Function at 0x440490
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b53fd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4d0b90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x18]
push ecx
mov ecx, 0x4793b78
call fcn.00475ac0
movzx edx, al
test edx, edx
je case.default.0x44050c
push 0xffffffffffffffff
mov ecx, 0x4793b78
call fcn.00475220
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x100
jg 0x440513
cmp dword [ebp - 0x14], 0x100
je 0x44072d
cmp dword [ebp - 0x14], 7
ja case.default.0x44050c
mov edx, dword [ebp - 0x14]
jmp dword [edx*4 + 0x44076c]
cmp dword [ebp - 0x14], 0x101
je 0x440737
jmp case.default.0x44050c
mov ecx, 0x489f860
call fcn.004672c0
mov ecx, 0x489f1d0
call fcn.0041cb50
push 1
mov ecx, 0x489f1d0
call fcn.00464bb0
push 0x65
mov ecx, 0x4927138
call fcn.004474f0
push 0x64
mov ecx, 0x4927138
call fcn.004474f0
push 0x6e
mov ecx, 0x4927138
call fcn.004474f0
push 0x66
mov ecx, 0x4927138
call fcn.004474f0
push 0x67
mov ecx, 0x4927138
call fcn.004474f0
push 0x68
mov ecx, 0x4927138
call fcn.004474f0
push 0x70
mov ecx, 0x4927138
call fcn.004474f0
mov ecx, 0x574b5f8
call fcn.0044a160
mov ecx, 0x4793b64
call fcn.0046c330
mov ecx, 0x489f1d0
call fcn.00463760
mov ecx, 0x489f1d0
call fcn.00465ac0
push 0
mov ecx, 0x69dd128
call fcn.004784d0
mov ecx, 0x69dd128
call fcn.0048d590
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 3
push 0
push 1
push 8
mov ecx, 0x489f1d0
call fcn.00461090
push 8
mov ecx, 0x489f1d0
call fcn.004113b0
mov dword [ebp - 0x18], eax
push 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x18]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, 0x4d2930
call fcn.0046cb10
mov ecx, 0x574b760
call fcn.0045e800
mov ecx, dword [ebp - 0x10]
call fcn.00440b10
jmp case.default.0x44050c
mov ecx, 0x489f1d0
call fcn.0041cb50
push 1
mov ecx, 0x489f1d0
call fcn.00464bb0
mov ecx, dword [ebp - 0x10]
call fcn.00440b80
jmp case.default.0x44050c
mov ecx, 0x489f1d0
call fcn.0041cb50
push 1
mov ecx, 0x489f1d0
call fcn.00464bb0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x14], 3
push 0
push 1
push 7
mov ecx, 0x489f1d0
call fcn.00461090
mov ecx, dword [ebp - 0x10]
call fcn.00440b10
jmp case.default.0x44050c
mov ecx, dword [ebp - 0x10]
call fcn.00440bb0
jmp case.default.0x44050c
mov ecx, dword [ebp - 0x10]
call fcn.00440be0
jmp case.default.0x44050c
push 2
push 2
mov ecx, dword [ebp - 0x10]
call fcn.0041a1f0
movzx edx, al
test edx, edx
jne 0x4406c5
mov ecx, dword [ebp - 0x10]
call fcn.00440b40
jmp case.default.0x44050c
mov ecx, dword [ebp - 0x10]
call fcn.00440c10
jmp case.default.0x44050c
lea ecx, [ebp - 0x28]
call fcn.00494520
mov dword [ebp - 4], 0
mov ecx, 0x489f1d0
call fcn.00411390
push eax
lea ecx, [ebp - 0x28]
call fcn.004945e0
push 0x4c54a8
lea ecx, [ebp - 0x28]
call fcn.00494630
push 1
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00411210
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00494560
jmp case.default.0x44050c
mov ecx, dword [ebp - 0x10]
call fcn.00440b40
jmp case.default.0x44050c
mov ecx, 0x48a70f4
call fcn.00415e80
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 1
mov ecx, dword [ebp - 0x10]
call fcn.00415cc0
mov ecx, 0x50a9e78
call fcn.0045a010
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret