Function at 0x4bcac0
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
push 0xffffffffffffffff
push 0x5801cc
mov eax, dword fs:[0]
push eax
sub esp, 0x98
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e95e0]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xbc]
mov edi, dword [esp + 0xc0]
test edi, edi
mov dword [0x5f3220], 1
jl 0x4bcc51
cmp edi, dword [ebp + 0x1e0]
jge 0x4bcc51
add ebp, 0x1d8
cmp edi, dword [ebp + 8]
jge 0x4bce43
mov eax, dword [ebp + 4]
lea esi, [edi*4]
add eax, esi
mov eax, dword [eax]
cmp dword [eax + 0x24], 0
je 0x4bcb72
cmp edi, dword [ebp + 8]
jge 0x4bce43
mov eax, dword [ebp + 4]
mov ecx, dword [eax + esi]
mov edx, dword [ecx + 0x24]
add eax, esi
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4bcb72
cmp edi, dword [ebp + 8]
jge 0x4bce43
mov eax, dword [ebp + 4]
add eax, esi
mov eax, dword [eax]
mov dword [eax + 0x24], 0
cmp edi, dword [ebp + 8]
jge 0x4bce43
mov eax, dword [ebp + 4]
mov ecx, dword [eax + esi]
add eax, esi
cmp dword [ecx + 0x24], 0
jne 0x4bd48d
cmp edi, dword [ebp + 8]
jge 0x4bce43
mov eax, dword [ebp + 4]
mov edx, dword [eax + esi]
add eax, esi
cmp dword [edx + 0x28], 0
je 0x4bcbd4
cmp edi, dword [ebp + 8]
jge 0x4bce43
mov eax, dword [ebp + 4]
add eax, esi
mov eax, dword [eax]
add eax, 0x28
push eax
xor ebx, ebx
call fcn.00462ff0
add esp, 4
test eax, eax
jne 0x4bcbd4
mov eax, edi
mov ecx, ebp
call fcn.00439be0
mov ecx, dword [eax]
mov dword [ecx + 0x28], ebx
cmp edi, dword [ebp + 8]
jge 0x4bce43
mov eax, dword [ebp + 4]
mov edx, dword [eax + esi]
add eax, esi
cmp dword [edx + 0x28], 0
jne 0x4bd195
cmp dword [esp + 0xc4], 0
je 0x4bd195
push str.PlugApp
lea eax, [esp + 0x1c]
push 0x5f2868
push eax
call fcn.00401ba0
add esp, 0xc
mov dword [esp + 0xb4], 0
mov esi, dword [eax]
call fcn.004601b0
test eax, eax
lea ecx, [esp + 0x18]
sete bl
mov dword [esp + 0xb4], 0xffffffff
call fcn.004a4690
test bl, bl
je 0x4bcc6f
push 0
push 0
push str.plugApp
call fcn.00539414
xor eax, eax
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa4
ret 0xc
mov eax, edi
mov ecx, ebp
call fcn.00439be0
mov eax, dword [eax]
mov ecx, dword [eax + 4]
add eax, 4
cmp dword [ecx - 0xc], 0
je 0x4bd187
mov eax, edi
mov ecx, ebp
mov dword [esp + 0x18], 0
call fcn.00439be0
mov ebx, dword [eax]
lea edx, [esp + 0x18]
push edx
add ebx, 4
call fcn.00462ff0
add esp, 4
test eax, eax
mov ecx, ebp
mov eax, edi
je 0x4bcd16
call fcn.00439be0
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
lea esi, [esp + 0x44]
mov dword [eax + 0x28], ecx
call fcn.004bd4b0
mov eax, edi
mov ecx, ebp
mov dword [esp + 0xb4], 1
call fcn.00439be0
mov edx, dword [eax]
mov eax, dword [edx + 0x28]
mov ecx, esi
mov dword [esp + 0x44], eax
xor eax, eax
push ecx
push 0x4bca70
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0xb4], 0xffffffff
call fcn.004bd500
jmp 0x4bd195
call fcn.00439be0
mov edx, dword [eax]
add edx, 0x60
push edx
lea ecx, [esp + 0x20]
call fcn.004020d0
mov dword [esp + 0xb4], 2
mov ecx, dword [esp + 0x1c]
call fcn.004600b0
test eax, eax
jne 0x4bd050
mov eax, edi
mov ecx, ebp
call fcn.00439be0
mov eax, dword [eax]
cmp dword [eax + 0x64], 0
jne 0x4bd047
lea ecx, [esp + 0x18]
call fcn.004026e0
mov eax, edi
mov ecx, ebp
mov byte [esp + 0xb4], 3
call fcn.00439be0
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
lea eax, [esp + 0x1c]
push 0x5b7704
push eax
call fcn.00405480
mov ecx, dword [esp + 0x24]
add esp, 0xc
push 0
push 4
push ecx
call fcn.00539414
cmp eax, 6
jne 0x4bd03e
mov eax, edi
mov ecx, ebp
call fcn.00439be0
mov eax, dword [eax]
add eax, 0x34
cmp dword [eax + 8], 0
jle 0x4bd03e
lea ecx, [esp + 0x28]
call fcn.004026e0
push str.PlugApp_
lea edx, [esp + 0x24]
push 0x5f2868
push edx
mov byte [esp + 0xc0], 4
call fcn.00401ba0
add esp, 0xc
mov esi, eax
mov eax, edi
mov ecx, ebp
mov byte [esp + 0xb4], 5
call fcn.00439be0
mov eax, dword [eax]
add eax, 0xc
push eax
lea ecx, [esp + 0x28]
push esi
push ecx
call fcn.00401ae0
add esp, 0xc
push 0x59b2e4
push eax
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0xc0], 6
call fcn.00401ba0
add esp, 0xc
mov esi, eax
mov eax, edi
mov ecx, ebp
mov byte [esp + 0xb4], 7
call fcn.00439be0
mov eax, dword [eax]
add eax, 0x48
cmp dword [eax + 8], 0
jg 0x4bce48
call fcn.00530cad
mov ebx, dword [eax + 4]
mov eax, edi
mov ecx, ebp
call fcn.00439be0
mov eax, dword [eax]
add eax, 0x34
cmp dword [eax + 8], 0
jg 0x4bce64
call fcn.00530cad
mov ecx, dword [esi]
mov eax, dword [eax + 4]
mov edx, dword [ebx]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x34]
push str.URL:_s_r_nRefer:_s_r_nLocalFile:_s_r_nThreads:3_r_nRetryTimes:1
push ecx
call fcn.00405480
add esp, 0x14
lea ecx, [esp + 0x14]
call fcn.004a4690
lea ecx, [esp + 0x24]
call fcn.004a4690
lea ecx, [esp + 0x20]
mov byte [esp + 0xb4], 4
call fcn.004a4690
mov ecx, dword [esp + 0x28]
push 0x38
push edi
push 0x5f3148
call fcn.0051fce0
mov esi, eax
mov eax, edi
mov ecx, ebp
call fcn.00439be0
mov edx, dword [eax]
mov eax, edi
mov ecx, ebp
mov dword [edx + 0x64], esi
call fcn.00439be0
mov eax, dword [eax]
cmp dword [eax + 0x64], 0
je 0x4bd035
mov eax, edi
mov ecx, ebp
call fcn.00439be0
mov eax, dword [eax]
add eax, 0x34
mov ebx, 1
cmp dword [eax + 8], ebx
jle 0x4bcfb4
mov eax, edi
mov ecx, ebp
call fcn.00439be0
mov eax, dword [eax]
add eax, 0x34
cmp dword [eax + 8], ebx
jle 0x4bcfb4
lea ecx, [esp + 0x14]
call fcn.004026e0
mov eax, edi
mov ecx, ebp
mov byte [esp + 0xb4], 8
call fcn.00439be0
mov ecx, dword [eax]
add ecx, 0x48
mov eax, ebx
call fcn.00439be0
mov esi, eax
mov eax, edi
mov ecx, ebp
call fcn.00439be0
mov ecx, dword [eax]
add ecx, 0x34
mov eax, ebx
call fcn.00439be0
mov ecx, dword [esi]
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x1c]
push str.URL:_s_r_nRefer:_s_r_nThreads:3
push eax
call fcn.00405480
add esp, 0x10
mov eax, edi
mov ecx, ebp
call fcn.00439be0
mov ecx, dword [eax]
mov edx, dword [esp + 0x14]
mov eax, dword [ecx + 0x64]
push edx
push eax
mov esi, 0x5f3148
call fcn.00522060
push eax
mov ecx, esi
call fcn.005203f0
lea ecx, [esp + 0x14]
mov byte [esp + 0xb4], 4
call fcn.004a4690
mov eax, edi
mov ecx, ebp
add ebx, 1
call fcn.00439be0
mov eax, dword [eax]
add eax, 0x34
cmp ebx, dword [eax + 8]
jl 0x4bcf0e
mov eax, edi
mov ecx, ebp
call fcn.00439be0
mov eax, dword [eax]
mov eax, dword [eax + 0x64]
call fcn.0051de20
mov eax, edi
mov ecx, ebp
call fcn.00439be0
mov ecx, dword [eax]
mov edi, dword [ecx + 0x64]
call fcn.0051df90
lea ecx, [esp + 0x14]
call fcn.004026e0
mov eax, dword [esp + 0xc0]
mov ecx, ebp
mov byte [esp + 0xb4], 9
call fcn.00439be0
mov edx, dword [eax]
mov eax, dword [edx]
push eax
lea ecx, [esp + 0x18]
push str.ck_W_vN
push ecx
call fcn.00405480
mov edx, dword [esp + 0x20]
mov eax, dword [0x5f2620]
add esp, 0xc
push edx
add eax, 0x1594
push eax
call fcn.004c36d0
lea ecx, [esp + 0x14]
call fcn.004a4690
mov edi, dword [esp + 0xc0]
lea ecx, [esp + 0x28]
call fcn.004a4690
lea ecx, [esp + 0x18]
call fcn.004a4690
lea ecx, [esp + 0x1c]
call fcn.00402160
mov ecx, dword [esp + 0x1c]
cmp dword [ecx - 0xc], 0
je 0x4bd171
push 0x44
lea edx, [esp + 0x60]
push 0
push edx
call fcn.00557890
add esp, 0xc
lea ecx, [esp + 0x14]
mov dword [esp + 0x5c], 0x44
mov dword [esp + 0x88], 1
mov word [esp + 0x8c], 0
call fcn.004026e0
mov bl, 0xa
mov eax, edi
mov ecx, ebp
mov byte [esp + 0xb4], bl
call fcn.00439be0
mov eax, dword [eax]
mov ecx, dword [eax + 8]
push ecx
lea edx, [esp + 0x18]
push str.noop__s
push edx
call fcn.00405480
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x60]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x34]
call fcn.0045ea30
push eax
lea ecx, [esp + 0x40]
call fcn.0045ea30
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4bd117
mov edx, dword [esp + 0x2c]
push 0x1388
push edx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, edi
mov ecx, ebp
call fcn.00439be0
mov eax, dword [eax]
mov ecx, dword [esp + 0x34]
mov dword [eax + 0x28], ecx
jmp 0x4bd152
push 0x5b7800
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.00401ba0
add esp, 0xc
push 0
mov byte [esp + 0xb8], 0xb
mov eax, dword [eax]
push 0
push eax
call fcn.00539414
lea ecx, [esp + 0x20]
mov byte [esp + 0xb4], bl
call fcn.004a4690
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call fcn.0046d440
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
call fcn.0046d440
lea ecx, [esp + 0x14]
call fcn.004a4690
lea ecx, [esp + 0x1c]
mov dword [esp + 0xb4], 0xffffffff
call fcn.004a4690
jmp 0x4bd195
push 0
push 0
push 0x5b7810
call fcn.00539414
cmp edi, dword [ebp + 8]
jge 0x4bce43
mov eax, dword [ebp + 4]
lea ebx, [edi*4]
mov ecx, dword [eax + ebx]
add eax, ebx
cmp dword [ecx + 0x28], 0
mov dword [esp + 0x18], ebx
je 0x4bd28a
lea esi, [esp + 0x2c]
call fcn.004bd4b0
mov dword [esp + 0xb4], 0xc
cmp edi, dword [ebp + 8]
jge 0x4bce43
mov eax, dword [ebp + 4]
mov edx, dword [eax + ebx]
add eax, ebx
mov eax, dword [edx + 0x28]
mov dword [esp + 0x2c], eax
xor eax, eax
cmp edi, dword [ebp + 8]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
jge 0x4bce43
mov eax, dword [ebp + 4]
add eax, ebx
mov eax, dword [eax]
add eax, 0x14
push eax
lea ecx, [esp + 0x40]
call fcn.00402310
cmp edi, dword [ebp + 8]
jge 0x4bce43
mov eax, dword [ebp + 4]
add eax, ebx
mov eax, dword [eax]
add eax, 0x18
push eax
lea ecx, [esp + 0x44]
call fcn.00402310
mov ecx, esi
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
push ecx
push 0x4bc890
mov dword [esp + 0x40], 1
call esi
