Function at 0x48906c
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x55
push 0
push 0
dec ecx
jne 0x489074
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x48962f
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4895fa
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.00477738
lea ecx, [ebp - 0x210]
mov edx, 0x489648
mov eax, 0x23
call fcn.00488104
call fcn.0047717c
lea ecx, [ebp - 0x214]
mov edx, 0x489664
mov eax, 0x25
call fcn.00488104
cmp dword [0x491f44], 1
jne 0x4894b6
lea edx, [ebp - 0x218]
mov eax, dword [0x491f1c]
call fcn.0040848c
cmp dword [ebp - 0x218], 0
je 0x489112
lea edx, [ebp - 0x21c]
mov eax, dword [0x491f20]
call fcn.0040848c
cmp dword [ebp - 0x21c], 0
jne 0x4891bb
mov eax, dword [0x491f48]
mov edx, 0x489684
call fcn.00404578
jne 0x4891ac
lea edx, [ebp - 0x220]
mov eax, 0x489690
call fcn.00488200
lea ecx, [ebp - 0x224]
mov edx, 0x4896a8
mov eax, 0x26
call fcn.00488104
push 0x4896cc
push dword [0x491f18]
push 0x4896dc
push 0x4896e8
lea eax, [ebp - 0x22c]
mov edx, 4
call fcn.004044ec
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.00488c64
call fcn.0048797c
push 0
push 0x489704
call sub.kernel32.dll_WinExec
mov eax, dword [0x490c6c]
mov eax, dword [eax]
call fcn.0045babc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x489604
mov dword [0x491f44], 1
jmp 0x4894b6
mov eax, dword [0x491f1c]
call fcn.0040442c
cmp eax, 0x64
jl 0x489253
lea edx, [ebp - 0x230]
mov eax, 0x48971c
call fcn.00488200
lea ecx, [ebp - 0x234]
mov edx, 0x489734
mov eax, 0x27
call fcn.00488104
push 0x4896cc
push dword [0x491f18]
push 0x4896dc
push 0x489758
lea eax, [ebp - 0x23c]
mov edx, 4
call fcn.004044ec
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.00488c64
call fcn.0048797c
push 0
push 0x489704
call sub.kernel32.dll_WinExec
mov eax, dword [0x490c6c]
mov eax, dword [eax]
call fcn.0045babc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x489604
lea eax, [ebp - 0x240]
call fcn.00487654
lea ecx, [ebp - 0x244]
mov edx, 0x48977c
mov eax, 0x28
call fcn.00488104
mov eax, dword [0x491f1c]
call fcn.0040442c
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4892df
inc ebx
mov dword [ebp - 4], 0
lea esi, [ebp - 0x3f]
lea eax, [ebp - 0x250]
push eax
mov edx, dword [ebp - 4]
inc edx
mov ecx, 1
mov eax, dword [0x491f1c]
call fcn.0040468c
mov eax, dword [ebp - 0x250]
lea edx, [ebp - 0x24c]
call fcn.00488fec
mov eax, dword [ebp - 0x24c]
lea edx, [ebp - 0x248]
call fcn.00488ee4
mov eax, dword [ebp - 0x248]
call fcn.004086c8
mov byte [esi], al
inc dword [ebp - 4]
inc esi
dec ebx
jne 0x48928f
mov eax, dword [0x491f1c]
call fcn.0040442c
mov byte [ebp + eax - 0x3f], 0
lea ebx, [ebp - 0x3f]
lea ecx, [ebp - 0x254]
mov edx, 0x489798
mov eax, 0x29
call fcn.00488104
call sub.FWT.dll_DSF_Strategy_GetKernelDefault
mov esi, eax
mov eax, dword [0x491f1c]
call fcn.0040442c
inc eax
push eax
push ebx
push 0
push esi
call sub.FWT.dll_DSF_Proxy_SetEncrypt
mov eax, dword [0x491f1c]
call fcn.0040442c
inc eax
push eax
push ebx
push 0
push esi
call sub.FWT.dll_DSF_Proxy_SetDecrypt
push 0
call sub.FWT.dll_DSF_FastDev_RunMode
mov eax, 0x491ec8
mov edx, dword [0x491f24]
call fcn.004041c0
mov eax, 0x491ecc
mov edx, dword [0x491f28]
call fcn.004041c0
lea ecx, [ebp - 0x258]
mov edx, 0x4897b4
mov eax, 0x2a
call fcn.00488104
push 0x4897e0
lea eax, [ebp - 0x264]
push eax
mov ecx, 0x4897f0
mov edx, edi
mov eax, dword [0x491f24]
call fcn.00488ae0
push dword [ebp - 0x264]
push 0x4897fc
lea eax, [ebp - 0x260]
mov edx, 3
call fcn.004044ec
mov edx, dword [ebp - 0x260]
lea ecx, [ebp - 0x25c]
mov eax, 0x2b
call fcn.00488104
push 0x4897e0
push dword [0x491f24]
push 0x4897fc
lea eax, [ebp - 0x26c]
mov edx, 3
call fcn.004044ec
mov edx, dword [ebp - 0x26c]
lea ecx, [ebp - 0x268]
mov eax, 0x2c
call fcn.00488104
push 0x4897e0
push dword [0x491f28]
push 0x4897fc
lea eax, [ebp - 0x274]
mov edx, 3
call fcn.004044ec
mov edx, dword [ebp - 0x274]
lea ecx, [ebp - 0x270]
mov eax, 0x2d
call fcn.00488104
mov eax, dword [0x491f28]
push eax
lea eax, [ebp - 0x278]
push eax
mov ecx, 0x48980c
mov edx, 0x48981c
mov eax, dword [0x491ee8]
call fcn.004884e0
lea eax, [ebp - 0x27c]
call fcn.00479428
call fcn.004783a4
lea eax, [ebp - 0x280]
call fcn.00487654
call fcn.00476ce0
lea eax, [ebp - 0x284]
call fcn.00486d14
lea ecx, [ebp - 0x288]
mov edx, 0x48982c
mov eax, 0x2f
call fcn.00488104
xor eax, eax
mov dword [0x491f44], eax
mov eax, dword [0x491f48]
mov edx, 0x489858
call fcn.00404578
jne 0x4894b6
lea edx, [ebp - 0x28c]
mov eax, 0x489864
call fcn.00488200
lea eax, [ebp - 0x290]
call fcn.00479384
call fcn.00478d80
cmp dword [0x491fac], 0
jne 0x4895c2
lea edx, [ebp - 8]
mov eax, 0x48987c
call fcn.004882f8
mov edx, 0x4897f0
mov eax, dword [ebp - 8]
call fcn.00488a04
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x489582
inc ebx
xor edi, edi
xor esi, esi
lea eax, [ebp - 0x298]
push eax
mov ecx, 0x4897f0
mov edx, edi
mov eax, dword [ebp - 8]
call fcn.00488ae0
mov eax, dword [ebp - 0x298]
lea edx, [ebp - 0x294]
call fcn.0040848c
cmp dword [ebp - 0x294], 0
je 0x489561
lea eax, [ebp - 0x2a0]
push eax
mov ecx, 0x4897f0
mov edx, edi
mov eax, dword [ebp - 8]
call fcn.00488ae0
mov eax, dword [ebp - 0x2a0]
lea edx, [ebp - 0x29c]
call fcn.0040848c
mov eax, dword [ebp - 0x29c]
call fcn.004086c8
mov esi, eax
test esi, esi
je 0x48957a
push 0xffffffffffffffff
push esi
push 0
push 0x411
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
inc edi
dec ebx
jne 0x4894fb
push 0
lea eax, [ebp - 0x2a4]
mov ecx, 0x48987c
mov edx, dword [0x491eec]
call fcn.00404478
mov eax, dword [ebp - 0x2a4]
call fcn.0040462c
push eax
call sub.kernel32.dll_WinExec
lea ecx, [ebp - 0x2a8]
mov edx, 0x489890
mov eax, 0x5f
call fcn.00488104
jmp 0x4895f0
call fcn.0048797c
mov eax, dword [0x490ae0]
mov eax, dword [eax]
mov eax, dword [eax + 0x304]
xor edx, edx
call fcn.00430c44
lea ecx, [ebp - 0x2ac]
mov edx, 0x4898ac
mov eax, 0x5f
call fcn.00488104
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x489604
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489636
lea eax, [ebp - 0x2ac]
mov edx, 0x28
call fcn.00404190
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404190
ret