Function at 0x4dc5e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
push esi
push edi
lea edi, [ebp - 0x194]
mov ecx, 0x65
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 0x30], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0xc]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0x14]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 0x18]
cmp dword [eax + 0x24], 0
je 0x4dc643
cmp dword [0x5a51dc], 0x1e
jl 0x4dc643
mov ecx, dword [ebp - 0x30]
or ecx, 8
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
cmp eax, 0x22
jne 0x4dc671
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00523ac0
add esp, 4
sub eax, 2
push eax
mov edx, dword [ebp + 0xc]
add edx, 1
push edx
mov eax, dword [ebp + 0x1c]
push eax
call fcn.00499250
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x18]
cmp dword [ecx + 0x20], 1
je 0x4dc687
mov edx, dword [ebp + 0x18]
cmp dword [edx + 0x20], 2
jne 0x4dc70f
mov dword [ebp - 0x38], 0
mov eax, dword [ebp + 0x1c]
push eax
push 0x10
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x18]
mov eax, dword [edx + 0x1c]
push eax
lea ecx, [ebp - 0x38]
push ecx
call fcn.0045a620
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4dc707
mov edx, dword [ebp + 0x18]
cmp dword [edx + 0x28], 0
je 0x4dc6ff
push 0
mov eax, dword [ebp + 0xc]
push eax
push str._progname:
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0x1c]
push edx
push str._currdir:
push str.filepath_merge_failed.
mov eax, dword [ebp + 0x1c]
push eax
call fcn.00499390
add esp, 0x1c
mov esi, esp
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 0x28]
call ecx
add esp, 0xc
cmp esi, esp
call fcn.0052354c
mov eax, dword [ebp - 4]
jmp 0x4dd6b2
mov edx, dword [ebp - 0x38]
mov dword [ebp + 0xc], edx
jmp 0x4dc73d
mov dword [ebp - 0x44], 0
mov eax, dword [ebp + 0x1c]
push eax
push 0x10
mov ecx, dword [ebp + 0xc]
push ecx
push 0x5a5756
lea edx, [ebp - 0x44]
push edx
call fcn.0045a620
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4dc73d
mov eax, dword [ebp - 0x44]
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004dd820
add esp, 4
test eax, eax
je 0x4dc76e
push 0
push str.___
mov edx, dword [ebp + 0xc]
push edx
push 0x5a0620
mov eax, dword [ebp + 0x1c]
push eax
call fcn.00499390
add esp, 0x14
mov dword [ebp - 0xc], eax
jmp 0x4dc774
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], 0x5a5757
mov dword [ebp - 8], 1
jmp 0x4dc78d
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
je 0x4dc81d
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + eax*4], 0
je 0x4dc81d
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.004dd820
add esp, 4
test eax, eax
jne 0x4dc7c9
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + edx*4]
movsx edx, byte [ecx]
test edx, edx
jne 0x4dc7f4
push 0
push 0x5a0624
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + eax*4]
push edx
push 0x5a0628
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.00499390
add esp, 0x18
mov dword [ebp - 0x10], eax
jmp 0x4dc818
push 0
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + edx*4]
push ecx
push 0x5a062c
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x1c]
push eax
call fcn.00499390
add esp, 0x14
mov dword [ebp - 0x10], eax
jmp 0x4dc784
mov ecx, dword [ebp + 0x18]
cmp dword [ecx + 0x20], 0
je 0x4dc833
mov edx, dword [ebp + 0x18]
cmp dword [edx + 0x20], 4
jne 0x4dc961
push 0x5a0630
call fcn.005294dc
add esp, 4
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x4dc87b
mov eax, dword [ebp + 0x18]
cmp dword [eax + 0x28], 0
je 0x4dc871
mov esi, esp
push 0x5a0638
push 0x16
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
mov eax, dword [edx + 0x28]
call eax
add esp, 0xc
cmp esi, esp
call fcn.0052354c
mov eax, 0x16
jmp 0x4dd6b2
mov ecx, dword [ebp - 0x4c]
movsx edx, byte [ecx]
cmp edx, 0x22
jne 0x4dc8ab
mov eax, dword [ebp - 0x4c]
push eax
call fcn.00523ac0
add esp, 4
sub eax, 2
push eax
mov ecx, dword [ebp - 0x4c]
add ecx, 1
push ecx
mov edx, dword [ebp + 0x1c]
push edx
call fcn.00499250
mov dword [ebp + 0xc], eax
jmp 0x4dc8e0
mov eax, dword [ebp - 0x4c]
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.004dd820
add esp, 4
test eax, eax
je 0x4dc8e0
push 0
push 0x5a0654
mov edx, dword [ebp - 0x4c]
push edx
push 0x5a0658
mov eax, dword [ebp + 0x1c]
push eax
call fcn.00499390
add esp, 0x14
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00523ac0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jb 0x4dc935
push 0x5a065c
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
lea ecx, [eax + edx - 0xb]
push ecx
call fcn.00537613
add esp, 8
test eax, eax
jne 0x4dc935
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0x5a0668
mov ecx, dword [ebp - 0x4c]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
call fcn.00499390
add esp, 0x18
mov dword [ebp - 0x10], eax
jmp 0x4dc95c
push 0
push 0x5a0670
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0x5a0674
mov edx, dword [ebp - 0x4c]
push edx
mov eax, dword [ebp + 0x1c]
push eax
call fcn.00499390
add esp, 0x1c
mov dword [ebp - 0x10], eax
jmp 0x4dcb56
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00523ac0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jb 0x4dcb2d
push str..bat
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
lea ecx, [eax + edx - 4]
push ecx
call fcn.00537613
add esp, 8
test eax, eax
je 0x4dc9b6
push str..cmd
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
lea ecx, [eax + edx - 4]
push ecx
call fcn.00537613
add esp, 8
test eax, eax
jne 0x4dcb2d
push str.COMSPEC
call fcn.005294dc
add esp, 4
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x4dc9fe
mov edx, dword [ebp + 0x18]
cmp dword [edx + 0x28], 0
je 0x4dc9f4
mov esi, esp
push str.COMSPEC_envar_is_not_set
push 0x16
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0x28]
call edx
add esp, 0xc
cmp esi, esp
call fcn.0052354c
mov eax, 0x16
jmp 0x4dd6b2
mov eax, dword [ebp - 0x50]
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x4dca2e
mov edx, dword [ebp - 0x50]
push edx
call fcn.00523ac0
add esp, 4
sub eax, 2
push eax
mov eax, dword [ebp - 0x50]
add eax, 1
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.00499250
mov dword [ebp + 0xc], eax
jmp 0x4dca63
mov edx, dword [ebp - 0x50]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 0x50]
push eax
call fcn.004dd820
add esp, 4
test eax, eax
je 0x4dca63
push 0
push 0x5a06b0
mov ecx, dword [ebp - 0x50]
push ecx
push 0x5a06b4
mov edx, dword [ebp + 0x1c]
push edx
call fcn.00499390
add esp, 0x14
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00523ac0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jb 0x4dcab8
push str.command.com
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx - 0xb]
push eax
call fcn.00537613
add esp, 8
test eax, eax
jne 0x4dcab8
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push str.__C
mov eax, dword [ebp - 0x50]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.00499390
add esp, 0x18
mov dword [ebp - 0x10], eax
jmp 0x4dcb2b
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x1c]
push eax
call fcn.004dd870
add esp, 8
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
cmp edx, 0x22
je 0x4dcb04
push 0
push 0x5a06cc
mov eax, dword [ebp - 0x10]
push eax
push 0x5a06d0
mov ecx, dword [ebp - 0xc]
push ecx
push str.__C___
mov edx, dword [ebp - 0x50]
push edx
mov eax, dword [ebp + 0x1c]
push eax
call fcn.00499390
add esp, 0x20
mov dword [ebp - 0x10], eax
jmp 0x4dcb2b
push 0
push 0x5a06dc
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push str.__C__
mov eax, dword [ebp - 0x50]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.00499390
add esp, 0x1c
mov dword [ebp - 0x10], eax
jmp 0x4dcb56
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.00499390
add esp, 0x10
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0x18]
cmp dword [edx + 0x20], 3
jne 0x4dcb56
mov dword [ebp + 0xc], 0
cmp dword [ebp + 0x14], 0
je 0x4dcb6e
mov eax, dword [ebp + 0x18]
cmp dword [eax + 0x20], 2
je 0x4dcb6e
mov ecx, dword [ebp + 0x18]
cmp dword [ecx + 0x20], 4
jne 0x4dcb7a
mov dword [ebp - 0x14], 0
jmp 0x4dcd55
mov dword [ebp - 8], 0
mov dword [ebp - 0x58], 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0x14]
cmp dword [eax + edx*4], 0
je 0x4dcbbb
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + ecx*4]
push eax
call fcn.00523ac0
add esp, 4
mov ecx, dword [ebp - 0x58]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x4dcb88
cmp dword [ebp - 8], 0
jne 0x4dcbca
mov ecx, dword [ebp - 0x58]
add ecx, 1
mov dword [ebp - 0x58], ecx
cmp dword [0x5a51dc], 0x14
jl 0x4dccdc
mov edx, dword [ebp - 0x58]
shl edx, 1
push edx
mov eax, dword [ebp + 0x1c]
push eax
call fcn.00497ff0
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x30]
or ecx, 0x400
mov dword [ebp - 0x30], ecx
mov dword [ebp - 8], 0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x60], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + eax*4], 0
je 0x4dccbb
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.00523ac0
add esp, 4
add eax, 1
mov dword [ebp - 0x68], eax
lea edx, [ebp - 0x58]
push edx
mov eax, dword [ebp - 0x60]
push eax
lea ecx, [ebp - 0x68]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.004b3240
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4dcc99
mov edx, dword [ebp + 0x18]
cmp dword [edx + 0x28], 0
je 0x4dcc91
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + eax*4]
push edx
push str.utf8_to_ucs2_conversion_failed_on_this_string:
mov eax, dword [ebp + 0x1c]
push eax
call fcn.00499390
add esp, 0x10
mov esi, esp
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 0x28]
call ecx
add esp, 0xc
cmp esi, esp
call fcn.0052354c
mov eax, dword [ebp - 4]
jmp 0x4dd6b2
push 0
mov edx, dword [ebp - 0x60]
push edx
call fcn.005264ed
add esp, 8
add eax, 2
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x4dcc02
cmp dword [ebp - 8], 0
jne 0x4dccd2
mov ecx, dword [ebp - 0x60]
mov word [ecx], 0
mov edx, dword [ebp - 0x60]
add edx, 2
mov dword [ebp - 0x60], edx
mov eax, dword [ebp - 0x60]
mov word [eax], 0
jmp 0x4dcd55
mov ecx, dword [ebp - 0x58]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
call fcn.00497ff0
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x14]
cmp dword [edx + ecx*4], 0
je 0x4dcd3a
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + eax*4]
push edx
mov eax, dword [ebp - 0x70]
push eax
call fcn.00526a50
add esp, 8
push 0
mov ecx, dword [ebp - 0x70]
push ecx
call fcn.00525b20
add esp, 8
add eax, 1
mov dword [ebp - 0x70], eax
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x4dccf9
cmp dword [ebp - 8], 0
jne 0x4dcd4f
mov eax, dword [ebp - 0x70]
mov byte [eax], 0
mov ecx, dword [ebp - 0x70]
add ecx, 1
mov dword [ebp - 0x70], ecx
mov edx, dword [ebp - 0x70]
mov byte [edx], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0x10], ecx
cmp dword [0x5a51dc], 0x14
jl 0x4dd47e
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xec], 0
cmp dword [ebp + 0xc], 0
je 0x4dce59
mov edx, dword [ebp + 0xc]
push edx
call fcn.00523ac0
add esp, 4
add eax, 1
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xf4]
add eax, 6
mov dword [ebp - 0x100], eax
mov ecx, dword [ebp - 0x100]
shl ecx, 1
push ecx
mov edx, dword [ebp + 0x1c]
push edx
call fcn.00497ff0
mov dword [ebp - 0xe4], eax
lea eax, [ebp - 0x100]
push eax
mov ecx, dword [ebp - 0xe4]
push ecx
lea edx, [ebp - 0xf4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004b3240
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4dce59
mov ecx, dword [ebp + 0x18]
cmp dword [ecx + 0x28], 0
je 0x4dce51
push 0
mov edx, dword [ebp + 0xc]
push edx
push str.utf8_to_ucs2_conversion_failed_on_progname:
mov eax, dword [ebp + 0x1c]
push eax
call fcn.00499390
add esp, 0x10
mov esi, esp
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 0x28]
call ecx
add esp, 0xc
cmp esi, esp
call fcn.0052354c
mov eax, dword [ebp - 4]
jmp 0x4dd6b2
cmp dword [ebp - 0x10], 0
je 0x4dcf08
mov edx, dword [ebp - 0x10]
push edx
call fcn.00523ac0
add esp, 4
add eax, 1
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x118]
shl ecx, 1
push ecx
mov edx, dword [ebp + 0x1c]
push edx
call fcn.00497ff0
mov dword [ebp - 0xe8], eax
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp - 0xe8]
push ecx
lea edx, [ebp - 0x10c]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.004b3240
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4dcf08
mov ecx, dword [ebp + 0x18]
cmp dword [ecx + 0x28], 0
je 0x4dcf00
push 0
mov edx, dword [ebp - 0x10]
push edx
push str.utf8_to_ucs2_conversion_failed_on_cmdline:
mov eax, dword [ebp + 0x1c]
push eax
call fcn.00499390
add esp, 0x10
mov esi, esp
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 0x28]
call ecx
add esp, 0xc
cmp esi, esp
call fcn.0052354c
mov eax, dword [ebp - 4]
jmp 0x4dd6b2
mov edx, dword [ebp + 0x18]
cmp dword [edx + 0x1c], 0
je 0x4dcfc3
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 0x1c]
push ecx
call fcn.00523ac0
add esp, 4
add eax, 1
mov dword [ebp - 0x124], eax
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0x130], edx
mov eax, dword [ebp - 0x124]
shl eax, 1
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.00497ff0
mov dword [ebp - 0xec], eax
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 0xec]
push eax
lea ecx, [ebp - 0x124]
push ecx
mov edx, dword [ebp + 0x18]
mov eax, dword [edx + 0x1c]
push eax
call fcn.004b3240
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4dcfc3
mov ecx, dword [ebp + 0x18]
cmp dword [ecx + 0x28], 0
je 0x4dcfbb
push 0
mov edx, dword [ebp + 0x18]
mov eax, dword [edx + 0x1c]
push eax
push str.utf8_to_ucs2_conversion_failed_on_currdir:
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.00499390
add esp, 0x10
mov esi, esp
push eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0x28]
call edx
add esp, 0xc
cmp esi, esp
call fcn.0052354c
mov eax, dword [ebp - 4]
jmp 0x4dd6b2
push 0x44
push 0
lea eax, [ebp - 0xb8]
push eax
call fcn.00523be0
add esp, 0xc
mov dword [ebp - 0xb8], 0x44
mov ecx, dword [ebp + 0x18]
cmp dword [ecx + 0x24], 0
je 0x4dd001
mov edx, dword [ebp - 0x8c]
or edx, 1
mov dword [ebp - 0x8c], edx
mov word [ebp - 0x88], 0
mov esi, esp
push 0x5a5704
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp esi, esp
call fcn.0052354c
mov eax, dword [ebp + 0x18]
cmp dword [eax + 8], 0
je 0x4dd02a
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 8]
cmp dword [edx + 4], 0
jne 0x4dd05c
mov eax, dword [ebp + 0x18]
cmp dword [eax + 0x10], 0
je 0x4dd03f
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0x10]
cmp dword [edx + 4], 0
jne 0x4dd05c
mov eax, dword [ebp + 0x18]
cmp dword [eax + 0x18], 0
je 0x4dd23e
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0x18]
cmp dword [edx + 4], 0
je 0x4dd23e
mov eax, dword [ebp - 0x8c]
or eax, 0x100
mov dword [ebp - 0x8c], eax
mov esi, esp
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp esi, esp
call fcn.0052354c
mov dword [ebp - 0x80], eax
mov esi, esp
lea ecx, [ebp - 0xc4]
push ecx
mov edx, dword [ebp - 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
cmp esi, esp
call fcn.0052354c
test eax, eax
je 0x4dd0c7
mov eax, dword [ebp - 0xc4]
and eax, 1
mov dword [ebp - 0xc4], eax
je 0x4dd0c7
mov esi, esp
push 0
push 1
mov ecx, dword [ebp - 0x80]
push ecx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
cmp esi, esp
call fcn.0052354c
mov edx, dword [ebp + 0x18]
cmp dword [edx + 8], 0
je 0x4dd101
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 8]
cmp dword [ecx + 4], 0
je 0x4dd101
mov edx, dword [ebp + 0x18]
mov eax, dword [edx + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x80], ecx
mov esi, esp
push 1
push 1
mov edx, dword [ebp - 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
cmp esi, esp
call fcn.0052354c
jmp 0x4dd108
mov dword [ebp - 0x80], 0xffffffff
mov esi, esp
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp esi, esp
call fcn.0052354c
mov dword [ebp - 0x7c], eax
mov esi, esp
lea eax, [ebp - 0xd0]
push eax
mov ecx, dword [ebp - 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
cmp esi, esp
call fcn.0052354c
test eax, eax
je 0x4dd162
mov edx, dword [ebp - 0xd0]
and edx, 1
mov dword [ebp - 0xd0], edx
je 0x4dd162
mov esi, esp
push 0
push 1
mov eax, dword [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
cmp esi, esp
call fcn.0052354c
mov ecx, dword [ebp + 0x18]
cmp dword [ecx + 0x10], 0
je 0x4dd19c
mov edx, dword [ebp + 0x18]
mov eax, dword [edx + 0x10]
cmp dword [eax + 4], 0
je 0x4dd19c
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 4]
mov dword [ebp - 0x7c], eax
mov esi, esp
push 1
push 1
mov ecx, dword [ebp - 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
cmp esi, esp
call fcn.0052354c
jmp 0x4dd1a3
mov dword [ebp - 0x7c], 0xffffffff
mov esi, esp
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp esi, esp
call fcn.0052354c
mov dword [ebp - 0x78], eax
mov esi, esp
lea edx, [ebp - 0xdc]
push edx
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
cmp esi, esp
call fcn.0052354c
test eax, eax
je 0x4dd1fd
mov ecx, dword [ebp - 0xdc]
and ecx, 1
mov dword [ebp - 0xdc], ecx
je 0x4dd1fd
mov esi, esp
push 0
push 1
mov edx, dword [ebp - 0x78]
push edx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
cmp esi, esp
call fcn.0052354c
mov eax, dword [ebp + 0x18]
cmp dword [eax + 0x18], 0
je 0x4dd237
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0x18]
cmp dword [edx + 4], 0
je 0x4dd237
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x78], edx
mov esi, esp
push 1
push 1
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
cmp esi, esp
call fcn.0052354c
jmp 0x4dd23e
mov dword [ebp - 0x78], 0xffffffff
mov ecx, dword [ebp + 0x18]
cmp dword [ecx + 0x30], 0
je 0x4dd336
mov dword [ebp - 0xb0], str.Winsta0Default
mov esi, esp
mov edx, dword [ebp + 0x18]
mov eax, dword [edx + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x4dd2d9
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x4dd28e
mov dword [ebp - 0x184], 0
jmp 0x4dd2a8
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
add eax, 0xafc80
mov dword [ebp - 0x184], eax
mov ecx, dword [ebp - 0x184]
mov dword [ebp - 4], ecx
mov esi, esp
mov edx, dword [ebp + 0x18]
mov eax, dword [edx + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0052354c
mov ecx, dword [ebp + 0x18]
mov dword [ecx + 0x30], 0
mov eax, dword [ebp - 4]
jmp 0x4dd6b2
mov esi, esp
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0xb8]
push eax
mov ecx, dword [ebp - 0xec]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x30]
push eax
push 1
push 0
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0x34]
push edx
mov eax, dword [ebp - 0xe8]
push eax
mov ecx, dword [ebp - 0xe4]
push ecx
mov edx, dword [ebp + 0x18]
mov eax, dword [edx + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp esi, esp
call fcn.0052354c
mov dword [ebp - 4], eax
mov esi, esp
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp esi, esp
call fcn.0052354c
jmp 0x4dd376
mov esi, esp
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0xb8]
push edx
mov eax, dword [ebp - 0xec]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x30]
push edx
push 1
push 0
push 0
mov eax, dword [ebp - 0xe8]
push eax
mov ecx, dword [ebp - 0xe4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp esi, esp
call fcn.0052354c
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x18]
cmp dword [edx + 8], 0
je 0x4dd38b
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 8]
cmp dword [ecx + 4], 0
jne 0x4dd3bd
mov edx, dword [ebp + 0x18]
cmp dword [edx + 0x10], 0
je 0x4dd3a0
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 0x10]
cmp dword [ecx + 4], 0
jne 0x4dd3bd
mov edx, dword [ebp + 0x18]
cmp dword [edx + 0x18], 0
je 0x4dd465
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 0x18]
cmp dword [ecx + 4], 0
je 0x4dd465
cmp dword [ebp - 0xc4], 0
je 0x4dd3f5
mov esi, esp
mov edx, dword [ebp - 0xc4]
push edx
mov eax, dword [ebp - 0xc4]
push eax
mov edi, esp
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp edi, esp
call fcn.0052354c
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
cmp esi, esp
call fcn.0052354c
cmp dword [ebp - 0xd0], 0
je 0x4dd42d
mov esi, esp
mov ecx, dword [ebp - 0xd0]
push ecx
mov edx, dword [ebp - 0xd0]
push edx
mov edi, esp
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp edi, esp
call fcn.0052354c
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
cmp esi, esp
call fcn.0052354c
cmp dword [ebp - 0xdc], 0
je 0x4dd465
mov esi, esp
mov eax, dword [ebp - 0xdc]
push eax
mov ecx, dword [ebp - 0xdc]
push ecx
mov edi, esp
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp edi, esp
call fcn.0052354c
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
cmp esi, esp
call fcn.0052354c
mov esi, esp
push 0x5a5704
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, esp
call fcn.0052354c
jmp 0x4dd606
push 0x44
push 0
lea edx, [ebp - 0x17c]
push edx
call fcn.00523be0
add esp, 0xc
mov dword [ebp - 0x17c], 0x44
mov eax, dword [ebp + 0x18]
cmp dword [eax + 0x24], 0
je 0x4dd4bc
mov ecx, dword [ebp - 0x150]
or ecx, 1
mov dword [ebp - 0x150], ecx
mov word [ebp - 0x14c], 0
mov edx, dword [ebp + 0x18]
cmp dword [edx + 8], 0
je 0x4dd4d1
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 8]
cmp dword [ecx + 4], 0
jne 0x4dd503
mov edx, dword [ebp + 0x18]
cmp dword [edx + 0x10], 0
je 0x4dd4e6
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 0x10]
cmp dword [ecx + 4], 0
jne 0x4dd503
mov edx, dword [ebp + 0x18]
cmp dword [edx + 0x18], 0
je 0x4dd5cc
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 0x18]
cmp dword [ecx + 4], 0
je 0x4dd5cc
mov edx, dword [ebp - 0x150]
or edx, 0x100
mov dword [ebp - 0x150], edx
mov eax, dword [ebp + 0x18]
cmp dword [eax + 8], 0
je 0x4dd52f
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x188], eax
jmp 0x4dd546
mov esi, esp
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp esi, esp
call fcn.0052354c
mov dword [ebp - 0x188], eax
mov ecx, dword [ebp - 0x188]
mov dword [ebp - 0x144], ecx
mov edx, dword [ebp + 0x18]
cmp dword [edx + 0x10], 0
je 0x4dd56c
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x18c], edx
jmp 0x4dd583
mov esi, esp
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp esi, esp
call fcn.0052354c
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x140], eax
mov ecx, dword [ebp + 0x18]
cmp dword [ecx + 0x18], 0
je 0x4dd5a9
mov edx, dword [ebp + 0x18]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x190], ecx
jmp 0x4dd5c0
mov esi, esp
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp esi, esp
call fcn.0052354c
mov dword [ebp - 0x190], eax
mov edx, dword [ebp - 0x190]
mov dword [ebp - 0x13c], edx
mov esi, esp
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x17c]
push ecx
mov edx, dword [ebp + 0x18]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x30]
push edx
push 1
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp esi, esp
call fcn.0052354c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4dd64d
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
test eax, eax
jne 0x4dd62b
mov dword [ebp - 0x194], 0
jmp 0x4dd645
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0052354c
add eax, 0xafc80
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
jmp 0x4dd6b2
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x28]
mov dword [edx + 0x14], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
mov eax, dword [ebp + 0x18]
cmp dword [eax + 8], 0
je 0x4dd673
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 8]
push edx
call fcn.0045c660
mov eax, dword [ebp + 0x18]
cmp dword [eax + 0x10], 0
je 0x4dd688
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0x10]
push edx
call fcn.0045c660
mov eax, dword [ebp + 0x18]
cmp dword [eax + 0x18], 0
je 0x4dd69d
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0x18]
push edx
call fcn.0045c660
mov esi, esp
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0052354c
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x4dd6d8]
call fcn.0052356f
pop eax
pop edx
pop edi
pop esi
add esp, 0x194
cmp ebp, esp
call fcn.0052354c
mov esp, ebp
pop ebp
ret 0x18