Function at 0x4dad60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x4dad68
push ecx
push ebx
push esi
mov eax, 0x4da7e8
call fcn.004069bc
xor eax, eax
push ebp
push 0x4db255
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4dfad0]
mov eax, dword [eax]
call fcn.0046a628
mov byte [0x4e1db8], 1
mov eax, dword [0x4dfa94]
call fcn.00404350
lea eax, [ebp - 0x14]
call fcn.004ccab0
mov edx, dword [ebp - 0x14]
mov eax, 0x4e1db4
call fcn.004043a4
call fcn.004cc9b4
mov ebx, eax
lea eax, [ebp - 0x18]
call fcn.004cca5c
mov edx, dword [ebp - 0x18]
mov eax, 0x4e1db0
call fcn.004043a4
call fcn.004cd264
test al, al
jne 0x4dadf2
mov eax, 0x4db26c
call fcn.004ce2f4
mov byte [0x4e1db8], 0
test bl, bl
jne 0x4dae07
mov eax, 0x4db298
call fcn.004ce2f4
mov byte [0x4e1db8], 0
cmp byte [0x4e1db8], 0
je 0x4dae53
mov eax, 0x4e1da4
mov edx, 0x4db2cc
call fcn.004043a4
lea edx, [ebp - 0x1c]
mov eax, dword [0x4e1da4]
call fcn.004cd104
mov edx, dword [ebp - 0x1c]
mov eax, 0x4e1dbc
call fcn.004043a4
cmp dword [0x4e1dbc], 0
jne 0x4dae53
mov eax, 0x4db304
call fcn.004ce2f4
mov byte [0x4e1db8], 0
cmp byte [0x4e1db8], 0
je 0x4daf84
lea eax, [ebp - 0x20]
push eax
xor ecx, ecx
mov edx, 0x4db334
mov eax, dword [0x4e1dbc]
call fcn.004ccee4
mov edx, dword [ebp - 0x20]
mov eax, 0x4e1dc0
call fcn.004043a4
lea eax, [ebp - 0x24]
push eax
mov ecx, 1
mov edx, 0x4db334
mov eax, dword [0x4e1dbc]
call fcn.004ccee4
mov edx, dword [ebp - 0x24]
mov eax, 0x4e1dac
call fcn.004043a4
lea eax, [ebp - 0x28]
push eax
mov ecx, 2
mov edx, 0x4db334
mov eax, dword [0x4e1dbc]
call fcn.004ccee4
mov edx, dword [ebp - 0x28]
mov eax, 0x4e1dc4
call fcn.004043a4
lea eax, [ebp - 0x2c]
push eax
mov ecx, 3
mov edx, 0x4db334
mov eax, dword [0x4e1dbc]
call fcn.004ccee4
mov edx, dword [ebp - 0x2c]
mov eax, 0x4e1dc8
call fcn.004043a4
lea edx, [ebp - 0x30]
mov eax, dword [0x4e1dc0]
call fcn.00408d4c
cmp dword [ebp - 0x30], 0
jne 0x4daf17
mov eax, 0x4db340
call fcn.004ce2f4
mov byte [0x4e1db8], 0
jmp 0x4daf84
mov edx, dword [0x4e1db0]
mov eax, dword [0x4e1dc0]
call fcn.004cbf8c
test al, al
jne 0x4daf3e
mov eax, 0x4db35c
call fcn.004ce2f4
mov byte [0x4e1db8], 0
jmp 0x4daf84
mov edx, dword [0x4e1dac]
mov eax, dword [0x4e1db0]
call fcn.004cc0e0
test al, al
jne 0x4daf84
push 0x4db37c
push dword [0x4e1dac]
push 0x4db3b8
push dword [0x4e1db0]
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.004046d0
mov eax, dword [ebp - 0x34]
call fcn.004ce2f4
mov byte [0x4e1db8], 0
cmp byte [0x4e1db8], 0
je 0x4dafec
lea edx, [ebp - 0x38]
mov eax, dword [0x4e1dc4]
call fcn.00408d4c
mov eax, dword [ebp - 0x38]
mov edx, 0x4db3d4
call fcn.0040475c
je 0x4dafc5
lea edx, [ebp - 0x3c]
mov eax, dword [0x4e1dc4]
call fcn.00408d4c
mov eax, dword [ebp - 0x3c]
mov edx, 0x4db3e0
call fcn.0040475c
jne 0x4dafec
mov byte [0x4e1db8], 0
push 1
push 0
mov eax, dword [0x4e1dc8]
call fcn.00404810
push eax
push 0x4db3e4
push 0x4db3f4
push 0
call sub.shell32.dll_ShellExecuteA
