Function at 0x481200
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x678
mov eax, dword [0x53273c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x618], eax
cmp byte [ebx], 0x3c
jne 0x4814b7
mov al, byte [ebx + 1]
inc ebx
mov dword [ebp - 0x610], ebx
cmp al, 0x20
ja 0x48124d
test al, al
je 0x4814b7
mov al, byte [ebx + 1]
inc ebx
mov dword [ebp - 0x610], ebx
cmp al, 0x20
jbe 0x481237
push edi
push 0
push 0x10
call fcn.00454710
add esp, 4
push eax
call fcn.00448750
mov ecx, dword [0x540c38]
add esp, 8
mov edx, ebx
mov dword [eax], ecx
lea ecx, [ebp - 0x204]
mov dword [eax + 4], 0x523ddc
mov dword [eax + 8], ebx
mov dword [eax + 0xc], 0
mov al, byte [ebx]
mov byte [ebp - 0x204], al
cmp al, 0x20
jbe 0x4812a2
inc ecx
lea eax, [ebp - 5]
cmp ecx, eax
jae 0x4812f6
mov al, byte [edx + 1]
inc edx
mov byte [ecx], al
cmp al, 0x20
ja 0x481290
push 0x400
lea eax, [ebp - 0x604]
mov byte [ecx], 0
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.004a6350
add esp, 0xc
test eax, eax
jne 0x481321
lea eax, [ebp - 0x204]
push eax
push str._nCould_not_find___s__n
push 1
call fcn.004d27a8
add esp, 4
push eax
call fcn.00408350
add esp, 0xc
or eax, 0xffffffff
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret
push str._nOversize_cmd_name_in_progopen___n
push 1
call fcn.004d27a8
add esp, 4
push eax
call fcn.00408350
add esp, 8
or eax, 0xffffffff
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x60c]
push eax
call fcn.004a68a0
add esp, 4
test eax, eax
jne 0x4812e3
push dword [ebp - 0x608]
call fcn.004a6860
add esp, 4
mov dword [ebp - 0x608], eax
lea eax, [ebp - 0x624]
mov dword [ebp - 0x624], 0xc
mov dword [ebp - 0x620], 0
mov dword [ebp - 0x61c], 1
push 0
push 0x80
push 3
push eax
push 3
push closesocket
push 0x5057e4
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x614], edi
test edi, edi
jne 0x48139e
push str._nCreateFile__nul___failed__n
jmp 0x4812fb
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff6
call esi
push edi
push 0xfffffffffffffff6
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0xfffffffffffffff5
call esi
push dword [ebp - 0x608]
mov edi, eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0x44
lea eax, [ebp - 0x678]
push 0
push eax
call fcn.004d0130
add esp, 0xc
mov dword [ebp - 0x678], 0x44
mov eax, 5
mov word [ebp - 0x648], ax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x678]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push dword [ebp - 0x610]
lea eax, [ebp - 0x604]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov esi, eax
push 0xfffffffffffffff6
call ebx
push edi
push 0xfffffffffffffff5
call ebx
push dword [ebp - 0x614]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x608]
call edi
test esi, esi
pop esi
jne 0x48148c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x204]
push eax
push str.CreateProcess___s___failure__nError_code__ld_n
push 1
call fcn.004d27a8
add esp, 4
push eax
call fcn.00408350
add esp, 0x10
push dword [ebp - 0x60c]
call edi
pop edi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x630]
call edi
mov ecx, dword [ebp - 0x618]
mov eax, dword [ebp - 0x60c]
pop edi
pop ebx
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
xor ecx, ebp
pop ebx
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret