Function at 0x4da560
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5a7f28
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004d4220
test eax, eax
je 0x4da815
lea ecx, [esp + 0x28]
call fcn.0055d17f
mov edi, vtable.CStringArrayEx.0
mov dword [esp + 0x28], edi
lea ecx, [esp + 0x3c]
mov dword [esp + 0x58], 0
call fcn.0055d17f
mov dword [esp + 0x3c], edi
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x5c], 1
mov eax, dword [esi + 0xa78]
push ecx
call fcn.004da350
call fcn.00555692
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4da5f1
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x58], 2
call fcn.00555692
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4da620
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x1c], ebp
mov ecx, 0x5d6538
lea ebx, [esp + 0x14]
lea edi, [esp + 0x28]
mov byte [esp + 0x58], 3
call fcn.0047d040
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x4da7a2
mov edx, dword [esp + 0x30]
push edx
lea eax, [esp + 0x20]
push 0x5fc410
push eax
call fcn.00404650
mov ebp, dword [esp + 0x28]
mov eax, dword [ebp - 0xc]
add esp, 0xc
push eax
push ebp
mov ecx, ebx
call fcn.004044f0
call fcn.00555692
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4da697
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x58], 4
call fcn.00555692
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4da6c6
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
mov ebx, 5
lea esi, [esp + 0x18]
mov byte [esp + 0x58], bl
call fcn.00452920
push str._text1.txt
mov ecx, esi
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00401ba0
add esp, 0xc
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x5c], 6
call fcn.00402330
mov byte [esp + 0x58], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4da730
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x20]
push 1
push esi
lea ecx, [esp + 0x1c]
call fcn.0044a9d0
add esp, 8
test eax, eax
je 0x4da75a
push ebx
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esi - 0x10]
mov byte [esp + 0x58], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4da77b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x58], 3
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4da7b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4da7b0
push 0
push 0
push 0x5fc438
call fcn.0055e834
lea eax, [ebp - 0x10]
mov byte [esp + 0x58], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4da7d1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x58], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4da7f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x58], 0
call fcn.0055d21d
lea ecx, [esp + 0x28]
mov dword [esp + 0x58], 0xffffffff
call fcn.0055d21d
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret