Function at 0x45cb80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x4f2d80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x104
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
push ebx
mov edi, ecx
mov dword [ebp - 0x24c], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ecx, ecx
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], ebx
mov word [ebp - 0x228], cx
lea edx, [eax + 2]
jmp 0x45cbe0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x45cbe0
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x20c]
push edx
lea ecx, [ebp - 0x228]
call fcn.00411930
push 1
push 0xffffffffffffffff
push 0x4c5330
lea ecx, [ebp - 0x228]
call fcn.00456b40
cmp eax, 0xffffffff
jne 0x45cc48
cmp dword [ebp - 0x214], 8
jb 0x45cc33
mov eax, dword [ebp - 0x228]
push eax
call fcn.00491b32
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049269f
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x218]
inc eax
cmp eax, ecx
ja 0x45cc63
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x228]
call fcn.00401560
jmp 0x45cc72
sub eax, ecx
push ebx
push eax
lea ecx, [ebp - 0x228]
call fcn.0043f7c0
push ebx
lea ecx, [ebp - 0x2fc]
push ecx
lea ecx, [ebp - 0x2b4]
mov dword [ebp - 0x314], 0x4c5de4
mov dword [ebp - 0x304], 0x4c2e48
mov dword [ebp - 0x2b4], 0x4c5d14
mov dword [ebp - 0x30c], ebx
mov dword [ebp - 0x308], ebx
call fcn.0045ac80
mov edx, dword [ebp - 0x304]
mov eax, dword [edx + 4]
mov dword [ebp + eax - 0x304], 0x4c5d10
mov ecx, dword [ebp - 0x314]
mov edx, dword [ecx + 4]
mov dword [ebp + edx - 0x314], 0x4c5d18
mov eax, dword [ebp - 0x314]
mov ecx, dword [eax + 4]
mov dword [ebp + ecx - 0x314], 0x4c5d94
lea ecx, [ebp - 0x2fc]
call fcn.00459e00
mov eax, dword [ebp - 0x304]
mov edx, dword [edi]
mov dword [ebp - 0x2fc], 0x4c5d58
mov dword [ebp - 0x2c0], ebx
mov dword [ebp - 0x2bc], ebx
mov eax, dword [eax + 4]
mov ecx, dword [edx + 8]
mov edx, dword [ebp + eax - 0x2f0]
lea eax, [ebp + eax - 0x304]
push esi
push 0x4c5e14
push ecx
and edx, 0xfffff9ff
or edx, 0x800
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x304]
mov eax, dword [eax + 4]
push 0x4c5df0
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x304]
lea eax, [ebp + eax - 0x304]
push 0x4c5dec
mov edi, 8
or dword [eax + 0x14], edi
push edx
call fcn.0045ad30
add esp, 8
push eax
call fcn.0045afa0
add esp, 8
push eax
call fcn.0045ad30
add esp, 8
mov ecx, eax
call fcn.0045b790
push eax
call fcn.0045b1d0
add esp, 8
mov ecx, eax
call fcn.0045b790
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x2fc]
call fcn.0045ca90
mov eax, dword [ebp - 0x244]
cmp dword [ebp - 0x230], edi
jae 0x45cdc5
lea eax, [ebp - 0x244]
push eax
call fcn.00495244
add esp, 4
mov esi, eax
cmp dword [ebp - 0x230], edi
jb 0x45cde7
mov ecx, dword [ebp - 0x244]
push ecx
call fcn.00491b32
add esp, 4
push 0x40
lea eax, [ebp - 0x354]
xor edx, edx
push ebx
push eax
mov dword [ebp - 0x230], 7
mov dword [ebp - 0x234], ebx
mov word [ebp - 0x244], dx
call fcn.004926b0
add esp, 0xc
lea ecx, [ebp - 0x25c]
push ecx
lea edx, [ebp - 0x358]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
xor eax, eax
push esi
push ebx
mov dword [ebp - 0x358], 0x44
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x45ce9e
cmp esi, ebx
je 0x45ce63
push esi
call fcn.00493675
add esp, 4
lea ecx, [ebp - 0x314]
call fcn.0045a8a0
cmp dword [ebp - 0x214], edi
jb 0x45cc33
mov eax, dword [ebp - 0x228]
push eax
call fcn.00491b32
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049269f
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x26c]
call fcn.00448010
mov edx, dword [ebp - 0x26c]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x26c]
mov edi, eax
lea eax, [ebp - 0x24c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
setne al
cmp edi, 0x102
jne 0x45cf36
lea ecx, [ebp - 0x26c]
call fcn.00447df0
cmp esi, ebx
je 0x45cefa
push esi
call fcn.00493675
add esp, 4
lea ecx, [ebp - 0x314]
call fcn.0045a8a0
cmp dword [ebp - 0x214], 8
jb 0x45cc33
mov edx, dword [ebp - 0x228]
push edx
call fcn.00491b32
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049269f
mov esp, ebp
pop ebp
ret 4
cmp al, bl
je 0x45cf49
mov byte [ebp - 0x245], 1
cmp dword [ebp - 0x24c], ebx
je 0x45cf4f
mov byte [ebp - 0x245], bl
lea ecx, [ebp - 0x26c]
call fcn.00447df0
cmp esi, ebx
je 0x45cf67
push esi
call fcn.00493675
add esp, 4
lea ecx, [ebp - 0x314]
call fcn.0045a8a0
cmp dword [ebp - 0x214], 8
jb 0x45cf8a
mov eax, dword [ebp - 0x228]
push eax
call fcn.00491b32
add esp, 4
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x245]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049269f
mov esp, ebp
pop ebp
ret 4