Function at 0x4ccaf8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd84
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
movzx eax, word [esi]
cmp eax, 0x61
jb 0x4ccb15
sub eax, 0x20
cmp eax, 0x41
jb 0x4ccb26
cmp eax, 0x5a
ja 0x4ccb26
cmp word [esi + 2], 0x3a
je 0x4ccb44
push 0x2f
push esi
call fcn.004c4cc0
add esp, 8
test eax, eax
jne 0x4ccb44
push 0x5c
push esi
call fcn.004c4cc0
add esp, 8
test eax, eax
je 0x4ccb49
xor edx, edx
mov dword [ebp + 0x18], edx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
push 0x5c
push esi
call fcn.004c4cec
add esp, 8
mov edi, eax
test eax, eax
je 0x4ccb64
add edi, 2
jmp 0x4ccb66
mov edi, esi
push 0x2e
push edi
call fcn.004c4cec
add esp, 8
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4ccbce
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x21c]
push edx
push 0x5cfa6a
push ecx
push esi
call fcn.004cc90c
add esp, 0x10
mov edi, eax
test eax, eax
je 0x4ccc2d
push 0x5cfa6c
mov edx, dword [ebp - 0x10]
push edx
call fcn.004c4d48
add esp, 8
test eax, eax
je 0x4ccbc5
push 0x5cfa76
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004c4d48
add esp, 8
test eax, eax
jne 0x4ccc2d
mov dword [ebp - 0x14], 1
jmp 0x4ccc2d
mov eax, dword [ebp + 0x18]
lea edx, [ebp - 0x21c]
push eax
push str..EXE
push edx
push esi
call fcn.004cc90c
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x4ccc2d
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x21c]
push edx
push str..BAT
push ecx
push esi
call fcn.004cc90c
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x4ccc2d
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x21c]
push edx
push str..CMD
push ecx
push esi
call fcn.004cc90c
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x14], eax
test edi, edi
je 0x4ccc49
cmp dword [ebp - 0x14], 0
je 0x4ccc5b
push 0x5cfa9e
call fcn.004cb9f4
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x4ccc5b
mov dword [0x5cf8dc], 2
or eax, 0xffffffff
jmp 0x4ccf25
cmp dword [ebp - 0x14], 0
je 0x4ccc7a
mov edx, dword [ebp + 0x10]
push edx
push 0x5cfaae
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004cc994
add esp, 0xc
mov edi, eax
jmp 0x4ccc93
mov eax, dword [ebp + 0x10]
add eax, 4
push eax
push 0
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx]
push ecx
call fcn.004cc994
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x4ccca9
mov dword [0x5cf8dc], 8
or eax, 0xffffffff
jmp 0x4ccf25
cmp dword [ebp + 0x14], 0
jne 0x4cccb6
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4ccce0
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.004cca90
pop ecx
mov dword [ebp - 8], eax
test eax, eax
jne 0x4ccce0
mov dword [0x5cf8dc], 8
push edi
call fcn.00469a68
pop ecx
or eax, 0xffffffff
jmp 0x4ccf25
call dword [0x5cf93c]
push 0x44
push 0
lea edx, [ebp - 0x26c]
push edx
call fcn.004c485c
add esp, 0xc
mov dword [ebp - 0x26c], 0x44
mov word [ebp - 0x23c], 0xa
cmp dword [0x5ce3bc], 0
je 0x4ccd49
push 0
call dword [0x5ce3b4]
pop ecx
mov esi, eax
mov word [ebp - 0x23a], si
movzx eax, si
push eax
call fcn.004c3a64
pop ecx
mov dword [ebp - 0x238], eax
test eax, eax
je 0x4cccc7
mov edx, dword [ebp - 0x238]
push edx
call dword [0x5ce3b4]
pop ecx
mov dword [ebp - 0x228], 0xc
xor ecx, ecx
xor esi, esi
or esi, 0x400
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], 1
test bl, 0x20
je 0x4ccd77
or esi, 0x10
jmp 0x4ccd7f
test bl, 0x10
je 0x4ccd7f
or esi, 8
test bl, 0x40
je 0x4ccd8a
or esi, 0x200
test bl, 0x80
je 0x4ccd92
or esi, 4
test bh, 2
je 0x4ccd9f
or esi, 0x800
jmp 0x4ccdaa
test bh, 4
je 0x4ccdaa
or esi, 0x1000
test bh, 8
je 0x4ccdb5
or esi, 0x4000000
test bh, 0x20
je 0x4ccdbf
or esi, 0x20
jmp 0x4ccde1
test bh, 0x10
je 0x4ccdc9
or esi, 0x40
jmp 0x4ccde1
test bh, 0x40
je 0x4ccdd6
or esi, 0x80
jmp 0x4ccde1
test bh, 0x80
je 0x4ccde1
or esi, 0x100
lea eax, [ebp - 0x27c]
lea edx, [ebp - 0x26c]
push eax
push edx
push 0
lea eax, [ebp - 0x228]
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x228]
push ecx
push esi
push 1
push eax
push edx
push edi
cmp dword [ebp - 0x14], 0
je 0x4cce12
mov ecx, dword [ebp - 0xc]
jmp 0x4cce18
lea ecx, [ebp - 0x21c]
push ecx
call sub.KERNEL32.DLL_CreateProcessW
dec eax
je 0x4cce5f
call sub.KERNEL32.DLL_GetLastError
and eax, 0xffff
dec eax
je 0x4cce3f
sub eax, 7
je 0x4cce46
sub eax, 0x51
jne 0x4cce4d
mov eax, 0x2a
jmp 0x4cce52
mov eax, 0x13
jmp 0x4cce52
mov eax, 8
jmp 0x4cce52
mov eax, 0x15
mov dword [0x5cf8dc], eax
or esi, 0xffffffff
jmp 0x4ccf12
cmp ebx, 0x10
jne 0x4cce69
mov ebx, 4
mov eax, ebx
and eax, 7
sub eax, 1
jb 0x4cce80
je 0x4ccec5
dec eax
je 0x4ccee0
dec eax
sub eax, 2
jb 0x4cceb4
jmp 0x4ccef9
push 0xffffffffffffffff
mov edx, dword [ebp - 0x27c]
push edx
call sub.KERNEL32.DLL_WaitForSingleObject
lea ecx, [ebp - 4]
push ecx
mov eax, dword [ebp - 0x27c]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
test bh, 1
jne 0x4cceaf
mov edx, dword [ebp - 0x27c]
push edx
call sub.KERNEL32.DLL_CloseHandle
mov esi, dword [ebp - 4]
jmp 0x4ccefc
test bh, 1
jne 0x4ccec5
mov eax, dword [ebp - 0x27c]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov edx, dword [ebp - 0x27c]
push edx
mov ecx, dword [ebp - 0x274]
push ecx
call dword [0x5cfa30]
add esp, 8
mov esi, eax
jmp 0x4ccefc
mov eax, dword [ebp - 8]
push eax
call fcn.00469a68
pop ecx
push edi
call fcn.00469a68
pop ecx
push 0
call fcn.004cb94c
pop ecx
or esi, 0xffffffff
test bl, 0x80
jne 0x4ccf12
test bh, 1
jne 0x4ccf12
mov eax, dword [ebp - 0x278]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov edx, dword [ebp - 8]
push edx
call fcn.00469a68
pop ecx
push edi
call fcn.00469a68
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret