Function at 0x4b50f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
push esi
push edi
push 4
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], vtable.t_str.0
call fcn.0046c3ce
add esp, 4
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x2c], 0
mov dword [eax], 0
call fcn.004a60e0
lea ecx, [esp + 0x20]
call fcn.004a60e0
mov esi, dword [0x51dc64]
test esi, esi
jne 0x4b521e
cmp byte [0x51b9a4], 0
je 0x4b5165
push 0x51b98c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x51dc64]
test esi, esi
jne 0x4b5204
mov ecx, str.t_runtime
call fcn.004113f0
mov esi, eax
test esi, esi
jne 0x4b51fe
push 0x98c
call fcn.0044c480
mov esi, eax
add esp, 4
mov dword [esi], vtable.ImmCleanup.0
mov ecx, dword [0x505f64]
mov eax, dword [0x505f68]
cmp ecx, eax
jne 0x4b51ce
test eax, eax
jne 0x4b51b0
mov ecx, dword [0x505f6c]
test ecx, ecx
jne 0x4b51b4
lea ecx, [eax + 1]
jmp 0x4b51be
add ecx, ecx
test ecx, ecx
js 0x4b51f0
cmp ecx, 0xfffffff
ja 0x4b51f0
push ecx
call fcn.00412ca0
test eax, eax
je 0x4b51f0
mov ecx, dword [0x505f64]
mov eax, dword [0x505f60]
lea eax, [eax + ecx*8]
test eax, eax
je 0x4b51e9
mov dword [eax], esi
mov dword [eax + 4], str.t_runtime
mov ecx, dword [0x505f64]
inc ecx
mov dword [0x505f64], ecx
lea ecx, [esi + 4]
mov dword [esi], vtable.ImmSingleton_class_t_runtime_.0
call fcn.004b0b60
mov dword [0x51dc64], esi
cmp byte [0x51b9a4], 0
je 0x4b521e
push 0x51b98c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [0x51dc64]
cmp byte [esi + 0x8ff], 0
je 0x4b5234
cmp byte [0x51bbf1], 0
jne 0x4b5234
mov al, 1
jmp 0x4b5236
xor al, al
test al, al
je 0x4b53d5
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x4b52a5
mov ecx, edi
mov eax, 0x4e76e0
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4b5276
test dx, dx
je 0x4b5272
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4b5276
add eax, 4
add ecx, 4
test dx, dx
jne 0x4b5250
xor eax, eax
jmp 0x4b527b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4b52a5
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x20]
push eax
call fcn.004b6f50
cmp dword [esp + 0x24], 0
mov esi, dword [0x51dc64]
jne 0x4b529e
xor edi, edi
jmp 0x4b52a5
mov edi, dword [esp + 0x28]
add edi, 4
test esi, esi
jne 0x4b5388
cmp byte [0x51b9a4], 0
je 0x4b52cf
push 0x51b98c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x51dc64]
test esi, esi
jne 0x4b536e
mov ecx, str.t_runtime
call fcn.004113f0
mov esi, eax
test esi, esi
jne 0x4b5368
push 0x98c
call fcn.0044c480
mov esi, eax
add esp, 4
mov dword [esi], vtable.ImmCleanup.0
mov ecx, dword [0x505f64]
mov eax, dword [0x505f68]
cmp ecx, eax
jne 0x4b5338
test eax, eax
jne 0x4b531a
mov ecx, dword [0x505f6c]
test ecx, ecx
jne 0x4b531e
lea ecx, [eax + 1]
jmp 0x4b5328
add ecx, ecx
test ecx, ecx
js 0x4b535a
cmp ecx, 0xfffffff
ja 0x4b535a
push ecx
call fcn.00412ca0
test eax, eax
je 0x4b535a
mov ecx, dword [0x505f64]
mov eax, dword [0x505f60]
lea eax, [eax + ecx*8]
test eax, eax
je 0x4b5353
mov dword [eax], esi
mov dword [eax + 4], str.t_runtime
mov ecx, dword [0x505f64]
inc ecx
mov dword [0x505f64], ecx
lea ecx, [esi + 4]
mov dword [esi], vtable.ImmSingleton_class_t_runtime_.0
call fcn.004b0b60
mov dword [0x51dc64], esi
cmp byte [0x51b9a4], 0
je 0x4b5388
push 0x51b98c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [0x51dc64]
cmp byte [esi + 0x908], 0
je 0x4b539a
