Function at 0x4cd208
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1e
push 0
push 0
dec ecx
jne 0x4cd210
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035f4
xor eax, eax
push ebp
push 0x4cdb00
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x70]
call fcn.004afb9c
lea eax, [ebp - 0x70]
mov edx, 0x4cdb18
call fcn.00403450
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 8]
call fcn.004afa38
push 0
push 0x4cdb1c
push 0x4cdb28
push dword [ebp - 8]
push 0x4cdb44
lea eax, [ebp - 0x74]
mov edx, 3
call fcn.0040350c
mov eax, dword [ebp - 0x74]
call fcn.00403614
push eax
push 0x4cdb48
push 0x4cdb4c
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, 0x4cdb5c
call fcn.004ccb6c
call fcn.004ccdc8
call fcn.004cd024
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4cd2cf
mov eax, dword [0x4d67b4]
cmp byte [eax], 0
je 0x4cd874
mov ecx, 0x2011f
mov dl, 1
mov eax, dword [0x43aa8c]
call fcn.0043ac3c
mov ebx, eax
cmp dword [ebp - 0x14], 1
jne 0x4cd2e8
mov ecx, 0x2001f
mov dl, 1
mov eax, dword [0x43aa8c]
call fcn.0043ac3c
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.0043acd4
xor ecx, ecx
mov edx, 0x4cdba4
mov eax, ebx
call fcn.0043ad3c
test al, al
je 0x4cd397
mov dl, 1
mov eax, dword [0x4187ac]
call fcn.004021c0
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0043b060
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4cd38f
inc eax
mov dword [ebp - 0x18], eax
xor esi, esi
lea ecx, [ebp - 0x7c]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x7c]
lea edx, [ebp - 0x78]
call fcn.00407e44
mov eax, dword [ebp - 0x78]
push eax
lea edx, [ebp - 0x80]
mov eax, 0x4cdbc8
call fcn.00407e44
mov eax, dword [ebp - 0x80]
pop edx
call fcn.0040374c
test eax, eax
je 0x4cd389
lea ecx, [ebp - 0x84]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x84]
mov eax, ebx
call fcn.0043ae60
inc esi
dec dword [ebp - 0x18]
jne 0x4cd336
lea eax, [ebp - 0x10]
call fcn.0040f100
mov eax, ebx
call fcn.0043aca4
mov edx, 0x80000002
mov eax, ebx
call fcn.0043acd4
mov edx, 0x4cdbdc
mov eax, ebx
call fcn.0043ae60
mov eax, ebx
call fcn.0043aca4
mov edx, 0x80000001
mov eax, ebx
call fcn.0043acd4
xor ecx, ecx
mov edx, 0x4cdc28
mov eax, ebx
call fcn.0043ad3c
test al, al
je 0x4cd47e
mov dl, 1
mov eax, dword [0x4187ac]
call fcn.004021c0
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0043b128
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4cd476
inc eax
mov dword [ebp - 0x18], eax
xor esi, esi
lea ecx, [ebp - 0x8c]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x8c]
lea edx, [ebp - 0x88]
call fcn.00407e44
mov eax, dword [ebp - 0x88]
push eax
mov eax, 0x4cdbc8
lea edx, [ebp - 0x90]
call fcn.00407e44
mov eax, dword [ebp - 0x90]
pop edx
call fcn.0040374c
test eax, eax
je 0x4cd470
lea ecx, [ebp - 0x94]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x94]
mov eax, ebx
call fcn.0043afd8
inc esi
dec dword [ebp - 0x18]
jne 0x4cd40b
lea eax, [ebp - 0x10]
call fcn.0040f100
mov eax, ebx
call fcn.0043aca4
mov edx, 0x80000002
mov eax, ebx
call fcn.0043acd4
xor ecx, ecx
mov edx, 0x4cdc7c
mov eax, ebx
call fcn.0043ad3c
test al, al
je 0x4cd546
mov dl, 1
mov eax, dword [0x4187ac]
call fcn.004021c0
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0043b128
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4cd53e
inc eax
mov dword [ebp - 0x18], eax
xor esi, esi
lea ecx, [ebp - 0x9c]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x9c]
lea edx, [ebp - 0x98]
call fcn.00407e44
mov eax, dword [ebp - 0x98]
push eax
mov eax, 0x4cdbc8
lea edx, [ebp - 0xa0]
call fcn.00407e44
mov eax, dword [ebp - 0xa0]
pop edx
call fcn.0040374c
test eax, eax
je 0x4cd538
lea ecx, [ebp - 0xa4]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xa4]
mov eax, ebx
call fcn.0043afd8
inc esi
dec dword [ebp - 0x18]
jne 0x4cd4d3
lea eax, [ebp - 0x10]
call fcn.0040f100
mov eax, ebx
call fcn.0043aca4
mov edx, 0x80000002
mov eax, ebx
call fcn.0043acd4
xor ecx, ecx
mov edx, 0x4cdcc8
mov eax, ebx
call fcn.0043ad3c
test al, al
je 0x4cd60e
mov dl, 1
mov eax, dword [0x4187ac]
call fcn.004021c0
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0043b060
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4cd606
inc eax
mov dword [ebp - 0x18], eax
xor esi, esi
lea ecx, [ebp - 0xac]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xac]
lea edx, [ebp - 0xa8]
call fcn.00407e44
mov eax, dword [ebp - 0xa8]
push eax
mov eax, 0x4cdbc8
lea edx, [ebp - 0xb0]
call fcn.00407e44
mov eax, dword [ebp - 0xb0]
pop edx
call fcn.0040374c
test eax, eax
je 0x4cd600
lea ecx, [ebp - 0xb4]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xb4]
mov eax, ebx
call fcn.0043ae60
inc esi
dec dword [ebp - 0x18]
jne 0x4cd59b
lea eax, [ebp - 0x10]
call fcn.0040f100
mov eax, ebx
call fcn.0043aca4
mov edx, 0x80000002
mov eax, ebx
call fcn.0043acd4
xor ecx, ecx
mov edx, 0x4cdd14
mov eax, ebx
call fcn.0043ad3c
test al, al
je 0x4cd6d6
mov dl, 1
mov eax, dword [0x4187ac]
call fcn.004021c0
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0043b060
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4cd6ce
inc eax
mov dword [ebp - 0x18], eax
xor esi, esi
lea ecx, [ebp - 0xbc]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xbc]
lea edx, [ebp - 0xb8]
call fcn.00407e44
mov eax, dword [ebp - 0xb8]
push eax
mov eax, 0x4cdbc8
lea edx, [ebp - 0xc0]
call fcn.00407e44
mov eax, dword [ebp - 0xc0]
pop edx
call fcn.0040374c
test eax, eax
je 0x4cd6c8
lea ecx, [ebp - 0xc4]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xc4]
mov eax, ebx
call fcn.0043ae60
inc esi
dec dword [ebp - 0x18]
jne 0x4cd663
lea eax, [ebp - 0x10]
call fcn.0040f100
mov eax, ebx
call fcn.0043aca4
mov edx, 0x80000002
mov eax, ebx
call fcn.0043acd4
xor ecx, ecx
mov edx, 0x4cdd14
mov eax, ebx
call fcn.0043ad3c
test al, al
je 0x4cd79e
mov dl, 1
mov eax, dword [0x4187ac]
call fcn.004021c0
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0043b060
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4cd796
inc eax
mov dword [ebp - 0x18], eax
xor esi, esi
lea ecx, [ebp - 0xcc]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xcc]
lea edx, [ebp - 0xc8]
call fcn.00407e44
mov eax, dword [ebp - 0xc8]
push eax
mov eax, 0x4cdbc8
lea edx, [ebp - 0xd0]
call fcn.00407e44
mov eax, dword [ebp - 0xd0]
pop edx
call fcn.0040374c
test eax, eax
je 0x4cd790
lea ecx, [ebp - 0xd4]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xd4]
mov eax, ebx
call fcn.0043ae60
inc esi
dec dword [ebp - 0x18]
jne 0x4cd72b
lea eax, [ebp - 0x10]
call fcn.0040f100
mov eax, ebx
call fcn.0043aca4
mov edx, 0x80000001
mov eax, ebx
call fcn.0043acd4
xor ecx, ecx
mov edx, 0x4cdd68
mov eax, ebx
call fcn.0043ad3c
test al, al
je 0x4cd866
mov dl, 1
mov eax, dword [0x4187ac]
call fcn.004021c0
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0043b128
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4cd85e
inc eax
mov dword [ebp - 0x18], eax
xor esi, esi
lea ecx, [ebp - 0xdc]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xdc]
lea edx, [ebp - 0xd8]
call fcn.00407e44
mov eax, dword [ebp - 0xd8]
push eax
mov eax, 0x4cdbc8
lea edx, [ebp - 0xe0]
call fcn.00407e44
mov eax, dword [ebp - 0xe0]
pop edx
call fcn.0040374c
test eax, eax
je 0x4cd858
lea ecx, [ebp - 0xe4]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xe4]
mov eax, ebx
call fcn.0043afd8
inc esi
dec dword [ebp - 0x18]
jne 0x4cd7f3
lea eax, [ebp - 0x10]
call fcn.0040f100
mov eax, ebx
call fcn.0043aca4
mov eax, ebx
call fcn.004021f0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jne 0x4cd2a8
mov dl, 1
mov eax, dword [0x4187ac]
call fcn.004021c0
mov dword [ebp - 0x10], eax
mov edx, 0x4cddd0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4cde00
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4cde0c
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4cde6c
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4cdee4
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4cdf44
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4cdfa0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4cdff8
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4ce054
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4ce0b4
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4ce110
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4ce170
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4ce1e4
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4ce250
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4ce2c0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4ce304
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4ce350
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4ce39c
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4ce3f0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4ce444
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4ce494
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4ce4ec
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4ce544
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4ce5a4
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4d651c]
cmp dword [eax], 6
jl 0x4cd9e1
lea eax, [ebp - 0xc]
mov edx, 0x4ce604
call fcn.00403218
jmp 0x4cd9ee
lea eax, [ebp - 0xc]
mov edx, 0x4ce658
call fcn.00403218
push 0x4ce690
push dword [ebp - 0xc]
push 0x4ce6b0
lea eax, [ebp - 0xe8]
mov edx, 3
call fcn.0040350c
mov edx, dword [ebp - 0xe8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0xec]
mov ecx, 0x4ce6bc
mov edx, dword [ebp - 4]
call fcn.00403498
mov edx, dword [ebp - 0xec]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x74]
lea eax, [ebp - 0x10]
call fcn.0040f100
lea eax, [ebp - 0x5c]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
mov word [ebp - 0x2c], 1
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp - 4]
call fcn.00403614
push eax
push 0
push 8
push 0
push 0
push 0
push 0x4ce6d0
push dword [ebp - 4]
push 0x4ce6bc
push 0x4cdb44
lea eax, [ebp - 0xf0]
mov edx, 4
call fcn.0040350c
mov eax, dword [ebp - 0xf0]
call fcn.00403614
push eax
push 0
call sub.kernel32.dll_CreateProcessA
push 0xffffffffffffffff
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0xf4]
mov ecx, 0x4ce6bc
mov edx, dword [ebp - 4]
call fcn.00403498
mov eax, dword [ebp - 0xf4]
lea edx, [ebp - 8]
call fcn.004afa38
mov eax, dword [ebp - 8]
call fcn.00408e50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cdb07
lea eax, [ebp - 0xf4]
mov edx, 0x22
call fcn.0040317c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040317c
ret