Function at 0x4e422c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x3d
push 0
push 0
dec ecx
jne 0x4e4234
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405ab8
xor eax, eax
push ebp
push 0x4e4eaf
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea eax, [ebp - 0x164]
mov ecx, dword [ebp - 4]
mov edx, 0x4e4ec4
call fcn.00405914
mov edx, dword [ebp - 0x164]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x168]
mov eax, dword [ebp - 4]
call fcn.00409970
mov ecx, dword [ebp - 0x168]
mov edx, 0x4e4ef4
mov eax, 0x80000001
call fcn.00488b64
cmp dword [ebp - 0x10], 0
je 0x4e42c8
mov eax, dword [ebp - 0x10]
call fcn.0040a790
test al, al
jne 0x4e42c8
lea eax, [ebp - 0x10]
call fcn.004055f4
cmp dword [ebp - 0x10], 0
jne 0x4e431d
lea edx, [ebp - 0x16c]
mov eax, 0x26
call fcn.0048856c
push dword [ebp - 0x16c]
push 0x4e4f0c
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 4]
call fcn.0040ac60
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x170]
xor edx, edx
call fcn.0040aa8c
push dword [ebp - 0x170]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405988
mov eax, dword [ebp - 0x10]
call fcn.0040a790
test al, al
je 0x4e4352
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x178]
mov ecx, dword [ebp - 4]
mov edx, 0x4e4f18
call fcn.00405914
mov eax, dword [ebp - 0x178]
mov cl, 1
mov edx, dword [ebp - 0x10]
call fcn.004884a8
jmp 0x4e43af
mov eax, dword [ebp - 0x10]
call fcn.0040ae60
lea eax, [ebp - 8]
push eax
push 0x4e4f18
push dword [ebp - 4]
push 0x4e4f50
push 0x4e4f5c
push 0x4e4f50
push 0x4e4fa8
lea eax, [ebp - 0x17c]
mov edx, 6
call fcn.00405988
mov eax, dword [ebp - 0x17c]
mov cl, 1
mov edx, dword [ebp - 0x10]
call fcn.004884a8
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00405a14
je 0x4e43af
mov eax, dword [ebp - 0x10]
call fcn.0040ae7c
cmp dword [ebp - 8], 0
jne 0x4e43df
mov eax, 0x4e4fdc
call fcn.0043e234
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e4ffc
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4e4e84
lea edx, [ebp - 0x180]
mov eax, dword [ebp - 8]
call fcn.00409970
mov edx, dword [ebp - 0x180]
lea eax, [ebp - 8]
call fcn.0040568c
mov eax, dword [ebp - 8]
test eax, eax
je 0x4e4407
sub eax, 4
mov eax, dword [eax]
cmp eax, 4
jge 0x4e4418
mov eax, 0x4e501c
call fcn.0043e234
xor ebx, ebx
mov eax, dword [ebp - 8]
call fcn.00405ac8
mov esi, eax
mov eax, esi
mov edx, 0x4e5080
call fcn.0040b068
test eax, eax
jne 0x4e4442
mov eax, esi
mov edx, 0x4e5088
call fcn.0040b068
test eax, eax
je 0x4e444e
mov eax, 0x4e5098
call fcn.0043e234
xor ebx, ebx
mov eax, esi
mov edx, 0x4e50ec
call fcn.0040b068
test eax, eax
je 0x4e446a
mov eax, 0x4e5100
call fcn.0043e234
xor ebx, ebx
mov eax, dword [ebp - 8]
call fcn.00405ac8
mov esi, eax
mov eax, esi
mov edx, 0x4e517c
call fcn.0040b068
test eax, eax
jne 0x4e44b4
mov eax, esi
mov edx, 0x4e5184
call fcn.0040b068
test eax, eax
jne 0x4e44b4
mov eax, esi
mov edx, 0x4e518c
call fcn.0040b068
test eax, eax
jne 0x4e44b4
mov eax, esi
mov edx, 0x4e5190
call fcn.0040b068
test eax, eax
je 0x4e44c0
mov eax, 0x4e51a0
call fcn.0043e234
xor ebx, ebx
test bl, bl
je 0x4e4256
lea eax, [ebp - 8]
mov edx, 0x4e4f0c
call fcn.004058d0
lea eax, [ebp - 0x184]
mov ecx, dword [ebp - 4]
mov edx, 0x4e5210
call fcn.00405914
mov edx, dword [ebp - 0x184]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4e4510
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
sub ecx, 4
jno 0x4e4520
call fcn.004045c4
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405b28
mov eax, dword [ebp - 4]
mov edx, 0x4e5234
call fcn.00405a14
jne 0x4e455c
push 0x4e524c
push dword [ebp - 0x14]
push 0x4e5260
push dword [0x4f65f0]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00405988
mov eax, dword [ebp - 4]
mov edx, 0x4e526c
call fcn.00405a14
jne 0x4e458b
push 0x4e524c
push dword [ebp - 0x14]
push 0x4e5260
push dword [0x4f65f4]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00405988
mov eax, dword [ebp - 4]
mov edx, 0x4e5280
call fcn.00405a14
jne 0x4e45ba
push 0x4e524c
push dword [ebp - 0x14]
push 0x4e5260
push dword [0x4f65f8]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00405988
mov eax, dword [ebp - 4]
mov edx, 0x4e5298
call fcn.00405a14
jne 0x4e45d6
lea eax, [ebp - 0x14]
mov edx, 0x4e52b4
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e52e8
call fcn.00405a14
jne 0x4e45f2
lea eax, [ebp - 0x14]
mov edx, 0x4e52b4
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e5300
call fcn.00405a14
jne 0x4e460e
lea eax, [ebp - 0x14]
mov edx, 0x4e531c
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e5348
call fcn.00405a14
jne 0x4e462a
lea eax, [ebp - 0x14]
mov edx, 0x4e5364
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e5390
call fcn.00405a14
jne 0x4e4646
lea eax, [ebp - 0x14]
mov edx, 0x4e53ac
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e53d8
call fcn.00405a14
jne 0x4e4662
lea eax, [ebp - 0x14]
mov edx, 0x4e53f4
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e5420
call fcn.00405a14
jne 0x4e467e
lea eax, [ebp - 0x14]
mov edx, 0x4e543c
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e5468
call fcn.00405a14
jne 0x4e469a
lea eax, [ebp - 0x14]
mov edx, 0x4e5484
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e54b0
call fcn.00405a14
jne 0x4e46b6
lea eax, [ebp - 0x14]
mov edx, 0x4e54cc
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e54f8
call fcn.00405a14
jne 0x4e46d2
lea eax, [ebp - 0x14]
mov edx, 0x4e5514
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e5540
call fcn.00405a14
jne 0x4e46ee
lea eax, [ebp - 0x14]
mov edx, 0x4e555c
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e5588
call fcn.00405a14
jne 0x4e470a
lea eax, [ebp - 0x14]
mov edx, 0x4e55a0
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e55c8
call fcn.00405a14
jne 0x4e4726
lea eax, [ebp - 0x14]
mov edx, 0x4e55e0
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e5608
call fcn.00405a14
jne 0x4e4742
lea eax, [ebp - 0x14]
mov edx, 0x4e5620
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e5648
call fcn.00405a14
jne 0x4e475e
lea eax, [ebp - 0x14]
mov edx, 0x4e5660
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e5688
call fcn.00405a14
jne 0x4e477a
lea eax, [ebp - 0x14]
mov edx, 0x4e56a0
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e56c8
call fcn.00405a14
jne 0x4e4796
lea eax, [ebp - 0x14]
mov edx, 0x4e56e0
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e5708
call fcn.00405a14
jne 0x4e47b2
lea eax, [ebp - 0x14]
mov edx, 0x4e5720
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e5748
call fcn.00405a14
jne 0x4e47ce
lea eax, [ebp - 0x14]
mov edx, 0x4e5760
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e5788
call fcn.00405a14
jne 0x4e47ea
lea eax, [ebp - 0x14]
mov edx, 0x4e57a0
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e57c8
call fcn.00405a14
jne 0x4e4806
lea eax, [ebp - 0x14]
mov edx, 0x4e57e4
