Function at 0x486f20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x32
push 0
push 0
dec ecx
jne 0x486f28
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x170]
mov edx, dword [0x40741c]
call fcn.00404a1c
xor eax, eax
push ebp
push 0x48732a
push dword fs:[eax]
mov dword fs:[eax], esp
nop
nop
nop
xor eax, eax
push ebp
push 0x4872cc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
call fcn.004040a4
lea ecx, [ebp - 0x170]
mov edx, 0x10
mov eax, 0x487340
call fcn.00408b08
test eax, eax
jne 0x486faa
cmp dword [ebp - 0x18], 0
jne 0x486faa
push 0x487350
push dword [ebp - 0x164]
push 0x48735c
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404424
lea ecx, [ebp - 0x170]
mov edx, 0x10
mov eax, 0x487368
call fcn.00408b08
test eax, eax
jne 0x486fe6
cmp dword [ebp - 0x18], 0
jne 0x486fe6
push 0x48737c
push dword [ebp - 0x164]
push 0x48735c
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404424
lea ecx, [ebp - 0x170]
mov edx, 0x10
mov eax, 0x487388
call fcn.00408b08
test eax, eax
jne 0x487022
cmp dword [ebp - 0x18], 0
jne 0x487022
push 0x48739c
push dword [ebp - 0x164]
push 0x48735c
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404424
lea eax, [ebp - 0x170]
call fcn.00408b58
mov eax, 0x487350
call fcn.00408998
test al, al
je 0x48704e
cmp dword [ebp - 0x18], 0
jne 0x48704e
lea eax, [ebp - 0x18]
mov edx, 0x487350
call fcn.0040413c
mov eax, 0x48737c
call fcn.00408998
test al, al
je 0x48706f
cmp dword [ebp - 0x18], 0
jne 0x48706f
lea eax, [ebp - 0x18]
mov edx, 0x48737c
call fcn.0040413c
mov eax, 0x48739c
call fcn.00408998
test al, al
je 0x487090
cmp dword [ebp - 0x18], 0
jne 0x487090
lea eax, [ebp - 0x18]
mov edx, 0x48739c
call fcn.0040413c
lea edx, [ebp - 0x178]
mov eax, dword [0x48a1f0]
mov eax, dword [eax]
call fcn.0045763c
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x174]
call fcn.00408c28
mov ecx, dword [ebp - 0x174]
lea eax, [ebp - 0x14]
mov edx, 0x4873a8
call fcn.004043b0
lea eax, [ebp - 0x10]
mov ecx, 0x4873b8
mov edx, dword [ebp - 0x18]
call fcn.004043b0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.0040436c
mov dl, 1
mov eax, dword [0x416720]
call fcn.00403324
mov dword [ebp - 8], eax
lea edx, [ebp - 0x17c]
xor eax, eax
call fcn.00402ab8
mov edx, dword [ebp - 0x17c]
mov eax, dword [ebp - 8]
call fcn.0041a78c
mov dl, 1
mov eax, dword [0x416720]
call fcn.00403324
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00486eb4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x48714d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0041a6b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x487157
mov eax, dword [ebp - 0x18]
call fcn.00408988
test al, al
jne 0x48724a
lea edx, [ebp - 0x184]
mov eax, dword [0x48a1f0]
mov eax, dword [eax]
call fcn.0045763c
mov eax, dword [ebp - 0x184]
lea edx, [ebp - 0x180]
call fcn.00408bf4
mov edx, dword [ebp - 0x180]
lea eax, [ebp - 0x18]
mov ecx, 0x4873cc
call fcn.004043b0
lea edx, [ebp - 0x18c]
mov eax, dword [0x48a1f0]
mov eax, dword [eax]
call fcn.0045763c
mov eax, dword [ebp - 0x18c]
lea edx, [ebp - 0x188]
call fcn.00408bf4
lea eax, [ebp - 0x188]
mov edx, 0x4873e0
call fcn.0040436c
mov eax, dword [ebp - 0x188]
call fcn.00408998
test al, al
jne 0x48721d
lea edx, [ebp - 0x194]
mov eax, dword [0x48a1f0]
mov eax, dword [eax]
call fcn.0045763c
mov eax, dword [ebp - 0x194]
lea edx, [ebp - 0x190]
call fcn.00408bf4
lea eax, [ebp - 0x190]
mov edx, 0x4873e0
call fcn.0040436c
mov eax, dword [ebp - 0x190]
call fcn.004089bc
xor eax, eax
push ebp
push 0x487240
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0041a6b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48724a
mov eax, dword [ebp - 0x18]
call fcn.00408988
test al, al
je 0x4872b2
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x48726b
cmp eax, 0xaae60
jbe 0x4872b2
jmp 0x48726d
jle 0x4872b2
push 0x80
push 0xffffffffffffffec
mov eax, dword [0x48a1f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetWindowLongA
xor edx, edx
mov eax, dword [0x48bdfc]
call fcn.00454404
push 5
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.00404564
push eax
push 0x4873e8
mov eax, dword [ebp - 4]
call fcn.0043e13c
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 0xc]
call fcn.00403354
mov eax, dword [ebp - 8]
call fcn.00403354
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4872e6
mov eax, dword [ebp - 4]
call fcn.0045397c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487331
lea eax, [ebp - 0x194]
mov edx, 9
call fcn.004040c8
lea eax, [ebp - 0x170]
mov edx, dword [0x40741c]
call fcn.00404aec
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004040c8
ret