Function at 0x4cb515
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x36c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x264], eax
push 0x104
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push ebx
mov dword [ebp - 0x250], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
push eax
lea esi, [ebp - 0x22c]
call fcn.0040bead
push 1
push 0x62d6d4
mov edi, esi
call fcn.00415677
cmp eax, 0xffffffff
jne 0x4cb59f
push 1
xor edi, edi
lea esi, [ebp - 0x22c]
call fcn.0040bab7
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret 8
lea ecx, [eax + 1]
lea eax, [ebp - 0x22c]
call fcn.00410ad4
lea eax, [ebp - 0x308]
push eax
lea edi, [ebp - 0x320]
mov dword [ebp - 0x320], 0x6546c8
mov dword [ebp - 0x310], 0x651344
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], 0x65463c
call fcn.004cc3c7
mov eax, dword [ebp - 0x320]
mov eax, dword [eax + 4]
lea esi, [ebp - 0x308]
mov dword [ebp + eax - 0x320], 0x6546c4
call fcn.004cc461
mov eax, dword [ebp - 0x24c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x310]
mov eax, dword [eax + 4]
push dword [ebp - 0x264]
lea eax, [ebp + eax - 0x310]
mov edx, dword [eax + 0x14]
push ecx
and edx, 0xfffff9ff
push ecx
or edx, 0x800
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x310]
mov eax, dword [eax + 4]
push ecx
lea eax, [ebp + eax - 0x310]
or dword [eax + 0x14], 8
push 0x654618
push ecx
lea eax, [ebp - 0x22c]
push eax
push ecx
push 0x652400
lea esi, [ebp - 0x310]
call fcn.004cd6fc
pop ecx
pop ecx
mov esi, eax
call fcn.004cd84e
pop ecx
pop ecx
mov esi, eax
call fcn.004cd6fc
pop ecx
pop ecx
mov esi, eax
call fcn.004cb949
mov esi, eax
call fcn.004cd971
pop ecx
mov esi, eax
call fcn.004cb949
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x308]
push eax
call fcn.004cc4db
cmp dword [ebp - 0x234], 8
mov eax, dword [ebp - 0x248]
jae 0x4cb6b6
lea eax, [ebp - 0x248]
push eax
call fcn.0043d9d1
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x248]
mov dword [ebp - 0x24c], eax
call fcn.0040bab7
push 0x40
lea eax, [ebp - 0x364]
push ebx
push eax
call fcn.00402394
xor eax, eax
lea edi, [ebp - 0x278]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
lea eax, [ebp - 0x260]
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x368]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x24c]
mov dword [ebp - 0x368], 0x44
push ebx
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x25c], ebx
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x254], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x268]
neg ebx
sbb bl, bl
call fcn.0043da26
inc bl
je 0x4cb7a2
lea edi, [ebp - 0x260]
call fcn.00432d31
cmp dword [ebp - 0x24c], 0
je 0x4cb77b
push dword [ebp - 0x24c]
call fcn.00404e46
pop ecx
lea ecx, [ebp - 0x2c0]
call fcn.004cbc88
lea eax, [ebp - 0x2c0]
push eax
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::ios_base.0
call fcn.005e2169
pop ecx
jmp 0x4cb57d
push 0xffffffffffffffff
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
lea eax, [ebp - 0x250]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
setne al
cmp esi, 0x102
jne 0x4cb82c
lea edi, [ebp - 0x260]
call fcn.00432d31
cmp dword [ebp - 0x24c], 0
je 0x4cb7f2
push dword [ebp - 0x24c]
call fcn.00404e46
pop ecx
xor bl, bl
lea ecx, [ebp - 0x2c0]
call fcn.004cbc88
lea eax, [ebp - 0x2c0]
push eax
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::ios_base.0
call fcn.005e2169
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x22c]
call fcn.0040bab7
mov al, bl
jmp 0x4cb58e
test al, al
je 0x4cb83d
cmp dword [ebp - 0x250], 0
jne 0x4cb83d
mov bl, 1
jmp 0x4cb83f
xor bl, bl
lea edi, [ebp - 0x260]
call fcn.00432d31
cmp dword [ebp - 0x24c], 0
je 0x4cb7f4
push dword [ebp - 0x24c]
call fcn.00404e46
pop ecx
jmp 0x4cb7f4