Function at 0x1004b515
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
mov dword [ebp - 0xc], 0xfffffffd
xor ebx, ebx
push esi
mov dword [ebp - 0x20], 0xfa147b80
xor esi, esi
mov dword [ebp - 0x20], 0xfffffff9
inc esi
push edi
mov dword [ebp - 0x20], 4
mov edi, ecx
mov dword [ebp - 0x14], ebx
jmp 0x1004b554
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x24], 0x624039b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1004b546
mov dword [ebp - 0xc], ebx
jmp 0x1004b5d5
mov dword [ebp - 0x10], 0x976ff55e
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x20], 0xd1f2e966
mov dword [ebp - 0x10], ebx
jmp 0x1004b5cd
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x14], ebx
jmp 0x1004b592
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x28], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1004b584
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1004b5b3
push 0x2432
push ebx
push ebx
push ebx
push 0x213
push ebx
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov dword [ebp - 0x14], ebx
jmp 0x1004b5c5
mov dword [ebp - 0x18], 0x27f7b6fe
dec dword [ebp - 0x18]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1004b5b8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1004b578
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jle 0x1004b55e
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1004b5f6
push ebx
push ebx
push ebx
push ebx
push 0x1e5f
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
push edi
call fcn.10045c5e
pop ecx
mov dword [ebp - 0x14], 0xdb3ae355
pop ecx
mov dword [ebp - 0x14], ebx
jmp 0x1004b619
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x44], 0x38ab659d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1004b60b
mov dword [ebp - 0x14], ebx
jmp 0x1004b7b5
mov dword [ebp - 0x10], 6
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x10], ebx
jmp 0x1004b7a2
mov dword [ebp - 0xc], 0x2e8588d0
mov dword [ebp - 8], 0x1fbc9fa8
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0xc], 2
cmp dword [ebp - 0xc], ebx
jl 0x1004b785
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfaf07207
mov ecx, dword [ebp - 0x10]
sbb edx, edx
inc edx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp edx, ecx
setle al
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x44]
imul eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
je 0x1004b6ed
mov dword [ebp - 0x20], 0x77d6446b
mov dword [ebp - 8], 0x18
jmp 0x1004b6e5
mov dword [ebp - 0x1c], 0xe7504ed0
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x44], ebx
je 0x1004b6c2
mov edx, esi
cmp dword [ebp - 0x1c], ebx
jne 0x1004b6c4
mov edx, ebx
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setne cl
xor edx, edx
test ecx, ecx
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x1c], ecx
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff2
jle 0x1004b6a2
jmp 0x1004b70e
mov dword [ebp - 8], 2
cmp dword [ebp - 8], ebx
jl 0x1004b70e
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1004b709
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadMenuW]
dec dword [ebp - 8]
jns 0x1004b6f9
mov dword [ebp - 8], 0xfffffff5
jmp 0x1004b776
mov dword [ebp - 0x20], 0xffff
mov dword [ebp - 0x1c], 0xaecaa70
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
sub ecx, 0xfff9
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
mov ecx, 0x461d0ee3
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul eax, eax, 0xfffb
sub ecx, eax
add ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setl dl
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
neg edx
sbb edx, edx
add edx, 0xffffb8d1
neg edx
sbb edx, edx
inc edx
add edx, dword [ebp + eax*4 - 0x44]
mov dword [ebp - 0x18], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xa
jl 0x1004b717
dec dword [ebp - 0xc]
jns 0x1004b662
mov dword [ebp - 0xc], 0x10
jmp 0x1004b799
cmp dword [ebp - 0x18], ebx
jne 0x1004b79f
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffe7
jle 0x1004b78e
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe5
jl 0x1004b63d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x16
jne 0x1004b627
push edi
call fcn.1002f843
pop ecx
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x14], 0xcb13638e
mov edi, eax
mov dword [ebp - 0x1c], 0x3423637b
push esi
call fcn.10016a6e
push 2
mov dword [ebp - 0x20], 0x137d3709
mov dword [ebp - 8], ebx
pop ecx
jmp 0x1004b7ff
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x38], 6
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x1004b7f1
mov dword [ebp - 8], ebx
jmp 0x1004b813
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x30], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x1004b809
mov dword [ebp - 8], ebx
jmp 0x1004b829
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x50]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x1004b81d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
je 0x1004b888
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
jne 0x1004b857
mov esi, ebx
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp esi, eax
mov eax, dword [ebp - 0x14]
setne cl
neg eax
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x50]
setne dl
mov dword [eax], edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x20], 0xe41b0ce7
call fcn.1001732e
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret