Function at 0x48a7c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4df93d
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x520404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x100
call fcn.0048f9f0
add esp, 4
test eax, eax
je 0x48a828
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
setg al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x48ac85
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
push 0x4e69d8
push 4
push 0
push 0x4e9370
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x48a957
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x48a95a
xor eax, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x20], eax
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
push 1
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 2
push edx
push 8
lea edx, [ebp - 0x6c]
push edx
push edx
push ecx
call dword [eax + 0x3c]
test eax, eax
mov eax, dword [ebp - 0x20]
jne 0x48a944
test eax, eax
je 0x48a944
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x4e69e8
push 0x4e9350
push eax
call dword [sym.imp.SHLWAPI.dll_IUnknown_QueryService]
mov esi, eax
test esi, esi
js 0x48a92e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x48a931
mov dword [ebp - 0x18], 0
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
push eax
mov byte [ebp - 4], 4
call dword [ecx + 0x3c]
mov esi, eax
mov eax, dword [ebp - 0x18]
test esi, esi
js 0x48a920
test eax, eax
je 0x48a920
mov ecx, dword [eax]
lea edx, [ebp - 0x28]
push edx
push 0x4e6a08
push eax
call dword [ecx]
mov esi, eax
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 3
test eax, eax
je 0x48a92e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 2
test eax, eax
je 0x48a93f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x20]
jmp 0x48a949
mov esi, 0x80004005
mov byte [ebp - 4], 1
test eax, eax
je 0x48a957
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x24]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x48a968
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
test esi, esi
js 0x48ac6b
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x48ac6b
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
push 0x4e671c
push 0
push eax
mov byte [ebp - 4], 6
call dword [ecx + 0x3c]
mov esi, eax
test esi, esi
js 0x48aa29
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x48aa2c
mov dword [ebp - 0x20], 0
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
push 0x4e69f8
push ecx
mov byte [ebp - 4], 7
call dword [eax]
mov esi, eax
test esi, esi
js 0x48aa18
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x48aa1b
mov dword [ebp - 0x24], 0
mov ecx, dword [eax]
lea edx, [ebp - 0x24]
push edx
push eax
mov byte [ebp - 4], 8
call dword [ecx + 0x1c]
mov esi, eax
mov eax, dword [ebp - 0x24]
test esi, esi
js 0x48aa0a
test eax, eax
je 0x48aa0a
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push 0x4e6a18
push eax
call dword [ecx]
mov esi, eax
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 7
test eax, eax
je 0x48aa18
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 6
test eax, eax
je 0x48aa29
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 5
test ecx, ecx
je 0x48aa3a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x14]
test esi, esi
js 0x48ac5d
test eax, eax
je 0x48ac5d
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
jne 0x48abfd
xor esi, esi
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 9
test eax, eax
jne 0x48ac12
xor edi, edi
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 0xa
test eax, eax
jne 0x48ac27
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov byte [ebp - 4], 0xb
test eax, eax
jne 0x48ac36
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0xc
test edi, edi
je 0x48ac45
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantClear]
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x3c]
push eax
call ebx
mov eax, 8
mov dword [ebp - 0x34], esi
mov word [ebp - 0x3c], ax
lea eax, [ebp - 0x5c]
push eax
call ebx
mov eax, 8
mov word [ebp - 0x5c], ax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x4c]
push eax
call ebx
mov eax, 8
mov word [ebp - 0x4c], ax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x6c]
push eax
call ebx
mov ebx, dword [ebp + 0x18]
sub esp, 0x10
mov edx, esp
mov dword [ebp - 0x64], ebx
mov eax, 3
sub esp, 0x10
mov word [ebp - 0x6c], ax
mov ecx, dword [ebp - 0x6c]
mov dword [edx], ecx
mov ecx, dword [ebp - 0x68]
mov dword [edx + 4], ecx
mov ecx, dword [ebp - 0x60]
mov dword [edx + 8], ebx
mov dword [edx + 0xc], ecx
mov edx, esp
mov ecx, dword [ebp - 0x3c]
sub esp, 0x10
mov eax, dword [ebp - 0x14]
mov dword [edx], ecx
mov ecx, dword [ebp - 0x38]
mov dword [edx + 4], ecx
mov ecx, dword [ebp - 0x34]
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0x30]
mov dword [edx + 0xc], ecx
mov edx, esp
mov ecx, dword [ebp - 0x4c]
sub esp, 0x10
mov dword [edx], ecx
mov ecx, dword [ebp - 0x48]
mov dword [edx + 4], ecx
mov ecx, dword [ebp - 0x44]
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0x40]
mov dword [edx + 0xc], ecx
mov edx, esp
mov ecx, dword [ebp - 0x5c]
mov dword [edx], ecx
mov ecx, dword [ebp - 0x58]
mov dword [edx + 4], ecx
mov ecx, dword [ebp - 0x54]
push edi
push eax
mov eax, dword [eax]
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0x50]
mov dword [edx + 0xc], ecx
call dword [eax + 0x7c]
push dword [ebp - 0x20]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
test eax, eax
setns byte [ebp - 0xd]
call ebx
push dword [ebp - 0x24]
call ebx
push edi
call ebx
push esi
call ebx
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0
test eax, eax
je 0x48abd4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x48abe8
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call ebx
mov esi, eax
mov dword [ebp - 0x2c], esi
test esi, esi
je 0x48ac99
jmp 0x48aa63
push eax
call ebx
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x48aca3
jmp 0x48aa77
push eax
call ebx
mov dword [ebp - 0x24], eax
test eax, eax
je 0x48acad
jmp 0x48aa89
push eax
call ebx
mov dword [ebp - 0x20], eax
test eax, eax
je 0x48acb7
jmp 0x48aa9b
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push eax
call edi
push dword [ebp - 0x24]
call edi
push 0
call edi
push esi
call edi
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0
test eax, eax
je 0x48ac6b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x48ac85
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x8007000e
call fcn.00477ec0
push 0x8007000e
call fcn.00477ec0
push 0x8007000e
call fcn.00477ec0
push 0x8007000e
call fcn.00477ec0
int3