Function at 0x4e7b44
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4e7b4d
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
call fcn.00404f5c
xor eax, eax
push ebp
push 0x4e80ea
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0040945c
cmp dword [ebp - 0x1c], 0
je 0x4e80c2
mov edx, dword [ebp - 4]
mov eax, 0x4e8100
call fcn.004050b0
test eax, eax
je 0x4e808c
mov edx, dword [ebp - 4]
mov eax, 0x4e8110
call fcn.004050b0
test eax, eax
je 0x4e808c
mov edx, dword [ebp - 4]
mov eax, 0x4e811c
call fcn.004050b0
test eax, eax
je 0x4e808c
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404d74
mov edx, dword [ebp - 8]
mov eax, 0x4e8128
call fcn.004050b0
mov ebx, eax
test ebx, ebx
je 0x4e7bf4
lea eax, [ebp - 8]
mov ecx, 7
mov edx, ebx
call fcn.0040500c
test ebx, ebx
jne 0x4e7bd2
mov edx, dword [ebp - 8]
mov eax, 0x4e8110
call fcn.004050b0
mov ebx, eax
test ebx, ebx
je 0x4e7c1a
lea eax, [ebp - 8]
mov ecx, 3
mov edx, ebx
call fcn.0040500c
test ebx, ebx
jne 0x4e7bf8
mov edx, dword [ebp - 8]
mov eax, 0x4e8138
call fcn.004050b0
mov ebx, eax
test ebx, ebx
je 0x4e7c40
lea eax, [ebp - 8]
mov ecx, 6
mov edx, ebx
call fcn.0040500c
test ebx, ebx
jne 0x4e7c1e
mov edx, dword [ebp - 8]
mov eax, 0x4e8148
call fcn.004050b0
mov ebx, eax
test ebx, ebx
je 0x4e7c66
lea eax, [ebp - 8]
mov ecx, 4
mov edx, ebx
call fcn.0040500c
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404b40
push 0x4e8158
push dword [ebp - 8]
push 0x4e8168
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404e2c
mov edx, dword [ebp - 8]
mov eax, 0x4e8178
call fcn.004050b0
mov ebx, eax
test ebx, ebx
je 0x4e7cbc
lea eax, [ebp - 8]
mov ecx, 1
mov edx, ebx
call fcn.0040500c
lea edx, [ebp - 8]
mov ecx, ebx
mov eax, 0x4e8184
call fcn.00405054
test ebx, ebx
jne 0x4e7c8b
lea eax, [ebp - 8]
mov edx, 0x4e8190
call fcn.00404d74
mov edx, dword [ebp - 8]
mov eax, 0x4e8190
call fcn.004050b0
mov ebx, eax
test ebx, ebx
je 0x4e7cfe
lea eax, [ebp - 8]
mov ecx, 1
mov edx, ebx
call fcn.0040500c
lea edx, [ebp - 8]
mov ecx, ebx
mov eax, 0x4e819c
call fcn.00405054
test ebx, ebx
jne 0x4e7ccd
mov edx, dword [ebp - 8]
mov eax, 0x4e81a8
call fcn.004050b0
mov ebx, eax
test ebx, ebx
je 0x4e7d33
lea eax, [ebp - 8]
mov ecx, 1
mov edx, ebx
call fcn.0040500c
lea edx, [ebp - 8]
mov ecx, ebx
mov eax, 0x4e81b4
call fcn.00405054
test ebx, ebx
jne 0x4e7d02
mov edx, dword [ebp - 8]
mov eax, 0x4e81c4
call fcn.004050b0
mov ebx, eax
test ebx, ebx
je 0x4e7d68
lea eax, [ebp - 8]
mov ecx, 1
mov edx, ebx
call fcn.0040500c
lea edx, [ebp - 8]
mov ecx, ebx
mov eax, 0x4e81d0
call fcn.00405054
test ebx, ebx
jne 0x4e7d37
mov edx, dword [ebp - 8]
mov eax, 0x4e81dc
call fcn.004050b0
mov ebx, eax
test ebx, ebx
je 0x4e7d9d
lea eax, [ebp - 8]
mov ecx, 1
mov edx, ebx
call fcn.0040500c
lea edx, [ebp - 8]
mov ecx, ebx
mov eax, 0x4e81e8
call fcn.00405054
test ebx, ebx
jne 0x4e7d6c
mov edx, dword [ebp - 8]
mov eax, 0x4e81f4
call fcn.004050b0
mov ebx, eax
test ebx, ebx
je 0x4e7dd2
lea eax, [ebp - 8]
mov ecx, 1
mov edx, ebx
call fcn.0040500c
lea edx, [ebp - 8]
mov ecx, ebx
mov eax, 0x4e8200
call fcn.00405054
test ebx, ebx
jne 0x4e7da1
mov edx, dword [ebp - 8]
mov eax, 0x4e820c
call fcn.004050b0
mov ebx, eax
test ebx, ebx
je 0x4e7e07
lea eax, [ebp - 8]
mov ecx, 1
mov edx, ebx
call fcn.0040500c
lea edx, [ebp - 8]
mov ecx, ebx
mov eax, 0x4e8218
call fcn.00405054
test ebx, ebx
jne 0x4e7dd6
lea eax, [ebp - 0x20]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404fcc
push dword [ebp - 0x20]
push 0x4e8178
push dword [ebp - 8]
lea eax, [ebp - 0x24]
push eax
mov ecx, 2
mov edx, 3
mov eax, dword [ebp - 0xc]
call fcn.00404fcc
push dword [ebp - 0x24]
lea eax, [ebp - 8]
mov edx, 4
call fcn.00404e2c
mov ecx, dword [0x4fede0]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x4353c4]
call fcn.0043af78
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00453e20
mov edx, dword [0x4fede0]
mov edx, dword [edx]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xf0]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00453f30
mov eax, dword [ebx + 0x270]
mov edx, 0x4e8224
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, ebx
call fcn.00403ba8
mov dl, 1
mov eax, dword [0x428158]
call fcn.00428258
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.004282f8
mov cl, 1
mov edx, 0x4e8240
mov eax, ebx
call fcn.0042835c
lea ecx, [ebp - 0x10]
mov edx, 0x4e825c
mov eax, ebx
call fcn.004286e0
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x10]
call fcn.0040945c
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x10]
call fcn.00404b40
cmp dword [ebp - 0x10], 0
jne 0x4e7f0b
lea eax, [ebp - 0x10]
mov edx, 0x4e81e8
call fcn.00404b40
mov eax, ebx
call fcn.004282c8
mov eax, ebx
call fcn.00403ba8
mov dl, 1
mov eax, dword [0x42973c]
call fcn.00430198
mov edi, eax
mov edx, 0x4e8270
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x4c]
mov bl, 0x34
mov byte [ebp - 0x15], 0x34
mov byte [ebp - 0x16], 0x35
movzx eax, bl
movzx edx, byte [ebp - 0x15]
shl edx, 8
or eax, edx
movzx edx, byte [ebp - 0x16]
shl edx, 0x10
or eax, edx
jmp 0x4e7f59
push eax
mov eax, edi
call fcn.0043076c
mov ecx, 0x3d
mov edx, 8
call fcn.0042bae0
mov bl, 0x41
mov byte [ebp - 0x15], 0x42
mov byte [ebp - 0x16], 0x44
movzx eax, bl
movzx edx, byte [ebp - 0x15]
shl edx, 8
or eax, edx
movzx edx, byte [ebp - 0x16]
shl edx, 0x10
or eax, edx
jmp 0x4e7f96
push eax
mov eax, edi
call fcn.0043076c
mov ecx, 0x3d
mov edx, 0xc
call fcn.0042bae0
mov bl, 0x3f
mov byte [ebp - 0x15], 0x3f
mov byte [ebp - 0x16], 0x42
movzx eax, bl
movzx edx, byte [ebp - 0x15]
shl edx, 8
or eax, edx
movzx edx, byte [ebp - 0x16]
shl edx, 0x10
or eax, edx
jmp 0x4e7fd3
push eax
mov eax, edi
call fcn.0043076c
mov ecx, 0x3d
mov edx, 0xd
call fcn.0042bae0
mov edx, 0x4e8270
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, edi
call fcn.00403ba8
mov eax, dword [0x4fecc4]
mov eax, dword [eax]
push dword [eax + 0x140]
push 0x4e8288
mov eax, dword [0x4fecc4]
mov eax, dword [eax]
push dword [eax + 0x144]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404e2c
push 0
mov eax, dword [0x4fecc4]
mov eax, dword [eax]
mov eax, dword [eax + 0xd0]
call fcn.00404f6c
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404f6c
mov edx, eax
mov eax, dword [0x4fec0c]
mov eax, dword [eax]
pop ecx
call fcn.00471208
push 5
push 0
push 0
lea edx, [ebp - 0x2c]
mov eax, dword [0x4fec0c]
mov eax, dword [eax]
call fcn.0047176c
mov eax, dword [ebp - 0x2c]
call fcn.00404f6c
push eax
push 0x4e828c
push esi
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x4fec0c]
mov eax, dword [eax]
call fcn.00471108
jmp 0x4e80c2
push 0
mov eax, dword [0x4fecc4]
mov eax, dword [eax]
mov eax, dword [eax + 0xd0]
call fcn.00404f6c
push eax
mov eax, dword [0x4fecc4]
mov eax, dword [eax]
mov eax, dword [eax + 0x13c]
call fcn.00404f6c
mov edx, eax
mov eax, dword [0x4fec0c]
mov eax, dword [eax]
pop ecx
call fcn.00471208
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e80f1
lea eax, [ebp - 0x2c]
mov edx, 5
call fcn.00404acc
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404acc
ret