cmp byte [esi + 0x90a], 0
jne 0x4b53b5
mov eax, dword [esi + 0x8e0]
add eax, 4
push str.AcroRd32.exe
push eax
call fcn.00477e16
add esp, 8
test eax, eax
jne 0x4b53f8
mov ecx, dword [0x51bbf4]
test ecx, ecx
je 0x4b53f8
push dword [ebp + 0x18]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
push dword [ebp + 0x10]
mov eax, dword [eax + 8]
add eax, 4
push eax
call dword [edx]
mov al, 1
mov ecx, dword [esp + 0x28]
mov byte [esp + 0xb], al
test ecx, ecx
je 0x4b53f0
push ecx
call fcn.00459651
mov al, byte [esp + 0xf]
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
push dword [ebp + 0x18]
mov esi, dword [esp + 0x10]
push edi
push dword [ebp + 0x10]
mov eax, dword [esi + 8]
add eax, 4
push eax
push 0x4e76e4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
cmp edi, 0x20
jg 0x4b53d5
mov esi, dword [esi + 8]
push 4
mov dword [esp + 0x34], vtable.t_str.0
call fcn.0046c3ce
add esp, 4
mov dword [esp + 0x38], eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x3c], 0
mov dword [eax], 0
call fcn.004a60e0
lea eax, [esi + 4]
push eax
lea ecx, [esp + 0x34]
call fcn.004a5ed0
push 4
mov dword [esp + 0x14], vtable.t_str.0
call fcn.0046c3ce
add esp, 4
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
mov dword [eax], 0
call fcn.004a60e0
mov ecx, 0x4e76f0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b5490
sub ecx, edx
mov edx, dword [esp + 0x18]
sar ecx, 1
mov dword [esp + 0x14], ecx
mov esi, dword [edx]
lea eax, [ecx + 1]
mov dword [esp + 0xc], eax
cmp eax, esi
jbe 0x4b54e3
lea esi, [esi*2 + 0x10]
and esi, 0xfff0
cmp eax, esi
cmovae esi, eax
lea eax, [esi*2 + 4]
push eax
push edx
call fcn.00478579
mov edx, eax
add esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], edx
mov dword [edx], esi
lea ecx, [eax + eax]
push ecx
lea eax, [edx + 4]
push 0x4e76f0
push eax
call fcn.0044e3e0
push edi
lea eax, [esp + 0x20]
push 0x4e3d04
push eax
call fcn.004a4cb0
push 0x4e7700
lea eax, [esp + 0x2c]
push 0x4e3d38
push eax
call fcn.004a4cb0
mov esi, dword [ebp + 8]
lea eax, [esp + 0x54]
add esp, 0x24
mov ecx, esi
push eax
mov eax, dword [esp + 0x1c]
add eax, 4
push eax
call fcn.004a7c10
mov ecx, eax
call fcn.004a71c0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4b554b
push eax
call fcn.00459651
add esp, 4
mov eax, dword [esp + 0x38]
test eax, eax
je 0x4b555c
push eax
call fcn.00459651
add esp, 4
cmp edi, 0x20
ja case.0x4b5568.1
movzx eax, byte [edi + 0x4b56a0]
jmp dword [eax*4 + 0x4b5668]
push 0x4e7740
mov ecx, esi
call fcn.004018a0
xor al, al
jmp 0x4b53d7
push 0x4e77a8
mov ecx, esi
call fcn.004018a0
xor al, al
jmp 0x4b53d7
push 0x4e77f0
mov ecx, esi
call fcn.004018a0
xor al, al
jmp 0x4b53d7
push 0x4e7848
mov ecx, esi
call fcn.004018a0
xor al, al
jmp 0x4b53d7
push 0x4e78e0
mov ecx, esi
call fcn.004018a0
xor al, al
jmp 0x4b53d7
push 0x4e7960
mov ecx, esi
call fcn.004018a0
xor al, al
jmp 0x4b53d7
push 0x4e79c8
mov ecx, esi
call fcn.004018a0
xor al, al
jmp 0x4b53d7
push 0x4e7ab8
mov ecx, esi
call fcn.004018a0
xor al, al
jmp 0x4b53d7
push 0x4e7af0
mov ecx, esi
call fcn.004018a0
xor al, al
jmp 0x4b53d7
push 0x4e7b88
mov ecx, esi
call fcn.004018a0
xor al, al
jmp 0x4b53d7
push 0x4e7bf8
mov ecx, esi
call fcn.004018a0
xor al, al
jmp 0x4b53d7
push 0x4e7c88
mov ecx, esi
call fcn.004018a0
xor al, al
jmp 0x4b53d7
push 0x4e7704
mov ecx, esi
call fcn.004018a0
xor al, al
jmp 0x4b53d7