Function at 0x45e8c0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
mov eax, dword [0x50b3bc]
push ebx
xor ebx, ebx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x1a4], ebx
je 0x45e8e3
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [0x50b3a0]
push edi
add esi, 0xee4
mov ecx, 0x17
lea edi, [ebp - 0xbc]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x50b3a4]
lea edx, [ebp - 0xbc]
push edx
mov dword [ecx + 0xf320c], ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
cmp eax, ebx
jne 0x45e92f
mov eax, dword [0x50b3a4]
mov dword [eax + 0xf320c], 4
jmp 0x45ea2a
mov ecx, dword [0x50b3a4]
push eax
push ebx
call fcn.00450930
mov edi, eax
mov dword [ebp - 8], edi
cmp edi, ebx
jne 0x45e95a
mov ecx, dword [0x50b3a4]
mov dword [ecx + 0xf320c], 4
jmp 0x45ea2a
mov esi, dword [edi + 0xc8]
cmp word [esi], 0x40
je 0x45eb14
cmp byte [0x50b4d5], bl
jne 0x45e98f
mov edx, dword [edi + 4]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x1c]
push edx
push eax
push ecx
push esi
call fcn.004508e0
add esp, 0x10
test al, al
je 0x45eb14
cmp byte [edi + 0x44], 9
jne 0x45eb14
mov edx, dword [0x50b3a0]
add edx, 0xf00
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x45eb14
mov eax, dword [ebp - 4]
xor edi, edi
cmp dword [eax + 0xf38b0], ebx
jle 0x45ea1e
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0xf38bc]
add eax, esi
cmp dword [eax + 0x258], 0
jne 0x45e9f8
mov edx, dword [0x50b3a0]
add edx, 0xf00
push edx
add eax, 0x210
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x45e9f8
lea ebx, [eax + 1]
mov eax, dword [ebp - 4]
inc edi
add esi, 0x25c
cmp edi, dword [eax + 0xf38b0]
jl 0x45e9c4
test ebx, ebx
je 0x45ea1e
mov ecx, dword [0x50b3a4]
mov dword [ecx + 0xf320c], 1
mov edi, dword [ebp - 8]
push edi
call fcn.00441300
add esp, 4
mov eax, dword [0x50b3a4]
cmp dword [eax + 0xf320c], 0
jne 0x45ea5d
mov ecx, dword [0x50b3a0]
add ecx, 0xf00
push ecx
call fcn.00451640
add esp, 4
test al, al
jne 0x45ea5d
mov eax, dword [0x50b3a4]
or dword [eax + 0xf320c], 2
mov edx, dword [0x50b3a4]
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [edx + 0xf320c]
test al, 2
jne 0x45ea89
cmp byte [0x50b4d4], 0
je 0x45ec40
test eax, eax
je 0x45ec40
push 0x284
lea eax, [ebp - 0x340]
push 0
push eax
mov dword [ebp - 0x344], 0x22
call fcn.004b03e0
mov ecx, dword [0x50b39c]
add esp, 0xc
add ecx, 0x5c8
push ecx
push 0x144
lea edx, [ebp - 0x344]
push edx
call fcn.00401880
lea eax, [ebp - 0x344]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45ead0
sub eax, edx
sar eax, 1
lea esi, [ebp + eax*2 - 0x344]
mov edi, 0x4c0bb0
mov edx, 0x40
mov eax, esi
sub edi, esi
lea ecx, [edx + 0x7fffffbe]
test ecx, ecx
je 0x45eb29
movzx ecx, word [edi + eax]
test cx, cx
je 0x45eb29
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x45eaf4
jmp 0x45eb2d
mov edx, dword [0x50b3a4]
mov dword [edx + 0xf320c], 1
jmp 0x45ea21
test edx, edx
jne 0x45eb30
sub eax, 2
xor edx, edx
mov word [eax], dx
call fcn.004ad0f0
test eax, eax
je 0x45eb8d
lea eax, [ebp - 0x342]
push 0
push eax
call fcn.004acca0
add esp, 8
test eax, eax
jne 0x45eb8d
mov edi, 0x4c0bcc
mov edx, 0x40
mov eax, esi
sub edi, esi
lea ecx, [edx + 0x7fffffbe]
test ecx, ecx
je 0x45eb81
movzx ecx, word [edi + eax]
test cx, cx
je 0x45eb81
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x45eb61
jmp 0x45eb85
test edx, edx
jne 0x45eb88
sub eax, 2
xor edx, edx
mov word [eax], dx
push str.___CheckUnicode
push 0x144
lea eax, [ebp - 0x344]
push eax
call fcn.00401880
xor eax, eax
push 0x40
push eax
lea ecx, [ebp - 0x5c]
push ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x60], 0x44
call fcn.004b03e0
add esp, 0xc
xor edx, edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x60]
push ecx
push edx
push edx
push 0x4000030
push edx
push edx
push edx
mov word [ebp - 0x30], dx
lea edx, [ebp - 0x344]
push edx
push 0
mov dword [ebp - 0x34], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x45ec40
mov eax, dword [ebp - 0x1c]
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x45ec34
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0xc], 0x8e
jne 0x45ec40
mov eax, dword [0x50b3a4]
mov dword [eax + 0xf320c], 0
jmp 0x45ec40
mov ecx, dword [ebp - 0x1c]
push 0x64
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [0x50b3a4]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [edx + 0xf320c], eax
pop edi
sete al
pop esi
pop ebx
test eax, eax
mov dword [ecx + 0xf2dc4], eax
setne al
mov esp, ebp
pop ebp
ret