Function at 0x40539c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
mov eax, 0x4d26c8
push ebx
push esi
push edi
lea esi, [ebp - 0x3e0]
mov ebx, 0x4d35a0
call fcn.0049b8e0
mov word [esi + 0x10], 0x14
mov edx, 0x4e20d0
lea eax, [ebp - 4]
call fcn.004a7b10
inc dword [esi + 0x1c]
lea edx, [ebp - 0x7c]
mov word [esi + 0x10], 8
mov word [esi + 0x10], 0x20
mov dword [ebp - 0x13c], edx
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x12c], ecx
lea eax, [ebp - 0x7c]
push eax
call fcn.004031a8
pop ecx
lea edx, [ebp - 0x13c]
add dword [esi + 0x1c], 7
push 0
push 1
push edx
call fcn.00403214
add esp, 0xc
lea ecx, [ebx + 0xc]
add dword [esi + 0x1c], 3
mov dword [ebp - 0x138], ecx
lea eax, [ebx + 0x18]
mov dword [ebp - 0x128], eax
lea edx, [ebx + 0x24]
mov ecx, dword [ebp - 0x13c]
lea eax, [ebp - 0x124]
mov dword [ecx], edx
push eax
call fcn.00403384
pop ecx
lea edx, [ebp - 0x124]
add dword [esi + 0x1c], 4
push edx
mov ecx, dword [ebp - 0x13c]
push ecx
call fcn.004035ac
add esp, 8
inc dword [esi + 0x1c]
mov word [esi + 0x10], 8
mov word [esi + 0x10], 0x38
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x274], eax
lea edx, [ebp - 0x1b4]
mov dword [ebp - 0x264], edx
lea ecx, [ebp - 0x1b4]
push ecx
call fcn.004031a8
pop ecx
lea eax, [ebp - 0x274]
add dword [esi + 0x1c], 7
push 0
push 1
push eax
call fcn.00403214
add esp, 0xc
lea edx, [ebx + 0xc]
add dword [esi + 0x1c], 3
mov dword [ebp - 0x270], edx
lea ecx, [ebx + 0x18]
mov dword [ebp - 0x260], ecx
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0x274]
lea ecx, [ebp - 0x25c]
mov dword [edx], eax
push ecx
call fcn.00403384
pop ecx
lea eax, [ebp - 0x25c]
add dword [esi + 0x1c], 4
push eax
mov edx, dword [ebp - 0x274]
push edx
call fcn.004035ac
add esp, 8
inc dword [esi + 0x1c]
mov word [esi + 0x10], 8
mov word [esi + 0x10], 0x50
lea ecx, [ebp - 0x2ec]
mov dword [ebp - 0x3ac], ecx
lea eax, [ebp - 0x2ec]
mov dword [ebp - 0x39c], eax
lea edx, [ebp - 0x2ec]
push edx
call fcn.004031a8
pop ecx
add dword [esi + 0x1c], 7
push 0
push 1
lea ecx, [ebp - 0x3ac]
push ecx
call fcn.00403214
add esp, 0xc
lea eax, [ebx + 0xc]
add dword [esi + 0x1c], 3
mov dword [ebp - 0x3a8], eax
lea edx, [ebx + 0x18]
mov dword [ebp - 0x398], edx
lea ecx, [ebx + 0x24]
mov eax, dword [ebp - 0x3ac]
lea edx, [ebp - 0x394]
mov dword [eax], ecx
push edx
call fcn.00403384
pop ecx
add dword [esi + 0x1c], 4
lea ecx, [ebp - 0x394]
push ecx
mov eax, dword [ebp - 0x3ac]
push eax
call fcn.004035ac
add esp, 8
inc dword [esi + 0x1c]
mov word [esi + 0x10], 8
cmp dword [ebp - 4], 0
je 0x405594
mov eax, dword [ebp - 4]
jmp 0x405599
mov eax, 0x4d1695
mov ebx, eax
push 0xc
push ebx
lea eax, [ebp - 0xe0]
push eax
call fcn.004ae164
add esp, 0xc
test al, al
je 0x4055b9
lea edx, [ebp - 0x124]
jmp 0x4055bb
xor edx, edx
test edx, edx
jne 0x4055f8
mov ebx, dword [ebp - 0x13c]
mov edi, dword [ebx + 8]
or edi, 4
cmp dword [ebx + 0x6c], 0
je 0x4055d5
mov eax, edi
jmp 0x4055da
mov eax, edi
or eax, 1
mov dword [ebp - 0x3e4], eax
mov edx, dword [ebp - 0x3e4]
mov dword [ebx + 8], edx
mov ecx, dword [ebx + 8]
and ecx, dword [ebx + 0x14]
je 0x4055f8
push ebx
call fcn.004a9ec4
pop ecx
push 4
push 0
lea eax, [ebp - 0x13c]
push eax
call fcn.00403914
add esp, 0xc
lea edx, [ebp - 0x13c]
push edx
lea ecx, [ebp - 0x3f0]
push ecx
call fcn.00403ae0
add esp, 8
or byte [ebx - 0x3ef7b], cl
dec dword [ecx - 0x3e77b]
dec dword [ebp - 0x13b6b]
jmp [edx + 1]
push 0
push edx
call fcn.00403914
add esp, 0xc
mov ecx, dword [ebp - 0x3e8]
cmp ecx, dword [0x4d11b0]
jne 0x405786
lea eax, [ebp - 0x124]
push eax
call fcn.004042c8
pop ecx
test eax, eax
jne 0x40569c
mov ebx, dword [ebp - 0x13c]
mov edi, dword [ebx + 8]
or edi, 4
cmp dword [ebx + 0x6c], 0
je 0x405679
mov eax, edi
jmp 0x40567e
mov eax, edi
or eax, 1
mov dword [ebp - 0x3f4], eax
mov edx, dword [ebp - 0x3f4]
mov dword [ebx + 8], edx
mov ecx, dword [ebx + 8]
and ecx, dword [ebx + 0x14]
je 0x40569c
push ebx
call fcn.004a9ec4
pop ecx
dec dword [esi + 0x1c]
sub dword [esi + 0x1c], 4
mov word [esi + 0x10], 0x68
mov edx, 0x4d1696
lea eax, [ebp - 0x3b4]
call fcn.004a7ad8
inc dword [esi + 0x1c]
xor eax, eax
mov dword [ebp - 0x3b8], eax
mov eax, 0x4e20d0
inc dword [esi + 0x1c]
lea edx, [ebp - 0x3b4]
lea ecx, [ebp - 0x3b8]
call fcn.004a7c90
lea edx, [ebp - 0x3b8]
lea eax, [ebp - 4]
call fcn.004a7c68
dec dword [esi + 0x1c]
lea eax, [ebp - 0x3b8]
mov edx, 2
call fcn.004a7c38
dec dword [esi + 0x1c]
lea eax, [ebp - 0x3b4]
mov edx, 2
call fcn.004a7c38
cmp dword [ebp - 4], 0
je 0x4057ff
mov eax, dword [ebp - 4]
jmp 0x405804
mov eax, 0x4d169b
mov ebx, eax
push 0x14
push ebx
lea eax, [ebp - 0x218]
push eax
call fcn.004ae164
add esp, 0xc
test al, al
je 0x405824
lea edx, [ebp - 0x25c]
jmp 0x405826
xor edx, edx
test edx, edx
jne 0x405863
mov ebx, dword [ebp - 0x274]
mov edi, dword [ebx + 8]
or edi, 4
cmp dword [ebx + 0x6c], 0
je 0x405840
mov eax, edi
jmp 0x405845
mov eax, edi
or eax, 1
mov dword [ebp - 0x3f8], eax
mov edx, dword [ebp - 0x3f8]
mov dword [ebx + 8], edx
mov ecx, dword [ebx + 8]
and ecx, dword [ebx + 0x14]
je 0x405863
push ebx
call fcn.004a9ec4
pop ecx
push 4
call fcn.00499954
pop ecx
mov ebx, eax
mov word [esi + 0x10], 8
xor edi, edi
jmp 0x40588a
push 1
push ebx
lea eax, [ebp - 0x13c]
push eax
call fcn.00403b5c
add esp, 0xc
inc edi
cmp edi, dword [0x4d11b0]
jl 0x405877
mov word [esi + 0x10], 8
xor edi, edi
jmp 0x4058c1
push 1
push ebx
lea eax, [ebp - 0x13c]
push eax
call fcn.00403b5c
add esp, 0xc
lea edx, [ebp - 0x264]
push 1
push ebx
push edx
call fcn.00404060
add esp, 0xc
inc edi
mov ecx, dword [ebp - 0x3e8]
sub ecx, dword [0x4d11b0]
cmp edi, ecx
jl 0x40589c
lea eax, [ebp - 0x124]
push eax
call fcn.004042c8
pop ecx
test eax, eax
jne 0x40591b
mov ebx, dword [ebp - 0x13c]
mov edi, dword [ebx + 8]
or edi, 4
cmp dword [ebx + 0x6c], 0
je 0x4058f8
mov eax, edi
jmp 0x4058fd
mov eax, edi
or eax, 1
mov dword [ebp - 0x3fc], eax
mov edx, dword [ebp - 0x3fc]
mov dword [ebx + 8], edx
mov ecx, dword [ebx + 8]
and ecx, dword [ebx + 0x14]
je 0x40591b
push ebx
call fcn.004a9ec4
pop ecx
lea eax, [ebp - 0x25c]
push eax
call fcn.004042c8
pop ecx
test eax, eax
jne 0x405965
mov ebx, dword [ebp - 0x274]
mov edi, dword [ebx + 8]
or edi, 4
cmp dword [ebx + 0x6c], 0
je 0x405942
mov eax, edi
jmp 0x405947
mov eax, edi
or eax, 1
mov dword [ebp - 0x400], eax
mov edx, dword [ebp - 0x400]
mov dword [ebx + 8], edx
mov ecx, dword [ebx + 8]
and ecx, dword [ebx + 0x14]
je 0x405965
push ebx
call fcn.004a9ec4
pop ecx
mov word [esi + 0x10], 0x74
mov edx, str..bin
lea eax, [ebp - 0x3bc]
call fcn.004a7ad8
inc dword [esi + 0x1c]
xor eax, eax
mov dword [ebp - 0x3b0], eax
mov eax, 0x4e20d0
inc dword [esi + 0x1c]
lea edx, [ebp - 0x3bc]
lea ecx, [ebp - 0x3b0]
call fcn.004a7c90
dec dword [esi + 0x1c]
lea eax, [ebp - 0x3bc]
mov edx, 2
call fcn.004a7c38
mov word [esi + 0x10], 8
mov edx, 2
mov eax, dword [ebp - 0x3b0]
call fcn.00444620
push 5
cmp dword [ebp - 0x3b0], 0
je 0x4059db
mov ecx, dword [ebp - 0x3b0]
jmp 0x4059e0
mov ecx, 0x4d16a1
push ecx
call sub.KERNEL32.DLL_WinExec
mov dword [0x4d11ac], 1
dec dword [esi + 0x1c]
lea eax, [ebp - 0x3b0]
mov edx, 2
call fcn.004a7c38
dec dword [esi + 0x1c]
sub dword [esi + 0x1c], 4
push 2
lea eax, [ebp - 0x394]
push eax
call fcn.004046d8
add esp, 8
sub dword [esi + 0x1c], 0xa
push 0
lea edx, [ebp - 0x3ac]
push edx
call fcn.00404784
add esp, 8
dec dword [esi + 0x1c]
sub dword [esi + 0x1c], 6
push 0
lea ecx, [ebp - 0x2ec]
push ecx
call fcn.004aa150
add esp, 8
dec dword [esi + 0x1c]
sub dword [esi + 0x1c], 4
push 2
lea eax, [ebp - 0x25c]
push eax
call fcn.004046d8
add esp, 8
sub dword [esi + 0x1c], 0xa
push 0
lea edx, [ebp - 0x274]
push edx
call fcn.00404784
add esp, 8
dec dword [esi + 0x1c]
sub dword [esi + 0x1c], 6
push 0
lea ecx, [ebp - 0x1b4]
push ecx
call fcn.004aa150
add esp, 8
dec dword [esi + 0x1c]
sub dword [esi + 0x1c], 4
push 2
lea eax, [ebp - 0x124]
push eax
call fcn.004046d8
add esp, 8
sub dword [esi + 0x1c], 0xa
push 0
lea edx, [ebp - 0x13c]
push edx
call fcn.00404784
add esp, 8
dec dword [esi + 0x1c]
sub dword [esi + 0x1c], 6
push 0
lea ecx, [ebp - 0x7c]
push ecx
call fcn.004aa150
add esp, 8
dec dword [esi + 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004a7c38
mov ecx, dword [esi]
mov dword fs:[0], ecx