Function at 0x4bd99c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x15
push 0
push 0
dec ecx
jne 0x4bd9a5
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x18]
mov eax, dword [ebp - 4]
call fcn.00404cb0
mov eax, dword [ebp - 8]
call fcn.00404cb0
mov eax, dword [ebp - 0xc]
call fcn.00404cb0
xor eax, eax
push ebp
push 0x4be0ec
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
jne 0x4bd9fa
lea eax, [ebp - 0x10]
mov edx, 0x4be108
call fcn.00404898
jmp 0x4bda07
lea eax, [ebp - 0x10]
mov edx, 0x4be118
call fcn.00404898
mov eax, dword [ebp - 4]
call fcn.0049b964
test al, al
je 0x4bda29
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0049bbec
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.00404898
mov eax, dword [ebp - 4]
call fcn.0049b964
test al, al
je 0x4bda6d
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.0049b040
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00408c4c
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00409b7c
mov eax, dword [ebp - 0x20]
mov edx, 0x4be128
call fcn.00404c0c
jne 0x4bda6d
lea eax, [ebp - 0x10]
call fcn.00404800
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.0049b040
mov edx, dword [ebp - 0x2c]
mov eax, 0x4be138
call fcn.00438da4
test al, al
je 0x4bdabd
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.0049b040
mov edx, dword [ebp - 0x30]
mov eax, 0x4be148
call fcn.00438d58
test al, al
jne 0x4bdabd
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404898
lea eax, [ebp - 4]
mov edx, 0x4be158
call fcn.00404898
cmp dword [ebp - 0xc], 0
jne 0x4bdae3
mov eax, dword [ebp - 4]
call fcn.0049b964
test al, al
je 0x4bdae3
cmp byte [0x4daed0], 0
jne 0x4bdae3
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409a5c
cmp dword [0x4daef4], 0
je 0x4bdbc1
mov eax, dword [ebp - 4]
call fcn.0049b964
test al, al
je 0x4bdbc1
mov eax, dword [ebp - 4]
call fcn.0049a71c
test al, al
je 0x4bdbc1
mov edx, dword [0x4daef4]
mov eax, 0x4be16c
call fcn.00438ec0
test al, al
je 0x4bdb6e
lea edx, [ebp - 0x38]
mov eax, dword [0x4daef4]
call fcn.00408d80
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
mov dl, 1
call fcn.004b7960
push dword [ebp - 0x34]
push 0x4be178
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 4]
call fcn.00408d80
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.0049afa8
push dword [ebp - 0x3c]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404b80
jmp 0x4bdbc1
lea edx, [ebp - 0x4c]
mov eax, dword [0x4daef4]
call fcn.00408d80
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x48]
mov dl, 1
call fcn.004b7960
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
call fcn.0049afa8
push dword [ebp - 0x44]
push 0x4be178
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 4]
call fcn.00408d80
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.0049afa8
push dword [ebp - 0x50]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404b80
mov eax, dword [ebp - 4]
call fcn.0049b964
test al, al
je 0x4bdc5c
mov edx, dword [ebp - 4]
mov eax, 0x4be16c
call fcn.00438ec0
test al, al
je 0x4bdc5c
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00404d60
lea eax, [ebp - 0x58]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4be16c
call fcn.00404e04
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404ac0
mov ecx, eax
mov eax, dword [ebp - 4]
pop edx
call fcn.00404d20
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 8]
call fcn.00408d80
lea eax, [ebp - 0x60]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4be16c
call fcn.00404e04
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404d20
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.00408d80
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 4]
call fcn.00404898
cmp dword [ebp - 8], 0
je 0x4bdc9d
mov edx, dword [ebp - 4]
mov eax, 0x4be184
call fcn.00438d58
test al, al
je 0x4bdc9d
push 0x4be16c
push dword [ebp - 4]
push 0x4be178
push dword [ebp - 8]
push 0x4be16c
lea eax, [ebp - 4]
mov edx, 5
call fcn.00404b80
lea eax, [ebp - 8]
call fcn.00404800
cmp byte [ebp + 8], 0
je 0x4bdcc7
mov eax, dword [ebp - 4]
call fcn.0049b964
test al, al
je 0x4bdcc7
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004a20a8
test al, al
je 0x4bdcc7
mov ebx, 0x21
jmp 0x4be0c1
mov edx, dword [ebp - 4]
mov eax, 0x4be194
call fcn.00404e04
test eax, eax
jg 0x4bdcfe
mov edx, dword [ebp - 4]
mov eax, 0x4be1ac
call fcn.00404e04
test eax, eax
jg 0x4bdcfe
mov edx, dword [ebp - 4]
mov eax, 0x4be1c4
call fcn.00404e04
test eax, eax
jle 0x4bde68
mov edx, dword [ebp - 4]
mov eax, 0x4be1ac
call fcn.00404e04
test eax, eax
setg byte [ebp - 0x15]
mov edx, dword [ebp - 4]
mov eax, 0x4be194
call fcn.00404e04
test eax, eax
setg byte [ebp - 0x16]
lea eax, [ebp - 0x64]
push eax
xor ecx, ecx
mov edx, 0x4be1c4
mov eax, dword [ebp - 4]
call fcn.00438dec
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 4]
call fcn.00404898
lea eax, [ebp - 0x68]
push eax
xor ecx, ecx
mov edx, 0x4be194
mov eax, dword [ebp - 4]
call fcn.00438dec
mov edx, dword [ebp - 0x68]
lea eax, [ebp - 4]
call fcn.00404898
lea eax, [ebp - 0x6c]
push eax
xor ecx, ecx
mov edx, 0x4be1ac
mov eax, dword [ebp - 4]
call fcn.00438dec
mov edx, dword [ebp - 0x6c]
lea eax, [ebp - 4]
call fcn.00404898
push esi
mov al, byte [ebp + 0x10]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404cc0
mov edx, eax
lea eax, [ebp - 0x70]
call fcn.004049f8
mov eax, dword [ebp - 0x70]
push eax
mov eax, dword [ebp - 8]
call fcn.00404cc0
mov edx, eax
lea eax, [ebp - 0x74]
call fcn.004049f8
mov eax, dword [ebp - 0x74]
push eax
mov eax, dword [ebp - 4]
call fcn.00404cc0
mov edx, eax
lea eax, [ebp - 0x78]
call fcn.004049f8
mov eax, dword [ebp - 0x78]
pop edx
pop ecx
call fcn.0049be0c
cmp byte [ebp - 0x15], 0
je 0x4bdde9
push 0
mov cl, 1
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4dadd8]
call fcn.004b95b8
jmp 0x4bde45
mov eax, dword [0x4d98e8]
cmp dword [eax], 0
je 0x4bde45
mov eax, dword [0x4d98e8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30c]
mov edx, dword [ebp - 0x14]
call fcn.00461850
mov eax, dword [0x4d98e8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30c]
mov dl, 1
call fcn.00461740
mov eax, dword [0x4d98e8]
mov eax, dword [eax]
mov dl, 1
call fcn.0047ac44
cmp byte [ebp - 0x16], 0
je 0x4bde45
mov eax, dword [0x4d98e8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30c]
mov edx, dword [eax]
call dword [edx + 0xc4]
mov eax, dword [ebp - 0x14]
mov edx, 0x4be1e0
call fcn.00404c0c
jne 0x4bde5e
mov ebx, 0x20
jmp 0x4be0c1
mov ebx, 0x21
jmp 0x4be0c1
cmp byte [ebp + 0x14], 0
je 0x4bdef4
mov eax, dword [ebp - 4]
call fcn.0049b898
test al, al
je 0x4bded9
cmp byte [0x4daec8], 0
jne 0x4bded9
lea eax, [ebp - 0x7c]
call fcn.004b7bcc
cmp dword [ebp - 0x7c], 0
je 0x4bded9
push esi
mov al, byte [ebp + 0x10]
push eax
push ebx
lea eax, [ebp - 0x84]
call fcn.004b7bcc
mov eax, dword [ebp - 0x84]
lea edx, [ebp - 0x80]
call fcn.00409a5c
mov eax, dword [ebp - 0x80]
push eax
lea eax, [ebp - 0x88]
call fcn.004b7bcc
mov eax, dword [ebp - 0x88]
mov edx, dword [ebp - 4]
pop ecx
call fcn.004bd8dc
mov ebx, eax
jmp 0x4be0c1
push esi
mov al, byte [ebp + 0x10]
push eax
push ebx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004bd8dc
mov ebx, eax
jmp 0x4be0c1
mov eax, dword [ebp - 4]
call fcn.0049b898
test al, al
je 0x4bdf7e
cmp byte [0x4daec8], 0
jne 0x4bdf7e
lea eax, [ebp - 0x8c]
call fcn.004b7bcc
cmp dword [ebp - 0x8c], 0
je 0x4bdf7e
push esi
lea eax, [ebp - 0x94]
call fcn.004b7bcc
mov eax, dword [ebp - 0x94]
lea edx, [ebp - 0x90]
call fcn.00409a5c
mov eax, dword [ebp - 0x90]
call fcn.00404cc0
push eax
mov eax, dword [ebp - 4]
call fcn.00404cc0
push eax
lea eax, [ebp - 0x98]
call fcn.004b7bcc
mov eax, dword [ebp - 0x98]
call fcn.00404cc0
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404cc0
push eax
call fcn.004b45dc
push eax
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
jmp 0x4bdfb0
push esi
mov eax, dword [ebp - 0xc]
call fcn.00404cc0
push eax
mov eax, dword [ebp - 8]
call fcn.00404cc0
push eax
mov eax, dword [ebp - 4]
call fcn.00404cc0
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404cc0
push eax
call fcn.004b45dc
push eax
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
cmp ebx, 0x21
jge 0x4be0c1
cmp byte [ebp + 0x10], 0
je 0x4be0c1
mov eax, dword [ebp - 4]
call fcn.0049b378
test al, al
je 0x4be0c1
cmp byte [0x4dae17], 0
je 0x4bdfe1
mov esi, 3
cmp byte [0x4daec8], 0
jne 0x4be079
lea eax, [ebp - 0x9c]
call fcn.004b7bcc
cmp dword [ebp - 0x9c], 0
je 0x4be079
push esi
lea eax, [ebp - 0xa4]
call fcn.004b7bcc
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0xa0]
call fcn.00409a5c
mov eax, dword [ebp - 0xa0]
call fcn.00404cc0
push eax
lea eax, [ebp - 0xa8]
mov ecx, dword [ebp - 4]
mov edx, 0x4be1f0
call fcn.00404b0c
mov eax, dword [ebp - 0xa8]
call fcn.00404cc0
push eax
lea eax, [ebp - 0xac]
call fcn.004b7bcc
mov eax, dword [ebp - 0xac]
call fcn.00404cc0
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404cc0
push eax
call fcn.004b45dc
push eax
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
jmp 0x4be0c1
push esi
mov eax, dword [ebp - 0xc]
call fcn.00404cc0
push eax
mov eax, dword [ebp - 8]
call fcn.00404cc0
push eax
lea eax, [ebp - 0xb0]
mov ecx, dword [ebp - 4]
mov edx, 0x4be1f0
call fcn.00404b0c
mov eax, dword [ebp - 0xb0]
call fcn.00404cc0
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404cc0
push eax
call fcn.004b45dc
push eax
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be0f3
lea eax, [ebp - 0xb0]
mov edx, 0x26
call fcn.00404824
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404824
ret