xor eax, eax
cmp dword [esp + 0x30], eax
jne 0x4bd25f
lea edx, [esp + 0x2c]
push edx
push 0x4bc890
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], eax
call esi
cmp edi, dword [ebp + 8]
jge 0x4bce43
mov eax, dword [ebp + 4]
mov ecx, dword [esp + 0x30]
add eax, ebx
mov eax, dword [eax]
lea esi, [esp + 0x2c]
mov dword [eax + 0x24], ecx
mov dword [esp + 0xb4], 0xffffffff
call fcn.004bd500
cmp edi, dword [ebp + 8]
jge 0x4bce43
mov edx, dword [ebp + 4]
mov eax, dword [edx + ebx]
cmp dword [eax + 0x24], 0
je 0x4bd489
cmp edi, dword [ebp + 8]
jge 0x4bce43
mov ecx, edx
mov edx, dword [esp + 0x18]
mov eax, dword [ecx + edx]
cmp dword [eax + 0x20], 0
je 0x4bd489
push 4
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x34], 4
call fcn.005308fb
mov ecx, dword [esp + 0x34]
add esp, 4
push ecx
push 0x5f2630
push eax
mov dword [esp + 0x40], eax
call fcn.0055cb00
add esp, 0xc
mov eax, edi
mov ecx, ebp
call fcn.00439be0
mov eax, dword [eax]
lea edx, [esp + 0x20]
push edx
mov edx, dword [0x5f2630]
push 0x3e8
push 1
lea ecx, [esp + 0x38]
push ecx
mov ecx, dword [eax + 0x24]
push edx
push 0x4a
push ecx
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov eax, edi
mov ecx, ebp
call fcn.00439be0
mov esi, eax
mov eax, edi
mov ecx, ebp
call fcn.00439be0
mov edx, dword [esi]
mov esi, dword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, eax
mov eax, dword [edx + 0x24]
push 0xfffffffffffffff0
push eax
call esi
mov ecx, dword [ebx]
mov dword [ecx + 0x2c], eax
mov eax, edi
mov ecx, ebp
call fcn.00439be0
mov ebx, eax
mov eax, edi
mov ecx, ebp
call fcn.00439be0
mov edx, dword [ebx]
mov dword [esp + 0x24], eax
mov eax, dword [edx + 0x24]
push 0xffffffffffffffec
push eax
call esi
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
mov dword [edx + 0x30], eax
mov eax, edi
mov ecx, ebp
call fcn.00439be0
mov eax, dword [eax]
mov ecx, dword [eax + 0x24]
push ecx
call fcn.00533854
mov esi, eax
test esi, esi
je 0x4bd42b
push 0
push SysReAllocStringLen
push 0xcf0000
mov ecx, esi
call fcn.00537c98
push 0
push 0
push 0x20000
mov ecx, esi
call fcn.00537c98
push 0
push 0
push 0x1000000
mov ecx, esi
call fcn.00537c98
push 0
push 0
push 0x10000
mov ecx, esi
call fcn.00537c98
push 0
push 0
push 0x80
mov ecx, esi
call fcn.00537c98
push 0
push 0
push 4
mov ecx, esi
call fcn.00537c98
push 0
push 0x80
push 0x40000
mov ecx, esi
call fcn.00537cc2
push 0
push 0
push 1
mov ecx, esi
call fcn.00537cc2
push 0
push 0
push 0x100
mov ecx, esi
call fcn.00537cc2
lea edx, [esp + 0x14]
push edx
push 0x591d88
push 1
push 0
push 0x591d78
mov dword [esp + 0x28], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4bd489
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push eax
call edx
mov eax, dword [esp + 0x14]
mov esi, dword [eax]
mov eax, edi
mov ecx, ebp
add esi, 0x14
call fcn.00439be0
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push edx
push eax
call ecx
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov esi, dword [esp + 0x18]
cmp edi, dword [ebp + 8]
mov dword [0x5f3220], 0
jge 0x4bce43
mov ecx, dword [ebp + 4]
mov edx, dword [ecx + esi]
mov eax, dword [edx + 0x24]
jmp 0x4bcc53