Function at 0x45eb70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x58eb50
push 0x5282d0
mov eax, dword fs:[0]
push eax
add esp, 0xfffffb34
mov eax, dword [0x59a530]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x46c]
call fcn.00431490
mov dword [ebp - 0x44c], 0
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
cmp dword [ebp + 0xc], 0
jne 0x45ebd3
jmp 0x45f13e
cmp dword [ebp + 0x10], 0
jne 0x45ebde
jmp 0x45f13e
xor edx, edx
mov byte [ebp - 0x45b], dl
lea ecx, [ebp - 0x45b]
call fcn.00464820
mov dword [ebp - 0x448], eax
xor eax, eax
mov byte [ebp - 0x44d], al
lea ecx, [ebp - 0x44d]
call fcn.004664f0
mov dword [ebp - 0x444], eax
xor ecx, ecx
mov byte [ebp - 0x44e], cl
lea ecx, [ebp - 0x44e]
call fcn.00464ed0
mov dword [ebp - 0x440], eax
xor edx, edx
mov byte [ebp - 0x44f], dl
lea ecx, [ebp - 0x44f]
call fcn.00464750
mov dword [ebp - 0x43c], eax
xor eax, eax
mov byte [ebp - 0x450], al
lea ecx, [ebp - 0x450]
call fcn.00465a60
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x480], 0
lea ecx, [ebp - 0x480]
push ecx
lea edx, [ebp - 0x47c]
push edx
call fcn.00466880
call fcn.00530a12
mov dword [ebp - 0x49c], eax
mov dword [ebp - 0x468], 5
mov dword [ebp - 0x4a0], 0x1f4
mov eax, dword [ebp - 0x468]
sub eax, 1
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x47c], 0
je 0x45ecc2
cmp dword [ebp - 0x480], 0
je 0x45ecc7
jmp 0x45eea6
mov dword [ebp - 0x470], 0
jmp 0x45ece2
mov ecx, dword [ebp - 0x470]
add ecx, 1
mov dword [ebp - 0x470], ecx
cmp dword [ebp - 0x470], 5
jae 0x45ee12
cmp dword [ebp - 0x44c], 0
jne 0x45ee12
mov dword [ebp - 0x464], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x470]
mov eax, dword [ebp + edx*4 - 0x448]
mov dword [ebp - 0x484], eax
mov ecx, dword [ebp - 0x484]
push ecx
call fcn.00467410
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 4
je 0x45ed40
jmp 0x45ede8
push 0x210
push 0
lea edx, [ebp - 0x22c]
push edx
call fcn.00526d90
add esp, 0xc
push 0x107
lea eax, [ebp - 0x22c]
push eax
mov ecx, dword [ebp - 0x484]
push ecx
call fcn.00467270
lea edx, [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0
jne 0x45ed8c
jmp 0x45ede8
xor eax, eax
mov byte [ebp - 0x451], al
lea ecx, [ebp - 0x451]
call fcn.00464f50
push eax
mov ecx, dword [ebp - 0x464]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 0
jne 0x45edbe
jmp 0x45ede8
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [ebp - 0x488]
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 0
jne 0x45ede8
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
mov dword [ebp - 4], 0xfffffffe
call fcn.0045edf6
jmp 0x45ee0d
jmp 0x45ecd3
cmp dword [ebp - 0x44c], 0
je 0x45ee43
xor ecx, ecx
mov byte [ebp - 0x452], cl
push 0x556914
lea ecx, [ebp - 0x452]
call fcn.00465da0
push eax
lea ecx, [ebp - 0x46c]
call fcn.00464b20
jmp 0x45eea6
xor edx, edx
mov byte [ebp - 0x453], dl
push 0x556914
lea ecx, [ebp - 0x453]
call fcn.00466000
push eax
lea ecx, [ebp - 0x46c]
call fcn.00464b20
cmp dword [ebp + 0x1c], 0
jne 0x45ee6f
jmp 0x45eea6
call fcn.00530a12
sub eax, dword [ebp - 0x49c]
cmp eax, 0x1388
jle 0x45ee83
jmp 0x45eea6
cmp dword [ebp - 0x468], 0
jle 0x45ee99
mov eax, dword [ebp - 0x4a0]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x468], 0
jg 0x45eca1
cmp dword [ebp + 0x1c], 0
je 0x45eec2
cmp dword [ebp - 0x44c], 0
jne 0x45eec2
cmp dword [ebp + 0x20], 0
jne 0x45eec2
xor eax, eax
jmp 0x45f144
cmp dword [ebp - 0x44c], 0
jne 0x45f136
mov dword [ebp - 0x460], 0
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x494], 0
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x478], 0
mov dword [ebp - 4], 1
cmp dword [ebp + 0x24], 0
je 0x45ef2e
xor ecx, ecx
mov byte [ebp - 0x454], cl
lea ecx, [ebp - 0x454]
call fcn.004664a0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0
je 0x45ef85
xor edx, edx
mov byte [ebp - 0x455], dl
lea ecx, [ebp - 0x455]
call fcn.00466330
push eax
mov eax, dword [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x474], eax
xor ecx, ecx
mov byte [ebp - 0x456], cl
lea ecx, [ebp - 0x456]
call fcn.00466400
push eax
mov edx, dword [ebp - 0x460]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x474], 0
je 0x45efa1
lea eax, [ebp - 0x494]
push eax
call dword [ebp - 0x474]
mov dword [ebp - 0x490], eax
push 0x3c
push 0
lea ecx, [ebp - 0x4dc]
push ecx
call fcn.00526d90
add esp, 0xc
mov dword [ebp - 0x4dc], 0x3c
mov dword [ebp - 0x4d8], 0xd640
call fcn.00467120
test eax, eax
je 0x45efec
xor edx, edx
mov byte [ebp - 0x457], dl
lea ecx, [ebp - 0x457]
call fcn.00465600
mov dword [ebp - 0x48c], eax
jmp 0x45eff6
mov dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x4d0], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x4cc], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x4c8], edx
mov dword [ebp - 0x4c4], 0
mov dword [ebp - 0x4c0], 1
lea eax, [ebp - 0x4dc]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 0
jne 0x45f0af
push 0x208
push 0
lea ecx, [ebp - 0x434]
push ecx
call fcn.00526d90
add esp, 0xc
xor edx, edx
mov byte [ebp - 0x458], dl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x458]
call fcn.00465870
push eax
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
xor ecx, ecx
mov byte [ebp - 0x459], cl
lea edx, [ebp - 0x434]
push edx
lea ecx, [ebp - 0x459]
call fcn.004658c0
push eax
lea ecx, [ebp - 0x46c]
call fcn.00464b20
jmp 0x45f0f2
xor eax, eax
mov byte [ebp - 0x45a], al
push 0x556914
lea ecx, [ebp - 0x45a]
call fcn.00465700
push eax
lea ecx, [ebp - 0x46c]
call fcn.00464b20
mov ecx, dword [ebp - 0x4a4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
mov eax, dword [ebp - 0x4a4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
call fcn.0045f100
jmp 0x45f136
xor eax, eax
jne 0x45ebbf
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004e6500
mov esp, ebp
pop ebp
ret 0x20