 0x3f4]
add eax, ecx
push eax
mov eax, dword [ebx + 0x364]
mov dword [ebp - 0x13ec], eax
xor edx, edx
mov dword [ebp - 0x13e8], edx
fild qword [ebp - 0x13ec]
add esp, 0xfffffff4
fstp xword [esp]
call fcn.004e6c02
push 0x5664e6
lea ecx, [ebp - 0x3f4]
push ecx
call fcn.0054e1b0
add esp, 8
push 0x5664ec
lea eax, [ebp - 0x3f4]
push eax
call fcn.0054e1b0
add esp, 8
xor edx, edx
mov dword [0x56cd18], edx
mov dword [0x56cd28], 1
push dword [0x5618e4]
lea ecx, [ebp - 0x3f4]
push ecx
push dword [ebp - 8]
call fcn.004ef55b
push dword [0x5618e8]
push dword [ebp - 8]
call fcn.004ef455
push 0
push 0
push 0x10
push dword [ebx]
call sub.USER32.dll_SendMessageA
jmp 0x48dbd7
cmp dword [ebx + 0x344], 0
je 0x48db95
push 0
push 0xb6a
call fcn.0042c771
mov dword [ebp + 0x10], eax
jmp 0x48dbbe
cmp dword [ebx + 0x33c], 4
jne 0x48dbaf
push 0
push 0xb67
call fcn.0042c771
mov dword [ebp + 0x10], eax
jmp 0x48dbbe
push 0
push 0xb60
call fcn.0042c771
mov dword [ebp + 0x10], eax
push dword [ebp + 0x10]
push 1
push 1
push 1
push 1
push ebx
call fcn.005191c5
push 1
push ebx
call fcn.0048b8ab
test esi, esi
je 0x48dc6a
cmp byte [esi], 0x2f
jne 0x48dbfb
push dword [ebx + 0x3b0]
push 0
push 0
push 1
push edi
push esi
push dword [ebx]
call fcn.004b07e0
jmp 0x48dc58
push 5
push 0x581f80
push edi
push esi
push 0
push dword [0x56f018]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x1f
jae 0x48dc58
xor eax, eax
mov dword [0x56cd18], eax
mov dword [0x56cd28], 1
push esi
push 0
push 0xb6c
call fcn.0042c771
push eax
lea edx, [ebp - 0x3f4]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0xc
push dword [0x5618e8]
lea ecx, [ebp - 0x3f4]
push ecx
push dword [ebx]
call fcn.004f0245
push esi
call fcn.00559c5c
pop ecx
test edi, edi
je 0x48dc6a
push edi
call fcn.00559c5c
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc