Function at 0x4dea62
Capabilities:
Create process on windows

Disassembly:
push 0x36c
mov eax, 0x61ccb0
call fcn.0042d958
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp + 0x10]
push 0x208
mov dword [ebp - 0x360], eax
lea eax, [ebp - 0x218]
push 0
push eax
mov byte [ebp - 0x355], 0
call fcn.0042e9f0
mov edi, dword [0x6b5e34]
add esp, 0xc
mov eax, dword [edi]
push 0x104
mov esi, dword [eax + 0x20]
lea eax, [ebp - 0x218]
push eax
push 0
mov ecx, esi
call dword [0x62c6dc]
mov ecx, edi
call esi
push ebx
push str._client
lea eax, [ebp - 0x248]
push eax
call fcn.0041991d
mov esi, dword [ebp - 0x35c]
lea ecx, [ebp - 0x230]
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], ebx
call fcn.004144d5
push ebx
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.0041428a
mov esi, 0x63b7c8
cmp eax, 0xffffffff
jne 0x4c94c7
push esi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x354]
push eax
call fcn.0041468b
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
push ecx
push eax
lea eax, [ebp - 0x378]
push eax
call fcn.0042a09b
lea ecx, [ebp - 0x230]
cmp ecx, eax
je 0x4c94ad
mov byte [ebp - 0x35c], bl
push dword [ebp - 0x35c]
push eax
call fcn.00414551
lea ecx, [ebp - 0x378]
call fcn.00415bf1
lea ecx, [ebp - 0x354]
mov byte [ebp - 4], 1
call fcn.00415bf1
call fcn.004c8416
test al, al
je 0x4c95de
push 0xb0
lea eax, [ebp - 0x33c]
push ebx
push eax
call fcn.0042e9f0
add esp, 0xc
lea ecx, [ebp - 0x33c]
push 1
call fcn.00423157
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 3
push eax
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x32c]
push eax
call fcn.00425162
push eax
call fcn.00425162
push eax
call fcn.00468de2
xor eax, eax
lea edi, [ebp - 0x34c]
stosd dword es:[edi], eax
push 0x44
pop esi
push esi
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x28c]
push eax
call fcn.0042e9f0
add esp, 0xc
mov dword [ebp - 0x28c], esi
lea eax, [ebp - 0x378]
lea ecx, [ebp - 0x324]
push eax
call fcn.004240fa
cmp dword [ebp - 0x364], 8
lea ecx, [ebp - 0x34c]
push ecx
lea ecx, [ebp - 0x28c]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x378]
cmovae eax, dword [ebp - 0x378]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ecx, [ebp - 0x378]
mov esi, eax
call fcn.00415bf1
test esi, esi
je 0x4c95da
cmp dword [ebp - 0x348], 0
je 0x4c95af
push dword [ebp - 0x348]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x34c], 0
je 0x4c95c4
push dword [ebp - 0x34c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, byte [ebp - 0x355]
lea ecx, [ebp - 0x33c]
call fcn.00421459
jmp 0x4c9662
mov bl, 1
jmp 0x4c95ca
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x284]
push ebx
push eax
call fcn.0042e9f0
mov edi, dword [0x6b5e34]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x274], eax
add esp, 0xc
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
mov dword [ebp - 0x284], esi
cmovae eax, dword [ebp - 0x230]
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x280], 0x8000
mov dword [ebp - 0x278], str.open
mov dword [ebp - 0x268], 5
mov eax, dword [edi]
mov esi, dword [eax + 0x15c]
lea eax, [ebp - 0x284]
push eax
mov ecx, esi
call dword [0x62c6dc]
mov ecx, edi
call esi
test eax, eax
setne bl
test bl, bl
je 0x4c966a
xor eax, eax
jmp 0x4c9670
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x360]
mov dword [ecx], eax
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x4c9696
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x230]
call fcn.004157b4
and dword [ebp - 0x220], 0
lea ecx, [ebp - 0x248]
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
call fcn.00415bf1
mov al, bl
call fcn.0042d907
ret 0xc
push ebp
mov ebp, esp
pop ebp
jmp 0x4c93ad