Function at 0x4ad004
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ad3d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov edx, 0x4ad3ec
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4ad458
mov eax, dword [ebx + 0x398]
call fcn.00410aa8
test al, al
je 0x4ad0ac
push 5
push 0
push 0x4ad47c
push 0x4ad4cc
push 0x4ad4e8
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
ja 0x4ad091
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 4]
call fcn.004151ac
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4ad3b6
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov edx, 0x4ad500
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4ad3b6
mov edx, 0x4ad5d8
mov eax, dword [ebx + 0x398]
call fcn.00410aa8
test al, al
je 0x4ad120
push 5
push 0
push 0x4ad5fc
push 0x4ad4cc
push 0x4ad4e8
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
ja 0x4ad105
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 8]
call fcn.004151ac
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4ad3b6
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov edx, 0x4ad500
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4ad3b6
mov edx, 0x4ad664
mov eax, dword [ebx + 0x398]
call fcn.00410aa8
test al, al
je 0x4ad194
push 5
push 0
push 0x4ad688
push 0x4ad4cc
push 0x4ad4e8
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
ja 0x4ad179
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0xc]
call fcn.004151ac
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4ad3b6
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov edx, 0x4ad500
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4ad3b6
mov edx, 0x4ad6f0
mov eax, dword [ebx + 0x398]
call fcn.00410aa8
test al, al
je 0x4ad208
push 5
push 0
push 0x4ad718
push 0x4ad4cc
push 0x4ad4e8
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
ja 0x4ad1ed
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x10]
call fcn.004151ac
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4ad3b6
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov edx, 0x4ad500
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4ad3b6
mov edx, 0x4ad780
mov eax, dword [ebx + 0x398]
call fcn.00410aa8
test al, al
je 0x4ad27c
push 5
push 0
push 0x4ad798
push 0x4ad4cc
push 0x4ad4e8
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
ja 0x4ad261
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x14]
call fcn.004151ac
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4ad3b6
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov edx, 0x4ad500
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4ad3b6
mov edx, 0x4ad800
mov eax, dword [ebx + 0x398]
call fcn.00410aa8
test al, al
je 0x4ad2f0
push 5
push 0
push 0x4ad81c
push 0x4ad4cc
push 0x4ad4e8
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
ja 0x4ad2d5
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x18]
call fcn.004151ac
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4ad3b6
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov edx, 0x4ad500
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4ad3b6
mov edx, 0x4ad884
mov eax, dword [ebx + 0x398]
call fcn.00410aa8
test al, al
je 0x4ad35e
push 5
push 0
push 0x4ad8a0
push 0x4ad4cc
push 0x4ad4e8
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
ja 0x4ad346
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x1c]
call fcn.004151ac
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4ad3b6
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov edx, 0x4ad500
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4ad3b6
push 5
push 0
push 0x4ad47c
push 0x4ad4cc
push 0x4ad4e8
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
ja 0x4ad3a0
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x20]
call fcn.004151ac
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4ad3b6
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov edx, 0x4ad500
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad3d8
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.004068a8
ret