Function at 0x4b2c88
Capabilities:
Create process on windows
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xc
push 0
push 0
dec ecx
jne 0x4b2c90
push ebx
push esi
push edi
mov eax, 0x4ac7ac
call fcn.0040a4a8
xor eax, eax
push ebp
push 0x4b32fc
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x4b32b1
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x4bcaac
mov ecx, 0x4bcab0
mov edx, 0x4b3318
mov eax, 0xa
call fcn.004ac4d0
cmp dword [0x4bcaac], 0x82d
jae 0x4b2cfc
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.004047c4
mov eax, dword [ebp - 0x14]
mov edx, 0xd
call fcn.004ac2fc
mov edx, dword [0x4b6218]
mov eax, dword [0x4bcab0]
mov ecx, 0x82d
call fcn.004045a8
mov eax, dword [0x4b6218]
mov eax, dword [eax + 0x820]
add eax, eax
add eax, 0x82d
mov edx, dword [0x4b6218]
add eax, dword [edx + 0x828]
cmp eax, dword [0x4bcaac]
jle 0x4b2d4e
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.004047c4
mov eax, dword [ebp - 0x18]
mov edx, 0xd
call fcn.004ac2fc
mov ebx, dword [0x4bcab0]
add ebx, 0x82d
mov edx, dword [0x4b6218]
mov edx, dword [edx + 0x820]
mov eax, 0x4b5e0c
call fcn.00407428
mov eax, dword [0x4b5e0c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4b2d84
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x4b2db3
mov eax, 0x4b5e0c
call fcn.00406ee0
mov edx, eax
mov eax, dword [0x4b5e0c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4b2da8
sub eax, 4
mov eax, dword [eax]
mov ecx, eax
add ecx, ecx
mov eax, ebx
call fcn.004045a8
mov eax, dword [0x4b5e0c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4b2dc7
sub eax, 4
mov eax, dword [eax]
add eax, eax
add ebx, eax
mov eax, dword [0x4b6218]
cmp dword [eax + 0x828], 0
jle 0x4b2e71
mov dl, 1
mov eax, dword [0x432bdc]
call fcn.00404f48
mov dword [0x4bcafc], eax
xor edx, edx
push ebp
push 0x4b2e6a
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [0x4b6218]
mov edx, dword [edx + 0x828]
mov eax, dword [0x4bcafc]
mov ecx, dword [eax]
call dword [ecx + 4]
mov ecx, dword [0x4b6218]
mov ecx, dword [ecx + 0x828]
mov eax, dword [0x4bcafc]
mov edx, dword [eax + 4]
mov eax, ebx
call fcn.004045a8
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4abd6c]
call fcn.0049f40c
mov ecx, dword [0x4b6218]
mov ecx, dword [ecx + 0x824]
mov edx, dword [0x4bcafc]
call fcn.004ac178
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2e71
mov eax, dword [0x4bcafc]
call fcn.00404f78
ret
lea ecx, [ebp - 0x20]
mov eax, 0x4b5e0c
mov edx, 0x4b3338
call fcn.004ac548
mov edx, dword [ebp - 0x20]
mov eax, 0x4bcab4
call fcn.00406d40
jmp 0x4b2f7b
push 0x4bcabc
mov ecx, 0x4bcab8
mov edx, 0x4b334c
mov eax, dword [0x4bcab4]
call fcn.004ac5ec
jmp 0x4b2ec4
mov eax, 0x4bcab8
mov ecx, 1
mov edx, 1
call fcn.004076b8
mov eax, dword [0x4bcab8]
call fcn.00406e24
test eax, eax
jle 0x4b2eff
mov eax, dword [0x4bcab8]
cmp word [eax], 0x25
je 0x4b2eb0
jmp 0x4b2eff
mov ebx, dword [0x4bcab8]
test ebx, ebx
je 0x4b2eee
sub ebx, 4
mov ebx, dword [ebx]
mov eax, 0x4bcab8
mov ecx, 1
mov edx, ebx
call fcn.004076b8
mov eax, dword [0x4bcab8]
call fcn.00406e24
test eax, eax
jle 0x4b2f25
mov eax, dword [0x4bcab8]
call fcn.00406e24
mov edx, dword [0x4bcab8]
cmp word [edx + eax*2 - 2], 0x25
je 0x4b2edf
cmp dword [0x4bcab8], 0
je 0x4b2f5b
push 0
mov eax, dword [0x4bcab8]
call fcn.004072c4
push eax
call sub.kernel32.dll_SetEnvironmentVariableW
mov eax, dword [0x4bcabc]
call fcn.004072c4
push eax
mov eax, dword [0x4bcab8]
call fcn.004072c4
push eax
call sub.kernel32.dll_SetEnvironmentVariableW
lea ecx, [ebp - 0x24]
push 0x4b5e0c
mov edx, 0x4b3338
pop eax
call fcn.004ac548
mov edx, dword [ebp - 0x24]
mov eax, 0x4bcab4
call fcn.00406d40
cmp dword [0x4bcab4], 0
jne 0x4b2e95
mov eax, 0x4b5e04
call fcn.00406980
mov eax, dword [0x4b6218]
movzx eax, byte [eax + 0x614]
test al, al
je 0x4b2fac
mov edx, dword [0x4b6218]
cmp al, 2
jne 0x4b2fe7
call fcn.00404764
mov ebx, eax
test ebx, ebx
jle 0x4b2fe7
mov esi, 1
push dword [0x4b5e04]
lea edx, [ebp - 0x28]
mov eax, esi
call fcn.004ac6b8
push dword [ebp - 0x28]
push 0x4b335c
mov eax, 0x4b5e04
mov edx, 3
call fcn.00407588
inc esi
dec ebx
jne 0x4b2fbc
lea eax, [ebp - 0x2c]
mov edx, dword [0x4b6218]
add edx, 0x20a
mov ecx, 0x105
call fcn.00407350
cmp dword [ebp - 0x2c], 0
je 0x4b3060
call fcn.004ac400
test al, al
je 0x4b3060
mov eax, 0x4b5e00
mov edx, dword [0x4b6218]
add edx, 0x20a
mov ecx, 0x105
call fcn.00407350
mov eax, dword [0x4b6218]
cmp byte [eax + 0x614], 0
je 0x4b30a9
lea eax, [ebp - 0x30]
mov edx, dword [0x4b6218]
add edx, 0x514
mov ecx, 0x80
call fcn.00407350
mov edx, dword [ebp - 0x30]
mov eax, 0x4b5e04
call fcn.004074a8
jmp 0x4b30a9
mov eax, 0x4b5e00
mov edx, dword [0x4b6218]
mov ecx, 0x105
call fcn.00407350
mov eax, dword [0x4b6218]
cmp byte [eax + 0x614], 0
je 0x4b30a9
lea eax, [ebp - 0x34]
mov edx, dword [0x4b6218]
add edx, 0x414
mov ecx, 0x80
call fcn.00407350
mov edx, dword [ebp - 0x34]
mov eax, 0x4b5e04
call fcn.004074a8
lea eax, [ebp - 0x38]
push eax
lea edx, [ebp - 0x40]
xor eax, eax
call fcn.004047c4
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.0041bd30
mov eax, dword [ebp - 0x3c]
mov cl, 1
mov edx, dword [0x4b5e00]
call fcn.00448174
mov edx, dword [ebp - 0x38]
mov eax, 0x4b5e00
call fcn.00406d40
cmp dword [0x4b5e00], 0
jne 0x4b30ff
lea edx, [ebp - 0x44]
xor eax, eax
call fcn.004047c4
mov eax, dword [ebp - 0x44]
mov edx, 0x57
call fcn.004ac2fc
mov eax, dword [0x4b6218]
cmp byte [eax + 0x614], 3
jne 0x4b3148
call fcn.00404764
mov ebx, eax
test ebx, ebx
jle 0x4b3148
mov esi, 1
push dword [0x4b5e04]
push 0x4b335c
lea edx, [ebp - 0x48]
mov eax, esi
call fcn.004ac6b8
push dword [ebp - 0x48]
mov eax, 0x4b5e04
mov edx, 3
call fcn.00407588
inc esi
dec ebx
jne 0x4b311d
mov eax, dword [0x4b6218]
movzx eax, byte [eax + 0x81f]
dec al
je 0x4b315e
dec al
je 0x4b317a
jmp 0x4b31d5
lea edx, [ebp - 0x4c]
mov eax, dword [0x4b5e00]
call fcn.0041b93c
mov edx, dword [ebp - 0x4c]
mov eax, 0x4b5e08
call fcn.00406d40
jmp 0x4b31df
lea eax, [ebp - 0x54]
push eax
lea edx, [ebp - 0x5c]
xor eax, eax
call fcn.004047c4
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x58]
call fcn.0041bd30
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x60]
mov edx, dword [0x4b6218]
add edx, 0x615
mov ecx, 0x105
call fcn.00407350
mov edx, dword [ebp - 0x60]
mov cl, 1
pop eax
call fcn.00448174
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.0041b93c
mov edx, dword [ebp - 0x50]
mov eax, 0x4b5e08
call fcn.00406d40
jmp 0x4b31df
mov eax, 0x4b5e08
call fcn.00406980
mov eax, 0x4bcac0
xor ecx, ecx
mov edx, 0x3c
call fcn.0040495c
mov dword [0x4bcac0], 0x3c
mov dword [0x4bcac4], 0x2000400
mov eax, dword [0x4b6218]
cmp byte [eax + 0x82c], 0
je 0x4b321e
mov eax, 0x4b3360
mov dword [0x4bcacc], eax
jmp 0x4b3228
mov eax, 0x4b336c
mov dword [0x4bcacc], eax
mov eax, dword [0x4b5e00]
call fcn.004072c4
mov dword [0x4bcad0], eax
mov eax, dword [0x4b5e04]
call fcn.004072c4
mov dword [0x4bcad4], eax
mov eax, dword [0x4b5e08]
call fcn.004072c4
mov dword [0x4bcad8], eax
mov dword [0x4bcadc], 1
push 0x4bcac0
call sub.shell32.dll_ShellExecuteExW
test eax, eax
jne 0x4b327e
call sub.kernel32.dll_GetLastError_1
mov edx, eax
mov eax, dword [0x4b5e00]
call fcn.004ac2fc
mov eax, dword [0x4b609c]
cmp dword [eax], 0
je 0x4b329e
call fcn.004ac714
push 0x14
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x4b609c]
cmp dword [eax], 0
jne 0x4b3288
xor edx, edx
xor eax, eax
call fcn.004ac2fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b32d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3303
lea eax, [ebp - 0x60]
mov edx, 0x11
call fcn.004069e0
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004069e0
ret