Function at 0x4c2ad2
Capabilities:
Create process on windows

Disassembly:
push 0x36c
mov eax, 0x60fd51
call fcn.004f0658
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x344], eax
mov eax, dword [ebp + 0x10]
push 0x208
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
push 0
push eax
mov byte [ebp - 0x35d], 0
call fcn.0041c790
mov edi, dword [0x69a2cc]
add esp, 0xc
mov eax, dword [edi]
push 0x104
mov esi, dword [eax + 0x20]
lea eax, [ebp - 0x218]
push eax
push 0
mov ecx, esi
call dword [0x62275c]
mov ecx, edi
call esi
push ebx
push str._client
lea eax, [ebp - 0x24c]
push eax
call fcn.0044a805
mov esi, dword [ebp - 0x344]
lea ecx, [ebp - 0x234]
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
call fcn.0040ca6e
push ebx
lea eax, [ebp - 0x24c]
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.004145a6
mov esi, 0x63a380
cmp eax, 0xffffffff
jne 0x4a86d9
push esi
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x35c]
push eax
call fcn.0040c633
mov ecx, eax
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
push dword [ebp - 0x224]
cmovae eax, dword [ebp - 0x234]
push eax
mov byte [ebp - 4], 2
call fcn.0040c504
push eax
lea ecx, [ebp - 0x378]
call fcn.0040c76f
mov byte [ebp - 0x344], bl
lea eax, [ebp - 0x378]
push dword [ebp - 0x344]
lea ecx, [ebp - 0x234]
push eax
call fcn.004152b2
lea ecx, [ebp - 0x378]
call fcn.00405795
lea ecx, [ebp - 0x35c]
mov byte [ebp - 4], 1
call fcn.00405795
call fcn.004a3fed
test al, al
je 0x4a87f0
push 0xb0
lea eax, [ebp - 0x340]
push ebx
push eax
call fcn.0041c790
add esp, 0xc
lea ecx, [ebp - 0x340]
push 1
call fcn.00413fa7
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 3
push eax
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x330]
push eax
call fcn.00416210
push eax
call fcn.00416210
push eax
call fcn.0045ae75
xor eax, eax
lea edi, [ebp - 0x354]
stosd dword es:[edi], eax
push 0x44
pop esi
push esi
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x290]
push eax
call fcn.0041c790
add esp, 0xc
mov dword [ebp - 0x290], esi
lea eax, [ebp - 0x378]
lea ecx, [ebp - 0x328]
push eax
call fcn.00415156
cmp dword [ebp - 0x364], 8
lea ecx, [ebp - 0x354]
push ecx
lea ecx, [ebp - 0x290]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x378]
cmovae eax, dword [ebp - 0x378]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ecx, [ebp - 0x378]
mov esi, eax
call fcn.00405795
test esi, esi
je 0x4a87ec
cmp dword [ebp - 0x350], 0
je 0x4a87c1
push dword [ebp - 0x350]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x354], 0
je 0x4a87d6
push dword [ebp - 0x354]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, byte [ebp - 0x35d]
lea ecx, [ebp - 0x340]
call fcn.00411984
jmp 0x4a8874
mov bl, 1
jmp 0x4a87dc
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x288]
push ebx
push eax
call fcn.0041c790
mov edi, dword [0x69a2cc]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x278], eax
add esp, 0xc
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
mov dword [ebp - 0x288], esi
cmovae eax, dword [ebp - 0x234]
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x284], 0x8000
mov dword [ebp - 0x27c], str.open
mov dword [ebp - 0x26c], 5
mov eax, dword [edi]
mov esi, dword [eax + 0x154]
lea eax, [ebp - 0x288]
push eax
mov ecx, esi
call dword [0x62275c]
mov ecx, edi
call esi
test eax, eax
setne bl
test bl, bl
je 0x4a887c
xor eax, eax
jmp 0x4a8882
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x21c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x220]
cmp eax, 8
jb 0x4a88dd
mov ecx, dword [ebp - 0x234]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x344], ecx
cmp eax, 0x1000
jb 0x4a88d4
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x344]
push eax
call fcn.00405741
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x344]
push eax
push ecx
call fcn.0041b169
pop ecx
pop ecx
and dword [ebp - 0x224], 0
lea ecx, [ebp - 0x24c]
xor eax, eax
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
call fcn.00405795
mov al, bl
call fcn.004f0607
ret 0xc
push ebp
mov ebp, esp
pop ebp
jmp 0x4a859d