Function at 0x4725fc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov byte [ebp - 0x11], dl
mov dword [ebp - 0x18], eax
mov esi, dword [0x48d550]
mov eax, dword [0x48dad8]
cmp byte [eax], 4
je 0x472631
mov ax, 0x312
call fcn.0040bc04
mov edx, 4
call fcn.00411d74
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x55d], 0
jle 0x472d15
mov eax, dword [ebp - 0x18]
call fcn.00464bb4
test al, al
je 0x472d15
mov eax, dword [ebp - 0x18]
mov al, byte [eax + 0x55d]
call fcn.0040cdd0
mov edx, dword [0x48da44]
lea eax, [ebp - 0x1c]
call fcn.00405c48
mov eax, dword [ebp - 0x18]
movsx eax, byte [eax + 0x55d]
mov edx, dword [0x48d340]
mov bl, byte [edx + eax - 1]
cmp byte [ebp - 0x11], 0
je 0x472789
call fcn.0040f494
mov eax, dword [ebp - 0x18]
mov al, byte [eax + 0x55d]
call fcn.0040cdd0
mov al, 4
call fcn.0042aef4
test al, al
je 0x472d15
mov edx, dword [0x48da44]
lea eax, [ebp - 0x11d]
call fcn.00405c48
lea edx, [ebp - 0x11d]
mov eax, dword [0x48d830]
mov cx, 3
call fcn.00405c70
mov eax, dword [0x48d830]
push eax
lea eax, [ebp - 0x1c]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
je 0x472700
cmp byte [ebp - 0x1c], 0x3f
je 0x472700
mov ax, 0xf6
call fcn.0040bc04
mov edx, 3
call fcn.00411d74
jmp 0x47268b
cmp bl, 1
je 0x47270f
cmp bl, 2
je 0x47270f
cmp bl, 3
jne 0x472789
lea eax, [ebp - 0x1d]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x4a4
mov edx, dword [ebp - 0x18]
mov dl, byte [edx + 0x55d]
lea eax, [ebp - 0x11d]
call fcn.00420948
mov edi, eax
cmp byte [ebp - 0x1d], 0
je 0x472772
mov eax, dword [0x48d714]
mov word [eax], 0
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x564], 0
jne 0x472772
mov eax, dword [ebp - 0x18]
call fcn.0047e098
add esp, 0xfffffff8
fistp qword [esp]
wait
mov edx, dword [ebp - 0x18]
mov dx, word [edx + 0x534]
mov al, 1
call fcn.004429a8
cmp edi, 0xfffffffd
jb 0x472789
cmp bl, 3
je 0x472d15
cmp edi, 0xfffffffd
jne 0x472d15
cmp byte [ebp - 0x11], 0
jne 0x4727a4
mov dl, 0x2f
mov ax, 0x29
call fcn.0042d52c
test eax, eax
je 0x472d15
jmp 0x4727b7
mov dl, 0x30
mov ax, 0x29
call fcn.0042d52c
test eax, eax
je 0x472d15
cmp byte [esi + 0x1981], 0
je 0x4728fa
mov edx, 0x472d1c
mov eax, 0x49c8a8
call fcn.00405c48
cmp byte [ebp - 0x11], 0
jne 0x47281b
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x55d], 0x1a
jg 0x472808
lea edx, [ebp - 0x1c]
mov eax, dword [0x48d830]
mov cx, 1
call fcn.00405c70
mov eax, dword [0x48d830]
push eax
push 0x49c8a8
call sub.kernel32.dll_lstrcatA
jmp 0x472887
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x14]
push eax
push 0x49c8a8
call sub.kernel32.dll_lstrcatA
jmp 0x472887
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA_1
cmp eax, 3
jg 0x472871
mov eax, dword [0x48da44]
mov dl, byte [ebp - 0x11d]
mov byte [eax], dl
mov eax, dword [0x48da44]
mov byte [eax + 1], 0x20
mov eax, dword [0x48da44]
mov byte [eax + 2], 0
mov eax, dword [0x48da44]
push eax
push 0x49c8a8
call sub.kernel32.dll_lstrcatA
mov ax, 0x222
call fcn.0040bc04
push eax
push 0x49c8a8
call sub.kernel32.dll_lstrcatA
jmp 0x472887
lea eax, [ebp - 0x11d]
call fcn.0040fb28
push eax
push 0x49c8a8
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48d4fc]
push eax
push 0x49c8a8
call sub.kernel32.dll_lstrcatA
mov edx, 0x49c8a8
mov eax, dword [0x48d370]
call fcn.00405c48
call fcn.0040f494
mov al, 1
call fcn.0042aef4
test al, al
je 0x472d15
mov eax, 0x49c8a8
call fcn.00412584
test al, al
je 0x4728d8
mov eax, dword [0x48d370]
xor edx, edx
call fcn.00411180
test al, al
je 0x4728a6
mov edx, dword [0x48d370]
mov eax, 0x49c8a8
call fcn.00405c48
mov eax, 0x49c8a8
call fcn.00471964
test al, al
je 0x472d15
cmp byte [esi + 0x1982], 0
je 0x47297c
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x1a8], 0
jne 0x47291d
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dl, 1
call fcn.00468248
jmp 0x47293f
mov ax, 0x12e
call fcn.0040bc04
mov edx, eax
mov eax, dword [ebp - 0x18]
add eax, 0x1d0
call fcn.00405c48
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x559], 1
mov eax, dword [ebp - 0x18]
call fcn.00466fcc
push 0xfffffffffffffff0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x1a8]
push eax
call sub.user32.dll_GetWindowLongA
mov edx, dword [0x48d498]
mov dword [edx], eax
mov eax, dword [0x48d498]
mov eax, dword [eax]
and eax, 0xfffffffb
push eax
push 0xfffffffffffffff0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x1a8]
push eax
call sub.user32.dll_SetWindowLongA
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x55d], 0x1a
jg 0x472a00
cmp bl, 1
je 0x472997
cmp bl, 2
je 0x472997
cmp bl, 3
jne 0x472a00
cmp byte [esi + 0x190b], 0
jne 0x472a00
cmp byte [esi + 0x1874], 0
je 0x472a00
mov ecx, dword [ebp - 0x18]
add ecx, 0x4a4
mov eax, dword [ebp - 0x18]
mov al, byte [eax + 0x55d]
mov dl, 1
call fcn.0042269c
mov eax, dword [0x48d714]
mov word [eax], 0
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x564], 0
jne 0x4729f8
mov eax, dword [ebp - 0x18]
call fcn.0047e098
add esp, 0xfffffff8
fistp qword [esp]
wait
mov edx, dword [ebp - 0x18]
mov dx, word [edx + 0x534]
mov al, 1
call fcn.004429a8
mov eax, dword [0x48d818]
mov byte [eax], 1
xor eax, eax
mov dword [ebp - 0x10], eax
mov ax, 0x311
call fcn.0040bc04
mov edx, eax
mov eax, dword [0x48d948]
call fcn.00405c48
cmp bl, 0xff
jne 0x472aa4
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x55d], 0x1a
jg 0x472a86
cmp byte [esi + 0x190b], 0
jne 0x472a86
cmp byte [esi + 0x18ae], 0
jne 0x472a86
cmp byte [esi + 0x1874], 0
jne 0x472a86
cmp byte [esi + 0x1982], 0
jne 0x472a86
mov eax, dword [0x48d948]
mov dl, 1
call fcn.0040e810
cmp byte [ebp - 0x11], 0
jne 0x472a74
push ebp
lea eax, [ebp - 0x1c]
call fcn.004722c4
pop ecx
jmp 0x472bfb
push ebp
lea eax, [ebp - 0x11d]
call fcn.004722c4
pop ecx
jmp 0x472bfb
mov eax, dword [0x48d948]
xor edx, edx
call fcn.0040e810
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov cl, 1
call fcn.00471478
jmp 0x472bfb
mov eax, dword [0x48d948]
mov dl, 1
call fcn.0040e810
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x55d], 0x1a
jg 0x472aff
cmp bl, 1
jl 0x472acf
cmp bl, 3
jg 0x472acf
cmp byte [esi + 0x190b], 0
jne 0x472aff
cmp byte [esi + 0x1982], 0
jne 0x472aff
cmp byte [ebp - 0x11], 0
jne 0x472aed
push ebp
lea eax, [ebp - 0x1c]
call fcn.004722c4
pop ecx
jmp 0x472bfb
push ebp
lea eax, [ebp - 0x11d]
call fcn.004722c4
pop ecx
jmp 0x472bfb
mov eax, dword [ebp - 0x18]
add eax, 0x4a4
mov dl, 1
call fcn.0041f698
test eax, eax
je 0x472bfb
cmp byte [ebp - 0x11], 0
jne 0x472bd8
push 4
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x472b58
push 0
push 0x1000
call fcn.00412abc
mov edx, eax
mov ax, 0xb
call fcn.0040de10
jmp 0x472d15
mov eax, dword [ebp - 8]
mov ecx, 0xff
mov edx, 0x1000
call fcn.00402db8
mov dword [ebp - 4], 0x1000
xor eax, eax
mov dword [ebp - 0xc], eax
cmp bl, 3
jne 0x472b86
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4f4]
jmp 0x472b8b
mov eax, 0xfffffffd
push ebp
push 1
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x4b4]
lea ecx, [ebp - 0x1c]
xchg ecx, eax
call fcn.00471d54
pop ecx
mov eax, dword [0x48d9fc]
cmp byte [eax], 0
jne 0x472bc4
cmp byte [esi + 0x190b], 0
je 0x472bc4
cmp byte [esi + 0x194a], 0
je 0x472bc4
push ebp
call fcn.004721f4
pop ecx
push 0x4000
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_VirtualFree_1
jmp 0x472bfb
push ebp
push 1
mov edx, dword [ebp - 0x18]
add edx, 0x4a4
mov eax, edi
call fcn.0041ea80
mov edx, eax
lea eax, [ebp - 0x11d]
mov ecx, edi
call fcn.00471d54
pop ecx
cmp byte [esi + 0x1981], 0
je 0x472c0e
mov eax, 0x49c6dc
call fcn.00402c60
call fcn.0040eb04
mov eax, dword [0x48d818]
mov byte [eax], 0
cmp byte [esi + 0x185f], 0
je 0x472c83
mov eax, dword [0x48da44]
call fcn.0040f9c8
test al, al
je 0x472c83
push 0x472d2c
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
push 0x49c8a8
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
push 0x472d30
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
push 1
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jae 0x472c83
mov edx, dword [0x48da44]
mov ax, 7
call fcn.0040de10
cmp byte [esi + 0x1982], 0
je 0x472cc0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.00469800
mov eax, dword [ebp - 0x18]
mov ax, word [eax + 0x534]
call fcn.00447f94
xor ecx, ecx
mov cl, byte [esi + 0x189a]
mov edx, 0x466ee8
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x1a8]
call fcn.0040b514
fild dword [ebp - 0x10]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.00412e40
mov ax, 0x314
call fcn.0040bc04
push eax
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
cmp dword [ebp - 0x10], 0xfffa
jle 0x472d06
cmp byte [esi + 0x1981], 0
je 0x472d06
push 0x472d34
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48da44]
mov edx, 4
call fcn.00411d74
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret