Function at 0x4e41f4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x3d
push 0
push 0
dec ecx
jne 0x4e41fc
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405c1c
xor eax, eax
push ebp
push 0x4e4dcf
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea eax, [ebp - 0x164]
mov ecx, dword [ebp - 4]
mov edx, 0x4e4de4
call fcn.00405a78
mov edx, dword [ebp - 0x164]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x168]
mov eax, dword [ebp - 4]
call fcn.00409ad4
mov ecx, dword [ebp - 0x168]
mov edx, 0x4e4e14
mov eax, 0x80000001
call fcn.00488b2c
cmp dword [ebp - 0x10], 0
je 0x4e4290
mov eax, dword [ebp - 0x10]
call fcn.0040a8f4
test al, al
jne 0x4e4290
lea eax, [ebp - 0x10]
call fcn.00405758
cmp dword [ebp - 0x10], 0
jne 0x4e42e5
lea edx, [ebp - 0x16c]
mov eax, 0x26
call fcn.00488534
push dword [ebp - 0x16c]
push 0x4e4e2c
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 4]
call fcn.0040adc4
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x170]
xor edx, edx
call fcn.0040abf0
push dword [ebp - 0x170]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405aec
mov eax, dword [ebp - 0x10]
call fcn.0040a8f4
test al, al
je 0x4e431a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x178]
mov ecx, dword [ebp - 4]
mov edx, 0x4e4e38
call fcn.00405a78
mov eax, dword [ebp - 0x178]
mov cl, 1
mov edx, dword [ebp - 0x10]
call fcn.00488470
jmp 0x4e4377
mov eax, dword [ebp - 0x10]
call fcn.0040afc4
lea eax, [ebp - 8]
push eax
push 0x4e4e38
push dword [ebp - 4]
push 0x4e4e70
push 0x4e4e7c
push 0x4e4e70
push 0x4e4ec8
lea eax, [ebp - 0x17c]
mov edx, 6
call fcn.00405aec
mov eax, dword [ebp - 0x17c]
mov cl, 1
mov edx, dword [ebp - 0x10]
call fcn.00488470
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00405b78
je 0x4e4377
mov eax, dword [ebp - 0x10]
call fcn.0040afe0
cmp dword [ebp - 8], 0
jne 0x4e43a7
mov eax, 0x4e4efc
call fcn.0043e398
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e4f1c
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4e4da4
lea edx, [ebp - 0x180]
mov eax, dword [ebp - 8]
call fcn.00409ad4
mov edx, dword [ebp - 0x180]
lea eax, [ebp - 8]
call fcn.004057f0
mov eax, dword [ebp - 8]
test eax, eax
je 0x4e43cf
sub eax, 4
mov eax, dword [eax]
cmp eax, 4
jge 0x4e43e0
mov eax, 0x4e4f3c
call fcn.0043e398
xor ebx, ebx
mov eax, dword [ebp - 8]
call fcn.00405c2c
mov esi, eax
mov eax, esi
mov edx, 0x4e4fa0
call fcn.0040b1cc
test eax, eax
jne 0x4e440a
mov eax, esi
mov edx, 0x4e4fa8
call fcn.0040b1cc
test eax, eax
je 0x4e4416
mov eax, 0x4e4fb8
call fcn.0043e398
xor ebx, ebx
mov eax, esi
mov edx, 0x4e500c
call fcn.0040b1cc
test eax, eax
je 0x4e4432
mov eax, 0x4e5020
call fcn.0043e398
xor ebx, ebx
mov eax, dword [ebp - 8]
call fcn.00405c2c
mov esi, eax
mov eax, esi
mov edx, 0x4e509c
call fcn.0040b1cc
test eax, eax
jne 0x4e447c
mov eax, esi
mov edx, 0x4e50a4
call fcn.0040b1cc
test eax, eax
jne 0x4e447c
mov eax, esi
mov edx, 0x4e50ac
call fcn.0040b1cc
test eax, eax
jne 0x4e447c
mov eax, esi
mov edx, 0x4e50b0
call fcn.0040b1cc
test eax, eax
je 0x4e4488
mov eax, 0x4e50c0
call fcn.0043e398
xor ebx, ebx
test bl, bl
je 0x4e421e
lea eax, [ebp - 8]
mov edx, 0x4e4e2c
call fcn.00405a34
lea eax, [ebp - 0x184]
mov ecx, dword [ebp - 4]
mov edx, 0x4e5130
call fcn.00405a78
