Function at 0x4ed2d7
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0x88
push 0x5c5e98
call fcn.0051bb70
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
test ebx, ebx
jne 0x4ed307
call fcn.0052d3fe
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x4ed6e4
mov dword [ebp - 4], esi
push str.COMSPEC
push esi
lea eax, [ebp - 0x20]
push eax
call fcn.0052d8dd
add esp, 0xc
test eax, eax
jne 0x4ed327
mov edi, dword [ebp - 0x20]
test edi, edi
jne 0x4ed346
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x2c]
call fcn.004eca61
test dword [ebp - 0x2c], 0x8000
mov edi, str.command.com
mov eax, str.cmd.exe
cmove edi, eax
push 0x44
pop esi
push esi
push 0
lea eax, [ebp - 0x98]
push eax
call fcn.0051c010
add esp, 0xc
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x6c], 1
xor eax, eax
mov word [ebp - 0x68], ax
push edi
call fcn.0052fd64
pop ecx
mov esi, eax
push ebx
call fcn.0052fd64
add esi, eax
mov dword [esp], str.__c
call fcn.0052fd64
pop ecx
inc esi
add eax, esi
mov dword [ebp - 0x24], eax
lea ecx, [eax + eax]
mov dword [ebp - 0x38], ecx
and dword [ebp - 0x34], 0
call fcn.004ebeae
mov esi, eax
mov dword [ebp - 0x28], esi
test esi, esi
je 0x4ed6d5
push edi
push dword [ebp - 0x24]
push esi
call fcn.00537885
add esp, 0xc
push str.__c
push dword [ebp - 0x24]
push esi
call fcn.00537961
add esp, 0xc
push ebx
push dword [ebp - 0x24]
push esi
call fcn.00537961
add esp, 0xc
call fcn.0052d3fe
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
xor ebx, ebx
push ebx
push edi
call fcn.00537661
pop ecx
pop ecx
test eax, eax
jne 0x4ed44a
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x98]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x4ed65a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess_failed___d_.error:__n
push str.os_system_w
push 0x2f8
push str.srcliblibpaloswindowsos_popen.c
push 0x5a9534
push 0x103
push ebx
call fcn.004e8a0a
add esp, 0x20
jmp 0x4ed65a
mov dword [ebp - 0x24], ebx
mov ecx, 0x208
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ebx
call fcn.004ebeae
mov ebx, eax
test ebx, ebx
jne 0x4ed489
xor ecx, ecx
call fcn.004ebe45
mov ecx, esi
call fcn.004ebe45
push dword [ebp - 0x20]
call fcn.00528163
pop ecx
call fcn.0052d3fe
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
jmp 0x4ed6d5
push 0x58994c
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.0052d8dd
add esp, 0xc
test eax, eax
je 0x4ed509
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4ed502
add eax, 0xfffffffc
mov edi, dword [eax]
push eax
call fcn.00528163
pop ecx
mov eax, dword [0x89615c]
xor ecx, ecx
cmp eax, ecx
ja 0x4ed4c6
cmp dword [0x896158], ecx
jbe 0x4ed4d5
add dword [0x896158], 0xffffffff
adc eax, 0xffffffff
mov dword [0x89615c], eax
mov eax, dword [0x896144]
cmp eax, ecx
jb 0x4ed4f7
ja 0x4ed4e8
cmp dword [0x896140], edi
jbe 0x4ed4f7
sub dword [0x896140], edi
sbb eax, ecx
mov dword [0x896144], eax
jmp 0x4ed502
xorps xmm0, xmm0
movlpd qword [0x896140], xmm0
mov ecx, ebx
jmp 0x4ed465
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, ebx
call fcn.004ec9ab
pop ecx
mov dword [ebp - 0x34], eax
test eax, eax
je 0x4ed5ef
xor eax, eax
cmp word [ebx], ax
je 0x4ed5ef
push ebx
call fcn.0052fd64
pop ecx
lea eax, [ebx + eax*2]
movzx eax, word [eax - 2]
cmp eax, 0x5c
je 0x4ed556
cmp eax, 0x2f
je 0x4ed556
push 0x5a99e8
push 0x104
push ebx
call fcn.00537961
add esp, 0xc
push edi
call fcn.0052fd64
pop ecx
mov esi, eax
push ebx
call fcn.0052fd64
pop ecx
add esi, eax
mov eax, 0x104
cmp esi, eax
jae 0x4ed5ec
push edi
push eax
push ebx
call fcn.00537961
add esp, 0xc
xor esi, esi
push esi
push ebx
call fcn.00537661
pop ecx
pop ecx
test eax, eax
jne 0x4ed5e1
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x98]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
mov esi, dword [ebp - 0x28]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x4ed5ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess_failed___d_.error:__n
push str.os_system_w
push 0x33a
push str.srcliblibpaloswindowsos_popen.c
push 0x5a9534
push 0x103
xor eax, eax
push eax
call fcn.004e8a0a
add esp, 0x20
jmp 0x4ed5ef
mov esi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x34]
jmp 0x4ed50c
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4ed651
add eax, 0xfffffffc
mov edi, dword [eax]
push eax
call fcn.00528163
pop ecx
mov eax, dword [0x89615c]
xor ecx, ecx
cmp eax, ecx
ja 0x4ed615
cmp dword [0x896158], ecx
jbe 0x4ed624
add dword [0x896158], 0xffffffff
adc eax, 0xffffffff
mov dword [0x89615c], eax
mov eax, dword [0x896144]
cmp eax, ecx
jb 0x4ed646
ja 0x4ed637
cmp dword [0x896140], edi
jbe 0x4ed646
sub dword [0x896140], edi
sbb eax, ecx
mov dword [0x896144], eax
jmp 0x4ed651
xorps xmm0, xmm0
movlpd qword [0x896140], xmm0
mov ecx, ebx
call fcn.004ebe45
xor ebx, ebx
mov ecx, esi
call fcn.004ebe45
push dword [ebp - 0x20]
call fcn.00528163
pop ecx
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0052d3fe
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
cmp dword [ebp - 0x1c], 0
je 0x4ed6d5
push 0xffffffffffffffff
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4ed6a1
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x4ed6d5
push str.timeout_terminate_process_n
push str.os_system_w
push 0x34e
push str.srcliblibpaloswindowsos_popen.c
push 0x5a9534
push 3
push ebx
call fcn.004e8a0a
add esp, 0x1c
xor ebx, ebx
inc ebx
push ebx
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.004ed6f4
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret