Function at 0x4a0c48
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4a0c50
xor eax, eax
push ebp
push 0x4a0f0e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
mov ecx, 0x4a0f24
mov edx, dword [0x4afdd4]
call fcn.00404ed4
mov eax, dword [ebp - 0x1c]
call fcn.004a1c58
mov dl, 1
mov eax, dword [0x41794c]
call fcn.00403c8c
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x20]
mov eax, dword [0x4a9384]
mov eax, dword [eax]
call fcn.0045f290
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
call fcn.004a3f80
call fcn.004a20f0
test al, al
jne 0x4a0cbf
call fcn.004a25cc
test al, al
je 0x4a0d52
push dword [0x4afde4]
push dword [0x4afdd4]
push 0x4a0f24
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00404f50
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.0049f8e4
mov eax, dword [ebp - 0x24]
mov edx, dword [0x4afe70]
call fcn.00404fe4
je 0x4a0d21
push dword [0x4afde4]
push dword [0x4afdd4]
push 0x4a0f24
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00404f50
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
call fcn.0041c824
push dword [0x4afde4]
push dword [0x4afdd4]
push 0x4a0f24
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404f50
lea eax, [ebp - 8]
mov edx, dword [0x4afde4]
call fcn.00404c54
jmp 0x4a0e11
push dword [0x4afdc8]
push dword [0x4afdd4]
push 0x4a0f34
push dword [0x4afdd4]
push 0x4a0f24
lea eax, [ebp - 0x34]
mov edx, 5
call fcn.00404f50
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.0049f8e4
mov eax, dword [ebp - 0x30]
mov edx, dword [0x4afe70]
call fcn.00404fe4
je 0x4a0dca
push dword [0x4afdc8]
push dword [0x4afdd4]
push 0x4a0f34
push dword [0x4afdd4]
push 0x4a0f24
lea eax, [ebp - 0x38]
mov edx, 5
call fcn.00404f50
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
call fcn.0041c824
push dword [0x4afdc8]
push dword [0x4afdd4]
push 0x4a0f34
push dword [0x4afdd4]
push 0x4a0f24
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404f50
push dword [0x4afdc8]
push dword [0x4afdd4]
push 0x4a0f34
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404f50
mov eax, dword [ebp - 0x18]
call fcn.00403cbc
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x4a0f40
mov edx, 0x4a0f4c
mov eax, dword [ebp - 0x10]
call fcn.004a1a0c
cmp dword [ebp - 0xc], 0
je 0x4a0e5b
movzx eax, byte [0x4a0f58]
push eax
lea eax, [ebp - 0x3c]
push eax
mov ecx, 0x4a0f64
mov edx, 0x4a0f34
mov eax, dword [ebp - 0xc]
call fcn.0040edd4
mov eax, dword [ebp - 0x3c]
call fcn.004a19a0
mov eax, dword [ebp - 4]
mov edx, 0x4a0f70
call fcn.00404fe4
jne 0x4a0e74
mov eax, dword [ebp - 0x14]
call fcn.004a1df4
jmp 0x4a0ee6
mov eax, dword [ebp - 4]
mov edx, 0x4a0f7c
call fcn.00404fe4
jne 0x4a0ec4
lea eax, [ebp - 0x40]
mov ecx, 0x4a0f88
mov edx, dword [ebp - 8]
call fcn.00404ed4
mov ecx, dword [ebp - 0x40]
mov edx, dword [0x4afe48]
mov eax, dword [ebp - 0x14]
call fcn.004a1eec
push 0
mov eax, dword [ebp - 8]
call fcn.0040504c
push eax
push 0
push 0x4a0f90
push 0x4a0f98
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4a0ee6
push 0
mov eax, dword [ebp - 8]
call fcn.0040504c
push eax
push 0
mov eax, dword [ebp - 0x14]
call fcn.0040504c
push eax
push 0x4a0f98
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0f15
lea eax, [ebp - 0x40]
mov edx, 0xa
call fcn.00404be0
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404be0
ret