Function at 0x4b15dfdd
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4b16c628]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [0x4b16c0b8]
cmp byte [eax + 0x19], 2
push edi
mov edi, ecx
mov dword [ebp - 0x210], edi
mov esi, 0x4b1528f0
jb 0x4b15e01e
push esi
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.4b157041
mov eax, dword [0x4b16c0b8]
cmp byte [edi + 0x10], 0
jne 0x4b15e043
push 2
pop ebx
cmp byte [eax + 0x19], bl
jb 0x4b15e1e2
push esi
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.4b157041
jmp 0x4b15e1e2
mov ecx, dword [edi + 0x220]
test ecx, ecx
jne 0x4b15e05f
cmp byte [eax + 0x19], 2
push 8
pop ebx
jb 0x4b15e1e2
push esi
push 0x10
jmp 0x4b15e033
cmp dword [ecx + 8], 0
jne 0x4b15e079
cmp byte [eax + 0x19], 2
mov ebx, 0x5a4
jb 0x4b15e1e2
push esi
push 0x11
jmp 0x4b15e033
push 0x11
xor eax, eax
pop ecx
lea edi, [ebp - 0x264]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x220]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x210]
push dword [edi + 0x21c]
lea eax, [ebp - 0x20c]
push 0x4b152938
push 0x104
push eax
mov dword [ebp - 0x264], 0x44
call fcn.4b15763b
add esp, 0x10
test eax, eax
jge 0x4b15e0e1
and eax, 0xffff
mov ebx, eax
mov eax, dword [0x4b16c0b8]
cmp byte [eax + 0x19], 2
jb 0x4b15e1e2
push esi
push 0x12
jmp 0x4b15e033
mov eax, dword [0x4b16c0b8]
cmp byte [eax + 0x19], 2
jb 0x4b15e105
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [edi + 0x12]
push ecx
push esi
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.4b15b68f
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x264]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x4000020
push 1
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
add edi, 0x12
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4b15e170
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
mov ecx, ebx
jle 0x4b15e14f
and ecx, 0xffff
or ecx, 0x80070000
mov eax, dword [0x4b16c0b8]
cmp byte [eax + 0x19], 2
jb 0x4b15e1e2
push edi
push ecx
push esi
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.4b15872d
jmp 0x4b15e1e2
mov eax, dword [0x4b16c0b8]
cmp byte [eax + 0x19], 2
jb 0x4b15e191
lea ecx, [ebp - 0x20c]
push ecx
push edi
push esi
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.4b15b68f
cmp dword [ebp - 0x220], ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4b15e1a7
push dword [ebp - 0x220]
call edi
cmp dword [ebp - 0x21c], ebx
je 0x4b15e1b7
push dword [ebp - 0x21c]
call edi
mov ecx, dword [ebp - 0x210]
call fcn.4b15d5c1
mov ebx, eax
test ebx, ebx
je 0x4b15e1fb
mov eax, dword [0x4b16c0b8]
cmp byte [eax + 0x19], 2
jb 0x4b15e1e2
push ebx
push esi
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.4b156ac1
call sym.mmcbase.DLL_public:_static_struct_HWND______stdcall_mmcerror::SC::GetModalHWND_void_
test eax, eax
jne 0x4b15e1f0
mov eax, dword [sym.mmcbase.DLL_struct_HWND____mmcerror::SC::s_hWnd]
push eax
mov ecx, 0x4b16cfa8
call fcn.4b15b591
mov ecx, dword [ebp - 0x210]
call fcn.4b15df37
mov eax, dword [0x4b16c0b8]
cmp byte [eax + 0x19], 2
jb 0x4b15e21f
push esi
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.4b157041
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.4b163f8b
leave
ret