cmp byte [0x4e1db8], 0
je 0x4db042
mov eax, 0x4e1dcc
mov edx, 0x4db404
call fcn.004043a4
lea edx, [ebp - 0x40]
mov eax, dword [0x4e1dcc]
call fcn.004cd104
mov edx, dword [ebp - 0x40]
mov eax, 0x4e1dd0
call fcn.004043a4
lea edx, [ebp - 0x44]
mov eax, dword [0x4e1dd0]
call fcn.00408d4c
cmp dword [ebp - 0x44], 0
jne 0x4db042
mov eax, 0x4db438
call fcn.004ce2f4
mov byte [0x4e1db8], 0
cmp byte [0x4e1db8], 0
je 0x4db06e
lea edx, [ebp - 0x48]
mov eax, dword [0x4e1dc4]
call fcn.00408d4c
mov eax, dword [ebp - 0x48]
mov edx, 0x4db458
call fcn.0040475c
jne 0x4db06e
mov byte [0x4e1db8], 0
cmp byte [0x4e1db8], 0
je 0x4db0fc
xor eax, eax
push ebp
push 0x4db0f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [0x4dfad0]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x4d9eac]
call fcn.00462e60
mov dword [0x4e1ddc], eax
mov eax, dword [0x4e1ddc]
mov eax, dword [eax + 0x304]
mov eax, dword [eax + 0x220]
mov edx, dword [0x4e1dd0]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [0x4e1ddc]
mov edx, dword [eax]
call dword [edx + 0xec]
dec eax
sete byte [0x4e1db8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db0fc
mov eax, dword [0x4e1ddc]
call fcn.00467010
mov eax, dword [0x4e1ddc]
call fcn.0046724c
ret
cmp byte [0x4e1db8], 0
je 0x4db120
mov edx, dword [0x4e1dc8]
mov eax, dword [0x4e1dbc]
call fcn.004ce7a4
test al, al
jne 0x4db120
mov byte [0x4e1db8], 0
cmp byte [0x4e1db8], 0
je 0x4db133
call fcn.004da154
mov byte [0x4e1db8], al
cmp byte [0x4e1db8], 0
je 0x4db146
call fcn.004da2e8
mov byte [0x4e1db8], al
cmp byte [0x4e1db8], 0
je 0x4db1ca
mov eax, dword [0x4df75c]
mov eax, dword [eax]
call fcn.00405864
mov esi, eax
test esi, esi
jl 0x4db1ca
inc esi
xor ebx, ebx
mov eax, dword [0x4df75c]
mov eax, dword [eax]
mov eax, dword [eax + ebx*4]
lea edx, [ebp - 0x4c]
call fcn.00408afc
mov eax, dword [ebp - 0x4c]
push eax
lea edx, [ebp - 0x50]
mov eax, 0x4db464
call fcn.00408afc
mov edx, dword [ebp - 0x50]
pop eax
call fcn.0040475c
jne 0x4db1c6
lea edx, [ebp - 0x54]
mov eax, dword [0x4e1db4]
call fcn.004ccfd0
mov edx, dword [ebp - 0x54]
mov eax, 0x4e1da8
mov ecx, 0x4db478
call fcn.0040465c
xor ecx, ecx
xor edx, edx
mov eax, dword [0x4e1da8]
call fcn.004cd9f4
mov byte [0x4e1db8], al
jmp 0x4db1ca
inc ebx
dec esi
jne 0x4db164
cmp byte [0x4e1db8], 0
je 0x4db23a
mov eax, dword [0x4df75c]
mov eax, dword [eax]
call fcn.00405864
mov esi, eax
test esi, esi
jl 0x4db226
inc esi
xor ebx, ebx
mov eax, 0x4e1dd4
mov edx, dword [0x4df75c]
mov edx, dword [edx]
mov edx, dword [edx + ebx*4]
call fcn.004043a4
mov eax, 0x4e1dd8
mov edx, dword [0x4dfc8c]
mov edx, dword [edx]
mov edx, dword [edx + ebx*4]
call fcn.004043a4
mov edx, dword [0x4e1dd8]
mov eax, dword [0x4e1dd4]
call fcn.004ccafc
inc ebx
dec esi
jne 0x4db1e8
mov eax, dword [0x4e1dc0]
call fcn.004ccc44
mov eax, 0x4db48c
call fcn.004ce2f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db25c
lea eax, [ebp - 0x54]
mov edx, 0x11
call fcn.00404374
ret