Function at 0x4c9b20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, ecx
jne 0x4ca41a
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
cmp edx, 1
jne 0x4c9b77
lea eax, [ebp + 0x14]
push eax
push ebx
push esi
push 1
mov dword [ebp + 0x14], 1
call fcn.004c7fe0
cmp dword [ebp + 0x14], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
je 0x4c9c38
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp edx, 0x113
jne 0x4c9ba9
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0x14]
push edx
mov eax, ebx
push eax
push ecx
push 0x113
mov ecx, edi
call fcn.004b94a0
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp edx, 2
jne 0x4c9bda
lea eax, [ebp + 0x14]
push eax
push ebx
push esi
push edx
mov dword [ebp + 0x14], 1
call fcn.004b8ef0
cmp dword [ebp + 0x14], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
je 0x4c9c38
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp edx, 0x1a
jne 0x4c9c06
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0x14]
push edx
mov eax, ebx
push eax
push ecx
push 0x1a
mov ecx, edi
call fcn.004b9250
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp edx, 0x37f
jne 0x4c9c3b
mov edx, dword [ebp + 0x10]
lea eax, [ebp + 0x14]
push eax
mov ecx, ebx
push ecx
push edx
push 0x37f
mov ecx, edi
call fcn.004b9aa0
mov ecx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [ecx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [ebp + 0xc]
cmp edx, dword [0x5f71a4]
jne 0x4c9c6d
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 0x14]
push edx
push ebx
push esi
push eax
mov ecx, edi
mov dword [ebp + 0x14], 1
call fcn.004c50f0
cmp dword [ebp + 0x14], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jne 0x4c9b69
mov edx, dword [ebp + 0xc]
cmp edx, 0x117
jne 0x4c9cab
lea edx, [ebp + 0x14]
push edx
push ebx
push esi
push 0x117
mov ecx, edi
mov dword [ebp + 0x14], 1
call fcn.004c0e50
cmp dword [ebp + 0x14], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
je 0x4ca069
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp edx, 0x8064
jne 0x4c9cd8
lea edx, [ebp + 0x14]
push edx
push ebx
push esi
push 0x8064
mov ecx, edi
call fcn.004b9480
mov ecx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [ecx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp edx, 0x111
jne 0x4ca039
mov eax, 0xe103
cmp ax, si
jne 0x4c9d12
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
shr esi, 0x10
push esi
mov ecx, edi
call fcn.004be8d0
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0xe102
cmp ax, si
jne 0x4c9d40
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
shr esi, 0x10
push esi
mov ecx, edi
call fcn.004b9270
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0x8026
cmp ax, si
jne 0x4c9d6e
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
shr esi, 0x10
push esi
mov ecx, edi
call fcn.004b9290
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0x800d
cmp ax, si
jne 0x4c9d9c
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
shr esi, 0x10
push esi
mov ecx, edi
call fcn.004c9460
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0x800e
cmp ax, si
jne 0x4c9dca
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
shr esi, 0x10
push esi
mov ecx, edi
call fcn.004c9580
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0x800f
cmp ax, si
jne 0x4c9df8
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
shr esi, 0x10
push esi
mov ecx, edi
call fcn.004c9610
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0x807a
cmp ax, si
jne 0x4c9e26
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
shr esi, 0x10
push esi
mov ecx, edi
call fcn.004b92c0
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0x9c91
cmp ax, si
jne 0x4c9e54
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
shr esi, 0x10
push esi
mov ecx, edi
call fcn.004c96a0
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0x9c94
cmp ax, si
jne 0x4c9e82
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
shr esi, 0x10
push esi
mov ecx, edi
call fcn.004c9730
mov edx, dword [ebp + 0x18]
mov dword [edx], eax
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0x9c92
cmp ax, si
jne 0x4c9eb0
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
shr esi, 0x10
push esi
mov ecx, edi
call fcn.004c97c0
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0x9c93
cmp ax, si
jne 0x4c9ede
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
shr esi, 0x10
push esi
mov ecx, edi
call fcn.004c9850
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0x120
cmp ax, si
jne 0x4c9f0c
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
shr esi, 0x10
push esi
mov ecx, edi
call fcn.004c98e0
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0x125
cmp ax, si
jne 0x4c9f3a
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
shr esi, 0x10
push esi
mov ecx, edi
call fcn.004c9a90
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0x8012
cmp ax, si
jne 0x4c9f68
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
shr esi, 0x10
push esi
mov ecx, edi
call fcn.004c9a00
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0x8013
cmp ax, si
jne 0x4c9f96
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
shr esi, 0x10
push esi
mov ecx, edi
call fcn.004c9970
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0x8016
cmp ax, si
jne 0x4c9fc4
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
shr esi, 0x10
push esi
mov ecx, edi
call fcn.004c94f0
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0x7d5
cmp ax, si
jne 0x4c9fd9
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
jmp 0x4c9e64
mov eax, 0x9c87
cmp ax, si
jne 0x4ca007
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
shr esi, 0x10
push esi
mov ecx, edi
call fcn.004c74d0
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, 0x9c88
cmp ax, si
jne 0x4ca0ca
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
shr esi, 0x10
push esi
mov ecx, edi
call fcn.004c7510
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp edx, 0x112
jne 0x4ca13e
lea eax, [ebp + 0x14]
push eax
push ebx
push esi
push edx
mov ecx, edi
mov dword [ebp + 0x14], 1
call fcn.004c71a0
cmp dword [ebp + 0x14], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jne 0x4c9e74
mov edx, dword [ebp + 0xc]
cmp dword [0x5ed808], 0
je 0x4ca2be
cmp edx, 0x4e
jne 0x4ca305
mov ecx, dword [ebx + 8]
cmp ecx, 0xfffffff4
jne 0x4ca2c7
mov eax, dword [edi + 0x2ce4]
mov edx, dword [ebx]
cmp edx, dword [eax + 4]
jne 0x4ca1ba
test eax, eax
je 0x4ca198
lea ecx, [ebp + 0x18]
push ecx
add eax, 4
push ebx
push eax
mov ecx, edi
call fcn.004bef20
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp esi, 0x4d2
jne 0x4ca06c
mov eax, dword [edi + 0x120]
mov edx, dword [edi + 0x2ce4]
cmp eax, dword [edx + 4]
jne 0x4ca0f6
push 0x80
lea eax, [ebp - 0x100]
push eax
push 0x108
jmp 0x4ca112
mov edx, dword [edi + 0x2cec]
cmp eax, dword [edx + 4]
jne 0x4ca11f
push 0x80
lea eax, [ebp - 0x100]
push eax
push 0x10b
mov ecx, dword [0x5fd7c0]
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push 1
push 0
push 0
lea edx, [ebp - 0x100]
push edx
push 0x59bf70
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4ca069
cmp edx, 0x4e
jne 0x4ca06c
cmp dword [ebx + 8], 0xfffffdd9
jne 0x4ca16d
cmp byte [edi + 0x198], 0
jne 0x4ca16d
lea eax, [ebp + 0x14]
push eax
push 0
push 0
push 0
mov ecx, edi
call fcn.004c7480
mov edx, dword [ebp + 0xc]
cmp dword [ebx + 8], 0xfffffdd8
jne 0x4ca06c
mov edx, dword [ebp + 0x18]
xor ecx, ecx
cmp dword [edi + 0x2d64], ecx
pop edi
setg cl
pop esi
mov eax, 1
pop ebx
mov dword [edx], ecx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [ebp + 0x18]
push ecx
xor eax, eax
push ebx
push eax
mov ecx, edi
call fcn.004bef20
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [ebp + 0xc]
cmp ecx, 0xfffffff4
jne 0x4ca2c7
mov eax, dword [edi + 0x2cf8]
mov edx, dword [ebx]
cmp edx, dword [eax + 4]
jne 0x4ca21c
test eax, eax
je 0x4ca1fa
lea ecx, [ebp + 0x18]
push ecx
add eax, 4
push ebx
push eax
mov ecx, edi
call fcn.004bf070
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [ebp + 0x18]
push ecx
xor eax, eax
push ebx
push eax
mov ecx, edi
call fcn.004bf070
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [ebp + 0xc]
cmp ecx, 0xfffffff4
jne 0x4ca2c7
mov eax, dword [edi + 0x2cf4]
mov edx, dword [ebx]
cmp edx, dword [eax + 4]
jne 0x4ca27e
test eax, eax
je 0x4ca25c
lea ecx, [ebp + 0x18]
push ecx
add eax, 4
push ebx
push eax
mov ecx, edi
call fcn.004bf1c0
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [ebp + 0x18]
push ecx
xor eax, eax
push ebx
push eax
mov ecx, edi
call fcn.004bf1c0
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [ebp + 0xc]
cmp ecx, 0xfffffff4
jne 0x4ca2c7
mov eax, dword [edi + 0x2cfc]
mov ecx, dword [ebx]
cmp ecx, dword [eax + 4]
jne 0x4ca2c7
test eax, eax
je 0x4ca29c
add eax, 4
jmp 0x4ca29e
xor eax, eax
lea edx, [ebp + 0x18]
push edx
push ebx
push eax
mov ecx, edi
call fcn.004bf310
mov ecx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [ecx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp edx, 0x4e
jne 0x4ca377
cmp dword [ebx + 8], 0xfffffff4
jne 0x4ca305
mov eax, dword [edi + 0x2ce0]
mov ecx, dword [ebx]
cmp ecx, dword [eax + 4]
jne 0x4ca305
test eax, eax
je 0x4ca2e3
add eax, 4
jmp 0x4ca2e5
xor eax, eax
lea edx, [ebp + 0x18]
push edx
push ebx
push eax
mov ecx, edi
call fcn.004bf570
mov ecx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [ecx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp dword [0x5ed808], 0
je 0x4ca377
cmp edx, 0x4e
jne 0x4ca377
cmp dword [ebx + 8], 0xfffffff4
jne 0x4ca3b2
mov eax, dword [edi + 0x2ce8]
mov edx, dword [ebx]
cmp edx, dword [eax + 4]
jne 0x4ca3b2
test eax, eax
je 0x4ca355
lea ecx, [ebp + 0x18]
push ecx
add eax, 4
push ebx
push eax
mov ecx, edi
call fcn.004bf920
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [ebp + 0x18]
push ecx
xor eax, eax
push ebx
push eax
mov ecx, edi
call fcn.004bf920
mov edx, dword [ebp + 0x18]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp edx, 0x111
jne 0x4ca3b2
mov eax, 0xe803
cmp ax, si
jne 0x4ca3b2
lea ecx, [ebp + 0x14]
push ecx
push ebx
mov edx, esi
push eax
shr edx, 0x10
push edx
mov ecx, edi
mov dword [ebp + 0x14], 1
call fcn.004c7480
cmp dword [ebp + 0x14], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jne 0x4c9b69
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0
push edx
push ebx
push esi
push eax
push ecx
lea ecx, [edi + 0x124]
call fcn.004c7d80
test eax, eax
jne 0x4c9b69
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push edx
push ebx
push esi
push eax
push ecx
mov ecx, edi
call fcn.004c79d0
test eax, eax
jne 0x4c9b69
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 0x14]
push edx
push ebx
push esi
push eax
mov ecx, edi
mov dword [ebp + 0x14], 1
call fcn.004a3fb0
cmp dword [ebp + 0x14], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jne 0x4c9b69
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18