Function at 0x4e0d00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
movsx eax, byte [esi]
cmp eax, 0x61
jb 0x4e0d1d
sub eax, 0x20
cmp eax, 0x41
jb 0x4e0d2d
cmp eax, 0x5a
ja 0x4e0d2d
cmp byte [esi + 1], 0x3a
je 0x4e0d4b
push 0x2f
push esi
call fcn.004df968
add esp, 8
test eax, eax
jne 0x4e0d4b
push 0x5c
push esi
call fcn.004df968
add esp, 8
test eax, eax
je 0x4e0d50
xor edx, edx
mov dword [ebp + 0x18], edx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
push 0x5c
push esi
call fcn.004dfc2c
add esp, 8
mov edi, eax
test eax, eax
je 0x4e0d69
inc edi
jmp 0x4e0d6b
mov edi, esi
push 0x2e
push edi
call fcn.004dfc2c
add esp, 8
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4e0dd3
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x118]
push edx
push 0x725879
push ecx
push esi
call fcn.004e0af8
add esp, 0x10
mov edi, eax
test eax, eax
je 0x4e0e32
push 0x72587a
mov edx, dword [ebp - 0x10]
push edx
call fcn.004dfa10
add esp, 8
test eax, eax
je 0x4e0dca
push 0x72587f
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004dfa10
add esp, 8
test eax, eax
jne 0x4e0e32
mov dword [ebp - 0x14], 1
jmp 0x4e0e32
mov eax, dword [ebp + 0x18]
lea edx, [ebp - 0x118]
push eax
push str..EXE
push edx
push esi
call fcn.004e0af8
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x4e0e32
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x118]
push edx
push str..BAT
push ecx
push esi
call fcn.004e0af8
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x4e0e32
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x118]
push edx
push str..CMD
push ecx
push esi
call fcn.004e0af8
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x14], eax
test edi, edi
je 0x4e0e4e
cmp dword [ebp - 0x14], 0
je 0x4e0e60
push 0x725893
call fcn.004e0340
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x4e0e60
mov dword [0x725704], 2
or eax, 0xffffffff
jmp 0x4e1124
cmp dword [ebp - 0x14], 0
je 0x4e0e7f
mov edx, dword [ebp + 0x10]
push edx
push 0x72589b
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004e0bb0
add esp, 0xc
mov edi, eax
jmp 0x4e0e98
mov eax, dword [ebp + 0x10]
add eax, 4
push eax
push 0
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx]
push ecx
call fcn.004e0bb0
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x4e0eae
mov dword [0x725704], 8
or eax, 0xffffffff
jmp 0x4e1124
cmp dword [ebp + 0x14], 0
jne 0x4e0ebb
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4e0ee5
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.004e0c9c
pop ecx
mov dword [ebp - 8], eax
test eax, eax
jne 0x4e0ee5
mov dword [0x725704], 8
push edi
call fcn.004d8360
pop ecx
or eax, 0xffffffff
jmp 0x4e1124
call dword [0x725784]
push 0x44
push 0
lea edx, [ebp - 0x168]
push edx
call fcn.004d91b8
add esp, 0xc
mov dword [ebp - 0x168], 0x44
mov word [ebp - 0x138], 0xa
cmp dword [0x7241cc], 0
je 0x4e0f4e
push 0
call dword [0x7241c4]
pop ecx
mov esi, eax
mov word [ebp - 0x136], si
movzx eax, si
push eax
call fcn.004d8350
pop ecx
mov dword [ebp - 0x134], eax
test eax, eax
je 0x4e0ecc
mov edx, dword [ebp - 0x134]
push edx
call dword [0x7241c4]
pop ecx
mov dword [ebp - 0x124], 0xc
xor ecx, ecx
xor esi, esi
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], 1
test bl, 0x20
je 0x4e0f76
or esi, 0x10
jmp 0x4e0f7e
test bl, 0x10
je 0x4e0f7e
or esi, 8
test bl, 0x40
je 0x4e0f89
or esi, 0x200
test bl, 0x80
je 0x4e0f91
or esi, 4
test bh, 2
je 0x4e0f9e
or esi, 0x800
jmp 0x4e0fa9
test bh, 4
je 0x4e0fa9
or esi, 0x1000
test bh, 8
je 0x4e0fb4
or esi, 0x4000000
test bh, 0x20
je 0x4e0fbe
or esi, 0x20
jmp 0x4e0fe0
test bh, 0x10
je 0x4e0fc8
or esi, 0x40
jmp 0x4e0fe0
test bh, 0x40
je 0x4e0fd5
or esi, 0x80
jmp 0x4e0fe0
test bh, 0x80
je 0x4e0fe0
or esi, 0x100
lea eax, [ebp - 0x178]
lea edx, [ebp - 0x168]
push eax
push edx
push 0
lea eax, [ebp - 0x124]
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x124]
push ecx
push esi
push 1
push eax
push edx
push edi
cmp dword [ebp - 0x14], 0
je 0x4e1011
mov ecx, dword [ebp - 0xc]
jmp 0x4e1017
lea ecx, [ebp - 0x118]
push ecx
call fcn.004e3c36
dec eax
je 0x4e105e
call fcn.004e3cfc
and eax, 0xffff
dec eax
je 0x4e103e
sub eax, 7
je 0x4e1045
sub eax, 0x51
jne 0x4e104c
mov eax, 0x2a
jmp 0x4e1051
mov eax, 0x13
jmp 0x4e1051
mov eax, 8
jmp 0x4e1051
mov eax, 0x15
mov dword [0x725704], eax
or esi, 0xffffffff
jmp 0x4e1111
cmp ebx, 0x10
jne 0x4e1068
mov ebx, 4
mov eax, ebx
and eax, 7
sub eax, 1
jb 0x4e107f
je 0x4e10c4
dec eax
je 0x4e10df
dec eax
sub eax, 2
jb 0x4e10b3
jmp 0x4e10f8
push 0xffffffffffffffff
mov edx, dword [ebp - 0x178]
push edx
call fcn.004e3f18
lea ecx, [ebp - 4]
push ecx
mov eax, dword [ebp - 0x178]
push eax
call fcn.004e3cde
test bh, 1
jne 0x4e10ae
mov edx, dword [ebp - 0x178]
push edx
call fcn.004e3c12
mov esi, dword [ebp - 4]
jmp 0x4e10fb
test bh, 1
jne 0x4e10c4
mov eax, dword [ebp - 0x178]
push eax
call fcn.004e3c12
mov edx, dword [ebp - 0x178]
push edx
mov ecx, dword [ebp - 0x170]
push ecx
call dword [0x725870]
add esp, 8
mov esi, eax
jmp 0x4e10fb
mov eax, dword [ebp - 8]
push eax
call fcn.004d8360
pop ecx
push edi
call fcn.004d8360
pop ecx
push 0
call fcn.004e02f0
pop ecx
or esi, 0xffffffff
test bl, 0x80
jne 0x4e1111
test bh, 1
jne 0x4e1111
mov eax, dword [ebp - 0x174]
push eax
call fcn.004e3c12
mov edx, dword [ebp - 8]
push edx
call fcn.004d8360
pop ecx
push edi
call fcn.004d8360
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret