Function at 0x4f7130
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x18
push 0
push 0
dec ecx
jne 0x4f7138
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4f7b48
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004f6060
lea eax, [ebp - 4]
call fcn.00404a54
xor esi, esi
lea edx, [ebp - 0x10]
mov al, 1
call fcn.0049f368
call fcn.004f6f68
lea eax, [ebp - 0x20]
call fcn.00404a54
lea ecx, [ebp - 0x28]
xor edx, edx
mov eax, 0x4f7b60
call fcn.00434ee4
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x24]
xor edx, edx
call fcn.004306e4
mov eax, dword [ebp - 0x10]
call fcn.00409d68
test al, al
jne 0x4f71ae
lea eax, [ebp - 4]
mov ecx, 0x4f7b74
mov edx, dword [ebp - 0x10]
call fcn.00404d60
cmp dword [ebp - 4], 0
jne 0x4f7ac7
mov dl, 1
mov eax, dword [0x4a2258]
call fcn.004a2d48
mov edi, eax
test edi, edi
jne 0x4f71da
lea eax, [ebp - 4]
mov ecx, 0x4f7bac
mov edx, dword [ebp - 0x10]
call fcn.00404d60
cmp dword [ebp - 4], 0
jne 0x4f7ac7
mov cl, 1
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.004aa85c
mov eax, edi
call fcn.004f6ef0
lea edx, [ebp - 0x2c]
xor eax, eax
call fcn.004aae1c
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004aae0c
mov ecx, eax
mov eax, edi
pop edx
call fcn.004aa95c
lea eax, [ebp - 0x30]
call fcn.004aadf8
mov eax, dword [ebp - 0x30]
push eax
call fcn.004aae0c
push eax
call fcn.004aae14
mov edx, eax
pop ecx
pop eax
call fcn.0043df0c
mov eax, edi
call fcn.004a397c
mov byte [ebp - 0x12], al
mov eax, edi
call fcn.004a398c
mov ebx, eax
mov eax, edi
call fcn.004a3994
test al, al
jne 0x4f7284
mov eax, 0x4f7be8
call fcn.0043500c
test al, al
je 0x4f7264
mov byte [ebp - 0x12], 1
mov eax, 0x4f7bf8
call fcn.0043500c
test al, al
je 0x4f7274
mov bl, 1
mov al, byte [ebp - 0x12]
or al, bl
je 0x4f7284
mov dl, 1
mov eax, edi
call fcn.004a6138
mov eax, edi
call fcn.004a3a74
test al, al
je 0x4f72b2
call fcn.004359e8
push eax
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x34]
mov eax, edi
call fcn.004f6300
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov edx, 0x4f7c08
call fcn.00435f78
mov eax, edi
call fcn.004a39c4
test al, al
je 0x4f72cc
mov eax, 0x40
call fcn.0042f3a0
call fcn.0042f380
cmp dword [ebp - 4], 0
jne 0x4f72ea
mov eax, edi
call fcn.004f6de0
test al, al
je 0x4f72ea
lea eax, [ebp - 4]
mov edx, 0x4f7c1c
call fcn.00404aec
cmp dword [ebp - 4], 0
jne 0x4f7358
mov eax, edi
call fcn.004f6e94
test al, al
je 0x4f7358
lea eax, [ebp - 4]
mov edx, 0x4f7c74
call fcn.00404aec
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x4f7cc0
mov eax, 0x4f7cd4
call fcn.004aaed0
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 4]
call fcn.00404aec
push 0
push 0
push 0
lea eax, [ebp - 0x3c]
push eax
lea edx, [ebp - 0x40]
mov eax, edi
call fcn.004a3580
mov ecx, dword [ebp - 0x40]
mov edx, 0x4f7cec
mov eax, dword [ebp - 4]
call fcn.00431d28
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 4]
call fcn.00404aec
cmp dword [ebp - 4], 0
jne 0x4f7465
mov eax, edi
call fcn.004f6a64
test al, al
jne 0x4f7465
lea edx, [ebp - 0x44]
mov eax, edi
call fcn.004a35b0
cmp dword [ebp - 0x44], 0
je 0x4f73b4
lea edx, [ebp - 0x48]
mov eax, edi
call fcn.004a3580
push dword [ebp - 0x48]
push 0x4f7d00
lea edx, [ebp - 0x4c]
mov eax, edi
call fcn.004a35b0
push dword [ebp - 0x4c]
push 0x4f7d0c
lea eax, [ebp - 8]
mov edx, 4
call fcn.00404dd4
jmp 0x4f73be
lea edx, [ebp - 8]
mov eax, edi
call fcn.004a3580
lea eax, [ebp - 4]
mov edx, 0x4f7d18
call fcn.00404aec
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x4f7d6c
mov eax, 0x4f7cd4
call fcn.004aaed0
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 4]
call fcn.00404aec
push 0
push 0
push 0
lea eax, [ebp - 0x54]
push eax
lea edx, [ebp - 0x5c]
mov al, 1
call fcn.00433284
push dword [ebp - 0x5c]
push 0x4f7d00
lea eax, [ebp - 0x60]
call fcn.00433328
push dword [ebp - 0x60]
push 0x4f7d0c
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00404dd4
mov ecx, dword [ebp - 0x58]
mov edx, 0x4f7d7c
mov eax, dword [ebp - 4]
call fcn.00431d28
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 4]
call fcn.00404aec
push 0
push 0
push 0
lea eax, [ebp - 0x64]
push eax
mov ecx, dword [ebp - 8]
mov edx, 0x4f7cec
mov eax, dword [ebp - 4]
call fcn.00431d28
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 4]
call fcn.00404aec
cmp dword [ebp - 4], 0
jne 0x4f74cf
mov eax, edi
call fcn.004a39ac
push eax
mov eax, edi
call fcn.004a399c
pop edx
call fcn.0049c164
test al, al
jne 0x4f74cf
mov eax, 0x65
call fcn.0049ebd8
test bl, bl
je 0x4f74a1
lea eax, [ebp - 4]
mov edx, 0x4f7d90
call fcn.00404aec
jmp 0x4f74cf
lea eax, [ebp - 4]
mov edx, 0x4f7d9c
call fcn.00404aec
lea eax, [ebp - 0x68]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x4f7df8
mov eax, 0x4f7cd4
call fcn.004aaed0
mov edx, dword [ebp - 0x68]
lea eax, [ebp - 4]
call fcn.00404aec
cmp dword [ebp - 4], 0
jne 0x4f75ae
mov edx, 0x4f7e0c
mov eax, edi
call fcn.004f658c
test al, al
je 0x4f75ae
lea eax, [ebp - 4]
mov edx, 0x4f7e2c
call fcn.00404aec
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x4f7e90
mov eax, 0x4f7cd4
call fcn.004aaed0
mov edx, dword [ebp - 0x6c]
lea eax, [ebp - 4]
call fcn.00404aec
push 0
push 0
push 0
lea eax, [ebp - 0x70]
push eax
lea edx, [ebp - 0x74]
mov eax, edi
call fcn.004a3580
mov ecx, dword [ebp - 0x74]
mov edx, 0x4f7cec
mov eax, dword [ebp - 4]
call fcn.00431d28
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 4]
call fcn.00404aec
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x4f7eb0
mov edx, 0x4f7eb0
mov eax, 0x4f7ec0
call fcn.004aaed0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x4f7ed0
mov edx, 0x4f7f08
mov eax, 0x4f7ec0
call fcn.004aaed0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004aae0c
push eax
push 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.0043120c
test al, al
je 0x4f75a1
lea eax, [ebp - 4]
call fcn.00404a54
jmp 0x4f75ae
lea eax, [ebp - 4]
mov edx, 0x4f7d90
call fcn.00404aec
cmp dword [ebp - 4], 0
jne 0x4f7621
mov edx, 0x4f7f18
mov eax, edi
call fcn.004f658c
test al, al
je 0x4f7621
lea eax, [ebp - 4]
mov edx, 0x4f7f38
call fcn.00404aec
lea eax, [ebp - 0x78]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x4f7f98
mov eax, 0x4f7cd4
call fcn.004aaed0
mov edx, dword [ebp - 0x78]
lea eax, [ebp - 4]
call fcn.00404aec
push 0
push 0
push 0
lea eax, [ebp - 0x7c]
push eax
lea edx, [ebp - 0x80]
mov eax, edi
call fcn.004a3580
mov ecx, dword [ebp - 0x80]
mov edx, 0x4f7cec
mov eax, dword [ebp - 4]
call fcn.00431d28
mov edx, dword [ebp - 0x7c]
lea eax, [ebp - 4]
call fcn.00404aec
cmp dword [ebp - 4], 0
jne 0x4f76ff
mov edx, 0x4f7fb4
mov eax, edi
call fcn.004f658c
test al, al
je 0x4f76ff
lea eax, [ebp - 4]
mov edx, 0x4f7fd8
call fcn.00404aec
lea eax, [ebp - 0x84]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x4f8024
mov eax, 0x4f7cd4
call fcn.004aaed0
mov edx, dword [ebp - 0x84]
lea eax, [ebp - 4]
call fcn.00404aec
push 0
push 0
push 0
lea eax, [ebp - 0x88]
push eax
lea edx, [ebp - 0x8c]
mov eax, edi
call fcn.004a3580
mov ecx, dword [ebp - 0x8c]
mov edx, 0x4f7cec
mov eax, dword [ebp - 4]
call fcn.00431d28
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 4]
call fcn.00404aec
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x4f803c
mov edx, 0x4f803c
mov eax, 0x4f7ec0
call fcn.004aaed0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x4f7ed0
mov edx, 0x4f7f08
mov eax, 0x4f7ec0
call fcn.004aaed0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004aae0c
push eax
push 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.00431178
lea eax, [ebp - 4]
call fcn.00404a54
cmp dword [ebp - 4], 0
jne 0x4f7722
mov edx, 0x4f8050
mov eax, edi
call fcn.004f658c
test al, al
je 0x4f7722
lea eax, [ebp - 4]
mov edx, 0x4f7d90
call fcn.00404aec
cmp dword [ebp - 4], 0
jne 0x4f77a2
mov eax, edi
call fcn.004f68f4
test al, al
jne 0x4f77a2
lea eax, [ebp - 4]
mov edx, 0x4f806c
call fcn.00404aec
lea eax, [ebp - 0x90]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x4f80e4
mov eax, 0x4f7cd4
call fcn.004aaed0
mov edx, dword [ebp - 0x90]
lea eax, [ebp - 4]
call fcn.00404aec
push 0
push 0
push 0
lea eax, [ebp - 0x94]
push eax
lea edx, [ebp - 0x98]
mov eax, edi
call fcn.004a3580
mov ecx, dword [ebp - 0x98]
mov edx, 0x4f7cec
mov eax, dword [ebp - 4]
call fcn.00431d28
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 4]
call fcn.00404aec
cmp dword [ebp - 4], 0
jne 0x4f7ac0
mov eax, edi
call fcn.004a397c
mov byte [ebp - 0x12], al
mov eax, edi
call fcn.004a398c
mov ebx, eax
mov eax, edi
call fcn.004a3994
test al, al
jne 0x4f77fc
mov eax, 0x4f7be8
call fcn.0043500c
test al, al
je 0x4f77dc
mov byte [ebp - 0x12], 1
mov eax, 0x4f7bf8
call fcn.0043500c
test al, al
je 0x4f77ec
mov bl, 1
mov al, byte [ebp - 0x12]
or al, bl
je 0x4f77fc
mov dl, 1
mov eax, edi
call fcn.004a6138
cmp dword [ebp - 0x20], 0
je 0x4f780a
mov eax, dword [ebp - 0x20]
call fcn.004dc0ec
cmp dword [ebp - 0x24], 0
je 0x4f7818
mov eax, dword [ebp - 0x24]
call fcn.004dc0ec
mov eax, edi
call fcn.004f6124
mov eax, edi
call fcn.004f6b0c
mov eax, edi
call fcn.004f63c0
mov byte [ebp - 0x11], 0
mov eax, dword [0x4fdd78]
mov eax, dword [eax]
call fcn.0048a388
xor eax, eax
call fcn.0049ebe8
mov eax, edi
call fcn.004a3644
test al, al
je 0x4f78a7
cmp byte [0x4fd9f8], 0
jne 0x4f78a7
test bl, bl
jne 0x4f78a7
mov ecx, dword [0x4fde78]
mov eax, dword [0x4fdd78]
mov eax, dword [eax]
mov edx, dword [0x4efd3c]
call fcn.0048a3a0
mov eax, dword [0x4fde78]
mov eax, dword [eax]
mov dword [eax + 0x30c], edi
mov eax, edi
call fcn.004a364c
test al, al
jne 0x4f789a
mov eax, dword [0x4fde78]
mov eax, dword [eax]
xor edx, edx
call fcn.0048411c
mov esi, dword [0x4fde78]
mov esi, dword [esi]
jmp 0x4f792c
mov ecx, dword [0x4fdde0]
mov eax, dword [0x4fdd78]
mov eax, dword [eax]
mov edx, dword [0x4db4d8]
call fcn.0048a3a0
test bl, bl
je 0x4f78cf
mov eax, dword [0x4fdde0]
mov eax, dword [eax]
call fcn.004dc0c8
cmp byte [0x4fd9f8], 0
je 0x4f78e4
mov eax, dword [0x4fdde0]
mov eax, dword [eax]
call fcn.004dc0c0
mov eax, dword [0x4fdde0]
mov eax, dword [eax]
mov dword [eax + 0x4ec], edi
mov eax, dword [0x4fdde0]
mov eax, dword [eax]
call fcn.004eb46c
lea edx, [ebp - 0x11]
mov eax, dword [0x4fdde0]
mov eax, dword [eax]
call fcn.004ec410
cmp byte [ebp - 0x11], 0
je 0x4f791e
mov eax, dword [0x4fdde0]
mov eax, dword [eax]
call fcn.00403c40
cmp byte [ebp - 0x11], 0
jne 0x4f792c
mov esi, dword [0x4fdde0]
mov esi, dword [esi]
lea edx, [ebp - 0x9c]
mov eax, edi
call fcn.004a3614
mov eax, dword [ebp - 0x9c]
mov edx, 0x4f80fc
call fcn.00404e60
jne 0x4f7978
lea edx, [ebp - 0xa0]
mov eax, edi
call fcn.004a35fc
mov eax, dword [ebp - 0xa0]
push eax
lea eax, [ebp - 0xa4]
call fcn.004a2114
mov edx, dword [ebp - 0xa4]
pop eax
call fcn.00404e60
je 0x4f799b
lea edx, [ebp - 0xa8]
mov eax, edi
call fcn.004a3614
mov eax, dword [ebp - 0xa8]
mov edx, 0x4f8108
call fcn.00404e60
je 0x4f799b
xor eax, eax
jmp 0x4f799d
mov al, 1
test al, al
je 0x4f79b7
lea eax, [ebp - 0xac]
call fcn.0049f78c
mov eax, dword [ebp - 0xac]
call fcn.004d9a84
test bl, bl
jne 0x4f79e2
mov ecx, dword [0x4fdb98]
mov eax, dword [0x4fdd78]
mov eax, dword [eax]
mov edx, dword [0x4f5cbc]
call fcn.0048a3a0
mov edx, 0x4f5fe4
mov eax, 0x4f5ef8
call fcn.0049ce88
cmp byte [ebp - 0x11], 0
jne 0x4f79f4
mov eax, dword [0x4fdd78]
mov eax, dword [eax]
call fcn.0048a420
lea eax, [ebp - 0xc]
call fcn.004dc1e8
cmp dword [ebp - 0xc], 0
je 0x4f7a65
lea eax, [ebp - 0xb0]
call fcn.004dc2a8
cmp dword [ebp - 0xb0], 0
je 0x4f7a2e
lea eax, [ebp - 0xb4]
call fcn.004dc2a8
mov eax, dword [ebp - 0xb4]
call fcn.0040a7fc
jmp 0x4f7a47
lea edx, [ebp - 0xb8]
mov eax, dword [ebp - 0xc]
call fcn.0040a1cc
mov eax, dword [ebp - 0xb8]
call fcn.0040a7fc
lea eax, [ebp - 0xbc]
call fcn.004dc248
mov edx, dword [ebp - 0xbc]
mov ecx, 5
mov eax, dword [ebp - 0xc]
call fcn.0042f744
lea eax, [ebp - 0xc]
call fcn.004dc308
cmp dword [ebp - 0xc], 0
je 0x4f7a9c
lea edx, [ebp - 0xc0]
mov eax, dword [ebp - 0xc]
call fcn.0040a1cc
mov eax, dword [ebp - 0xc0]
call fcn.0040a7fc
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404f14
push eax
call sub.KERNEL32.DLL_WinExec
call fcn.004dc368
test al, al
je 0x4f7ac0
test esi, esi
je 0x4f7ab0
mov eax, esi
call fcn.00486ca8
push 0
push 0x64
xor eax, eax
call fcn.00430d04
call fcn.0043512c
mov eax, edi
call fcn.00403c40
mov eax, dword [ebp - 4]
mov edx, 0x4f7d90
call fcn.00404e60
jbe 0x4f7b1d
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x4f8114
mov edx, 0x4f8114
mov eax, 0x4f7ec0
call fcn.004aaed0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x4f7ed0
mov edx, 0x4f7f08
mov eax, 0x4f7ec0
call fcn.004aaed0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004aae0c
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.004310e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7b4f
lea eax, [ebp - 0xc0]
mov edx, 0x2b
call fcn.00404a78
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404a78
ret