mov edx, dword [ebp - 0x184]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4e44d8
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
sub ecx, 4
jno 0x4e44e8
call fcn.00404728
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405c8c
mov eax, dword [ebp - 4]
mov edx, 0x4e5154
call fcn.00405b78
jne 0x4e4524
push 0x4e516c
push dword [ebp - 0x14]
push 0x4e5180
push dword [0x4f65f0]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00405aec
mov eax, dword [ebp - 4]
mov edx, 0x4e518c
call fcn.00405b78
jne 0x4e4553
push 0x4e516c
push dword [ebp - 0x14]
push 0x4e5180
push dword [0x4f65f4]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00405aec
mov eax, dword [ebp - 4]
mov edx, 0x4e51a0
call fcn.00405b78
jne 0x4e4582
push 0x4e516c
push dword [ebp - 0x14]
push 0x4e5180
push dword [0x4f65f8]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00405aec
mov eax, dword [ebp - 4]
mov edx, 0x4e51b8
call fcn.00405b78
jne 0x4e459e
lea eax, [ebp - 0x14]
mov edx, 0x4e51d4
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5208
call fcn.00405b78
jne 0x4e45ba
lea eax, [ebp - 0x14]
mov edx, 0x4e51d4
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5220
call fcn.00405b78
jne 0x4e45d6
lea eax, [ebp - 0x14]
mov edx, 0x4e523c
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5268
call fcn.00405b78
jne 0x4e45f2
lea eax, [ebp - 0x14]
mov edx, 0x4e5284
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e52b0
call fcn.00405b78
jne 0x4e460e
lea eax, [ebp - 0x14]
mov edx, 0x4e52cc
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e52f8
call fcn.00405b78
jne 0x4e462a
lea eax, [ebp - 0x14]
mov edx, 0x4e5314
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5340
call fcn.00405b78
jne 0x4e4646
lea eax, [ebp - 0x14]
mov edx, 0x4e535c
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5388
call fcn.00405b78
jne 0x4e4662
lea eax, [ebp - 0x14]
mov edx, 0x4e53a4
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e53d0
call fcn.00405b78
jne 0x4e467e
lea eax, [ebp - 0x14]
mov edx, 0x4e53ec
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5418
call fcn.00405b78
jne 0x4e469a
lea eax, [ebp - 0x14]
mov edx, 0x4e5430
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5458
call fcn.00405b78
jne 0x4e46b6
lea eax, [ebp - 0x14]
mov edx, 0x4e5470
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5498
call fcn.00405b78
jne 0x4e46d2
lea eax, [ebp - 0x14]
mov edx, 0x4e54b0
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e54d8
call fcn.00405b78
jne 0x4e46ee
lea eax, [ebp - 0x14]
mov edx, 0x4e54f0
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5518
call fcn.00405b78
jne 0x4e470a
lea eax, [ebp - 0x14]
mov edx, 0x4e5530
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5558
call fcn.00405b78
jne 0x4e4726
lea eax, [ebp - 0x14]
mov edx, 0x4e5570
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5598
call fcn.00405b78
jne 0x4e4742
lea eax, [ebp - 0x14]
mov edx, 0x4e55b0
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e55d8
call fcn.00405b78
jne 0x4e475e
lea eax, [ebp - 0x14]
mov edx, 0x4e55f4
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5620
call fcn.00405b78
jne 0x4e477a
lea eax, [ebp - 0x14]
mov edx, 0x4e563c
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5668
call fcn.00405b78
jne 0x4e4796
lea eax, [ebp - 0x14]
mov edx, 0x4e5684
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e56b0
call fcn.00405b78
jne 0x4e47b2
lea eax, [ebp - 0x14]
mov edx, 0x4e56cc
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e56f8
call fcn.00405b78
jne 0x4e47ce
lea eax, [ebp - 0x14]
mov edx, 0x4e5714
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5740
call fcn.00405b78
jne 0x4e47ea
lea eax, [ebp - 0x14]
mov edx, 0x4e575c
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e5788
call fcn.00405b78
jne 0x4e4806
lea eax, [ebp - 0x14]
mov edx, 0x4e57a4
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e57d0
call fcn.00405b78
jne 0x4e4822
lea eax, [ebp - 0x14]
mov edx, 0x4e57ec
call fcn.004057f0
mov eax, dword [ebp - 4]
mov edx, 0x4e580c
call fcn.00405b78
jne 0x4e483e
lea eax, [ebp - 0x14]
mov edx, 0x4e5828
call fcn.004057f0
lea eax, [ebp - 0x188]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405a78
mov eax, dword [ebp - 0x188]
push eax
lea eax, [ebp - 0x18c]
mov ecx, dword [ebp - 0x14]
mov edx, 0x4e584c
call fcn.00405a78
mov eax, dword [ebp - 0x18c]
mov cl, 1
pop edx
call fcn.00486398
test al, al
je 0x4e498c
lea eax, [ebp - 0x190]
mov ecx, dword [ebp - 4]
mov edx, 0x4e586c
call fcn.00405a78
mov edx, dword [ebp - 0x190]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x194]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405a78
mov eax, dword [ebp - 0x194]
call fcn.0040a8d0
test al, al
je 0x4e496f
lea eax, [ebp - 0x198]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405a78
mov edx, dword [ebp - 0x198]
lea eax, [ebp - 0x160]
call fcn.004035a0
mov edx, 1
lea eax, [ebp - 0x160]
call fcn.00403d68
call fcn.00402ef0
lea eax, [ebp - 0x160]
call fcn.004039a8
call fcn.00402ef0
mov ebx, eax
lea edx, [ebp - 0x1a0]
mov eax, ebx
call fcn.0040a2e8
mov ecx, dword [ebp - 0x1a0]
lea eax, [ebp - 0x19c]
mov edx, 0x4e5894
call fcn.00405a78
mov edx, dword [ebp - 0x19c]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x160]
call fcn.00403668
call fcn.00402ef0
jmp 0x4e4a0a
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e58b0
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4e4a0a
push 0x4e5934
push dword [ebp - 4]
push 0x4e5954
lea eax, [ebp - 0x1a4]
mov edx, 3
call fcn.00405aec
mov edx, dword [ebp - 0x1a4]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e5960
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e59b0
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, 0x4e59d0
call fcn.0043e398
jmp 0x4e4da4
mov eax, 1
mov edx, dword [ebp - 4]
dec eax
test edx, edx
je 0x4e4a1c
cmp eax, dword [edx - 4]
jb 0x4e4a21
call fcn.00404720
inc eax
cmp byte [edx + eax - 1], 0x70
jne 0x4e4a69
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e5b54
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x1a8]
mov ecx, 0x4e5b80
mov edx, dword [ebp - 8]
call fcn.00405a78
mov edx, dword [ebp - 0x1a8]
mov cl, 1
mov eax, 0x4e5b98
call fcn.00486398
mov eax, 1
mov edx, dword [ebp - 4]
dec eax
test edx, edx
je 0x4e4a7b
cmp eax, dword [edx - 4]
jb 0x4e4a80
call fcn.00404720
inc eax
cmp byte [edx + eax - 1], 0x6f
jne 0x4e4ac8
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e5bcc
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x1ac]
mov ecx, 0x4e5bf4
mov edx, dword [ebp - 8]
call fcn.00405a78
mov edx, dword [ebp - 0x1ac]
mov cl, 1
mov eax, 0x4e5c08
call fcn.00486398
push 0x4e5c3c
push dword [ebp - 8]
push dword [ebp - 4]
lea eax, [ebp - 0x1b0]
mov edx, 3
call fcn.00405aec
mov edx, dword [ebp - 0x1b0]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0xc]
mov edx, 0x4e5c60
mov eax, dword [ebp - 4]
call fcn.0040abf0
lea eax, [ebp - 0x1b4]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4e5c70
call fcn.00405a78
mov edx, dword [ebp - 0x1b4]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 2
lea eax, [ebp - 0x1b8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405a78
mov eax, dword [ebp - 0x1b8]
mov ecx, 0x4e5ca0
mov edx, dword [ebp - 0xc]
call fcn.00488568
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e5cb8
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 8]
push eax
lea edx, [ebp - 0x1bc]
mov eax, dword [ebp - 4]
call fcn.00409ad4
mov ecx, dword [ebp - 0x1bc]
mov edx, 0x4e4e14
mov eax, 0x80000001
call fcn.00488a64
lea eax, [ebp - 0x1c0]
mov ecx, dword [ebp - 4]
mov edx, 0x4e5cf0
call fcn.00405a78
mov edx, dword [ebp - 0x1c0]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
call fcn.00488978
test al, al
je 0x4e4d37
lea eax, [ebp - 0x1c8]
mov edx, 1
mov ecx, dword [ebp - 4]
dec edx
test ecx, ecx
je 0x4e4bfa
cmp edx, dword [ecx - 4]
jb 0x4e4bff
call fcn.00404720
inc edx
movzx edx, byte [ecx + edx - 1]
call fcn.00405940
mov eax, dword [ebp - 0x1c8]
lea edx, [ebp - 0x1c4]
call fcn.00409ad4
mov eax, dword [ebp - 0x1c4]
mov edx, 0x4e5d2c
call fcn.00405b78
jne 0x4e4c53
lea eax, [ebp - 0x1cc]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405a78
mov ecx, dword [ebp - 0x1cc]
mov edx, 0x4e5d38
mov eax, 0x4e5d54
call fcn.0048874c
lea eax, [ebp - 0x1d4]
mov edx, 1
mov ecx, dword [ebp - 4]
dec edx
test ecx, ecx
je 0x4e4c6b
cmp edx, dword [ecx - 4]
jb 0x4e4c70
call fcn.00404720
inc edx
movzx edx, byte [ecx + edx - 1]
call fcn.00405940
mov eax, dword [ebp - 0x1d4]
lea edx, [ebp - 0x1d0]
call fcn.00409ad4
mov eax, dword [ebp - 0x1d0]
mov edx, 0x4e5d64
call fcn.00405b78
jne 0x4e4cc4
lea eax, [ebp - 0x1d8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405a78
mov ecx, dword [ebp - 0x1d8]
mov edx, 0x4e5d70
mov eax, 0x4e5d8c
call fcn.0048874c
lea eax, [ebp - 0x1e0]
mov edx, 1
mov ecx, dword [ebp - 4]
dec edx
test ecx, ecx
je 0x4e4cdc
cmp edx, dword [ecx - 4]
jb 0x4e4ce1
call fcn.00404720
inc edx
movzx edx, byte [ecx + edx - 1]
call fcn.00405940
mov eax, dword [ebp - 0x1e0]
lea edx, [ebp - 0x1dc]
call fcn.00409ad4
mov eax, dword [ebp - 0x1dc]
mov edx, 0x4e5d9c
call fcn.00405b78
jne 0x4e4d5c
lea eax, [ebp - 0x1e4]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405a78
mov ecx, dword [ebp - 0x1e4]
mov edx, 0x4e5da8
mov eax, 0x4e5dc0
call fcn.0048874c
jmp 0x4e4d5c
mov eax, 0x4e5dd0
call fcn.0043e398
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e5fec
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e59b0
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp byte [0x4f65fd], 0
je 0x4e4da4
push 5
lea eax, [ebp - 0x1e8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405a78
mov eax, dword [ebp - 0x1e8]
call fcn.00405c2c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4dd6
lea eax, [ebp - 0x1e8]
mov edx, 0x22
call fcn.0040577c
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040577c
ret