Function at 0x4821e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x20
push 0
push 0
dec ecx
jne 0x4821e8
push ebx
push esi
push edi
mov ebx, eax
mov edi, dword [0x486a7c]
xor eax, eax
push ebp
push 0x482f0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [edi]
lea eax, [ebp - 0x10]
mov ecx, 0x482f24
call fcn.0040482c
mov eax, dword [ebp - 0x10]
call fcn.00408ddc
test al, al
je 0x482234
mov edx, dword [edi]
lea eax, [ebp - 0xc]
mov ecx, 0x482f24
call fcn.0040482c
jmp 0x48225e
lea edx, [ebp - 0x18]
mov eax, dword [0x486a00]
mov eax, dword [eax]
call fcn.0045d31c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408fb0
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, 0x482f3c
call fcn.0040482c
push 1
push 0
push 0x482f54
push dword [edi]
push 0x482f64
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x1c]
call fcn.004049d8
push eax
mov eax, dword [ebp - 0xc]
call fcn.004049d8
mov esi, eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x482f84
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x20]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x482f9c
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x24]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x482fb4
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x28]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x482fcc
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x2c]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x482fe4
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x30]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x482ffc
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x34]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x483014
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x38]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x48302c
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x3c]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x483044
lea eax, [ebp - 0x40]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x40]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x48305c
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x44]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x483074
lea eax, [ebp - 0x48]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x48]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x48308c
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x4c]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x4830a4
lea eax, [ebp - 0x50]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x50]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x4830bc
lea eax, [ebp - 0x54]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x54]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x4830d4
lea eax, [ebp - 0x58]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x58]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x4830ec
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x5c]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x483104
lea eax, [ebp - 0x60]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x60]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x48311c
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x64]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x483130
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x68]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x483148
lea eax, [ebp - 0x6c]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x6c]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x483160
lea eax, [ebp - 0x70]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x70]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
mov eax, dword [0x48688c]
push dword [eax]
push 0x483174
lea eax, [ebp - 0x74]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x74]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
mov eax, dword [0x48688c]
push dword [eax]
push 0x48318c
lea eax, [ebp - 0x78]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x78]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
mov eax, dword [0x48688c]
push dword [eax]
push 0x4831a8
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x7c]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x4831c8
lea eax, [ebp - 0x80]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x80]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x4831e0
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x84]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x4831fc
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x88]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x483214
lea eax, [ebp - 0x8c]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x8c]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x48322c
lea eax, [ebp - 0x90]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x90]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x483244
lea eax, [ebp - 0x94]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x94]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0x482f54
push dword [edi]
push 0x483258
lea eax, [ebp - 0x98]
mov edx, 3
call fcn.004048a0
mov eax, dword [ebp - 0x98]
call fcn.004049d8
push eax
push esi
push 0x482f74
mov eax, ebx
call fcn.00443b5c
push eax
call sub.shell32.dll_ShellExecuteA
mov edx, dword [edi]
lea eax, [ebp - 0x9c]
mov ecx, 0x483270
call fcn.0040482c
mov edx, dword [ebp - 0x9c]
lea eax, [ebp - 8]
call fcn.00404d64
lea eax, [ebp - 4]
call fcn.00406298
push eax
mov eax, dword [ebp - 8]
call fcn.00404d74
push eax
call sub.oleaut32.dll_LoadTypeLib
test eax, eax
jne 0x482a0a
push 0
mov eax, dword [ebp - 8]
call fcn.00404d74
push eax
mov eax, dword [ebp - 4]
push eax
call sub.oleaut32.dll_RegisterTypeLib
push 0
mov ecx, dword [0x486a98]
mov ecx, dword [ecx]
lea eax, [ebp - 0xa0]
mov edx, 0x483288
call fcn.0040482c
mov edx, dword [ebp - 0xa0]
xor ecx, ecx
mov eax, 0x80000002
call fcn.0045eea4
mov eax, dword [0x4869f0]
mov eax, dword [eax]
push eax
mov ecx, dword [0x486a98]
mov ecx, dword [ecx]
lea eax, [ebp - 0xa4]
mov edx, 0x483288
call fcn.0040482c
mov edx, dword [ebp - 0xa4]
mov ecx, 0x483294
mov eax, 0x80000002
call fcn.0045eea4
mov eax, dword [0x4868c0]
mov eax, dword [eax]
push eax
mov ecx, dword [0x486a98]
mov ecx, dword [ecx]
lea eax, [ebp - 0xa8]
mov edx, 0x483288
call fcn.0040482c
mov edx, dword [ebp - 0xa8]
mov ecx, 0x4832a8
mov eax, 0x80000002
call fcn.0045eea4
lea edx, [ebp - 0xb0]
mov eax, dword [0x486a00]
mov eax, dword [eax]
call fcn.0045d31c
mov eax, dword [ebp - 0xb0]
lea edx, [ebp - 0xac]
call fcn.00408fb0
mov eax, dword [ebp - 0xac]
push eax
mov ecx, dword [0x486a98]
mov ecx, dword [ecx]
lea eax, [ebp - 0xb4]
mov edx, 0x483288
call fcn.0040482c
mov edx, dword [ebp - 0xb4]
mov ecx, 0x4832bc
mov eax, 0x80000002
call fcn.0045eea4
mov eax, dword [0x48688c]
mov eax, dword [eax]
push eax
mov ecx, dword [0x486a98]
mov ecx, dword [ecx]
lea eax, [ebp - 0xb8]
mov edx, 0x483288
call fcn.0040482c
mov edx, dword [ebp - 0xb8]
mov ecx, 0x4832d0
mov eax, 0x80000002
call fcn.0045eea4
mov eax, dword [0x486acc]
mov eax, dword [eax]
push eax
mov ecx, dword [0x486a98]
mov ecx, dword [ecx]
lea eax, [ebp - 0xbc]
mov edx, 0x483288
call fcn.0040482c
mov edx, dword [ebp - 0xbc]
mov ecx, 0x4832e8
mov eax, 0x80000002
call fcn.0045eea4
lea edx, [ebp - 0xc0]
mov eax, 0xc9
call fcn.00408c40
mov eax, dword [ebp - 0xc0]
push eax
push 0x483288
mov eax, dword [0x486a98]
push dword [eax]
push 0x483300
lea eax, [ebp - 0xc4]
mov edx, 3
call fcn.004048a0
mov edx, dword [ebp - 0xc4]
mov ecx, 0x483314
mov eax, 0x80000002
call fcn.0045eea4
mov eax, dword [0x486af8]
mov eax, dword [eax]
push eax
mov ecx, dword [0x486a98]
mov ecx, dword [ecx]
lea eax, [ebp - 0xc8]
mov edx, 0x483288
call fcn.0040482c
mov edx, dword [ebp - 0xc8]
mov ecx, 0x483320
mov eax, 0x80000002
call fcn.0045eea4
push 0
push 0x483288
mov eax, dword [0x486a98]
push dword [eax]
push 0x483334
lea eax, [ebp - 0xcc]
mov edx, 3
call fcn.004048a0
mov edx, dword [ebp - 0xcc]
xor ecx, ecx
mov eax, 0x80000002
call fcn.0045eea4
push 0
push 0x483288
mov eax, dword [0x486a98]
push dword [eax]
push 0x483334
lea eax, [ebp - 0xd0]
mov edx, 3
call fcn.004048a0
mov edx, dword [ebp - 0xd0]
mov ecx, 0x483348
mov eax, 0x80000002
call fcn.0045eea4
push 0
push 0x483288
mov eax, dword [0x486a98]
push dword [eax]
push 0x483358
lea eax, [ebp - 0xd4]
mov edx, 3
call fcn.004048a0
mov edx, dword [ebp - 0xd4]
xor ecx, ecx
mov eax, 0x80000002
call fcn.0045eea4
push 0
push 0x483288
mov eax, dword [0x486a98]
push dword [eax]
push 0x483358
lea eax, [ebp - 0xd8]
mov edx, 3
call fcn.004048a0
mov edx, dword [ebp - 0xd8]
mov ecx, 0x483368
mov eax, 0x80000002
call fcn.0045eea4
push 0
push 0x483288
mov eax, dword [0x486a98]
push dword [eax]
push 0x483378
lea eax, [ebp - 0xdc]
mov edx, 3
call fcn.004048a0
mov edx, dword [ebp - 0xdc]
xor ecx, ecx
mov eax, 0x80000002
call fcn.0045eea4
push 0x483388
push 0x483288
mov eax, dword [0x486a98]
push dword [eax]
push 0x483378
lea eax, [ebp - 0xe0]
mov edx, 3
call fcn.004048a0
mov edx, dword [ebp - 0xe0]
mov ecx, 0x483394
mov eax, 0x80000002
call fcn.0045eea4
mov eax, dword [0x4868e4]
mov eax, dword [eax]
push eax
mov ecx, dword [0x486a98]
mov ecx, dword [ecx]
lea eax, [ebp - 0xe4]
mov edx, 0x483288
call fcn.0040482c
mov edx, dword [ebp - 0xe4]
mov ecx, 0x4833a4
mov eax, 0x80000002
call fcn.0045eea4
push 0
mov ecx, dword [0x486b0c]
mov ecx, dword [ecx]
lea eax, [ebp - 0xe8]
mov edx, 0x4833b8
call fcn.0040482c
mov edx, dword [ebp - 0xe8]
xor ecx, ecx
mov eax, 0x80000002
call fcn.0045eea4
mov eax, dword [0x486b0c]
mov eax, dword [eax]
push eax
mov ecx, dword [0x486b0c]
mov ecx, dword [ecx]
lea eax, [ebp - 0xec]
mov edx, 0x4833b8
call fcn.0040482c
mov edx, dword [ebp - 0xec]
mov ecx, 0x4833f8
mov eax, 0x80000002
call fcn.0045eea4
push 0x48340c
lea edx, [ebp - 0xf8]
mov eax, dword [0x486a00]
mov eax, dword [eax]
call fcn.0045d31c
mov eax, dword [ebp - 0xf8]
lea edx, [ebp - 0xf4]
call fcn.00408fb0
push dword [ebp - 0xf4]
push 0x483418
push 0x48340c
lea eax, [ebp - 0xf0]
mov edx, 4
call fcn.004048a0
mov eax, dword [ebp - 0xf0]
push eax
mov ecx, dword [0x486b0c]
mov ecx, dword [ecx]
lea eax, [ebp - 0xfc]
mov edx, 0x4833b8
call fcn.0040482c
mov edx, dword [ebp - 0xfc]
mov ecx, 0x483430
mov eax, 0x80000002
call fcn.0045eea4
push 0x483448
xor ecx, ecx
mov edx, 0x483460
mov eax, 0x80000000
call fcn.0045eea4
push 0x483498
xor ecx, ecx
mov edx, 0x4834ac
mov eax, 0x80000000
call fcn.0045eea4
push 0x4834f4
xor ecx, ecx
mov edx, 0x48350c
mov eax, 0x80000000
call fcn.0045eea4
mov edx, dword [0x4869b4]
mov edx, dword [edx]
lea eax, [ebp - 0x100]
mov ecx, 0x48354c
call fcn.0040482c
mov eax, dword [ebp - 0x100]
push eax
mov ecx, 0x483560
mov edx, 0x483570
mov eax, 0x80000000
call fcn.0045eea4
push 0x4835a0
xor ecx, ecx
mov edx, 0x4835d0
mov eax, 0x80000000
call fcn.0045eea4
push 0x483608
xor ecx, ecx
mov edx, 0x483638
mov eax, 0x80000000
call fcn.0045eea4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482f15
lea eax, [ebp - 0x100]
mov edx, 0x3e
call fcn.0040454c
lea eax, [ebp - 8]
call fcn.00404c18
lea eax, [ebp - 4]
call fcn.00406298
ret