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e5810
call fcn.00405a14
jne 0x4e4822
lea eax, [ebp - 0x14]
mov edx, 0x4e582c
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e5858
call fcn.00405a14
jne 0x4e483e
lea eax, [ebp - 0x14]
mov edx, 0x4e5874
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e58a0
call fcn.00405a14
jne 0x4e485a
lea eax, [ebp - 0x14]
mov edx, 0x4e58bc
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e58e8
call fcn.00405a14
jne 0x4e4876
lea eax, [ebp - 0x14]
mov edx, 0x4e5904
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e5930
call fcn.00405a14
jne 0x4e4892
lea eax, [ebp - 0x14]
mov edx, 0x4e594c
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e5978
call fcn.00405a14
jne 0x4e48ae
lea eax, [ebp - 0x14]
mov edx, 0x4e5994
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e59c0
call fcn.00405a14
jne 0x4e48ca
lea eax, [ebp - 0x14]
mov edx, 0x4e59dc
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e5a08
call fcn.00405a14
jne 0x4e48e6
lea eax, [ebp - 0x14]
mov edx, 0x4e5a24
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e5a50
call fcn.00405a14
jne 0x4e4902
lea eax, [ebp - 0x14]
mov edx, 0x4e5a6c
call fcn.0040568c
mov eax, dword [ebp - 4]
mov edx, 0x4e5a8c
call fcn.00405a14
jne 0x4e491e
lea eax, [ebp - 0x14]
mov edx, 0x4e5aa8
call fcn.0040568c
lea eax, [ebp - 0x188]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405914
mov eax, dword [ebp - 0x188]
push eax
lea eax, [ebp - 0x18c]
mov ecx, dword [ebp - 0x14]
mov edx, 0x4e5acc
call fcn.00405914
mov eax, dword [ebp - 0x18c]
mov cl, 1
pop edx
call fcn.004862cc
test al, al
je 0x4e4a6c
lea eax, [ebp - 0x190]
mov ecx, dword [ebp - 4]
mov edx, 0x4e5aec
call fcn.00405914
mov edx, dword [ebp - 0x190]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x194]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405914
mov eax, dword [ebp - 0x194]
call fcn.0040a76c
test al, al
je 0x4e4a4f
lea eax, [ebp - 0x198]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405914
mov edx, dword [ebp - 0x198]
lea eax, [ebp - 0x160]
call fcn.004035a0
mov edx, 1
lea eax, [ebp - 0x160]
call fcn.00403c04
call fcn.00402ef0
lea eax, [ebp - 0x160]
call fcn.00403844
call fcn.00402ef0
mov ebx, eax
lea edx, [ebp - 0x1a0]
mov eax, ebx
call fcn.0040a184
mov ecx, dword [ebp - 0x1a0]
lea eax, [ebp - 0x19c]
mov edx, 0x4e5b14
call fcn.00405914
mov edx, dword [ebp - 0x19c]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x160]
call fcn.00403668
call fcn.00402ef0
jmp 0x4e4aea
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e5b30
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4e4aea
push 0x4e5bb4
push dword [ebp - 4]
push 0x4e5bd4
lea eax, [ebp - 0x1a4]
mov edx, 3
call fcn.00405988
mov edx, dword [ebp - 0x1a4]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e5be0
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e5c30
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, 0x4e5c50
call fcn.0043e234
jmp 0x4e4e84
mov eax, 1
mov edx, dword [ebp - 4]
dec eax
test edx, edx
je 0x4e4afc
cmp eax, dword [edx - 4]
jb 0x4e4b01
call fcn.004045bc
inc eax
cmp byte [edx + eax - 1], 0x70
jne 0x4e4b49
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e5dd4
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x1a8]
mov ecx, 0x4e5e00
mov edx, dword [ebp - 8]
call fcn.00405914
mov edx, dword [ebp - 0x1a8]
mov cl, 1
mov eax, 0x4e5e18
call fcn.004862cc
mov eax, 1
mov edx, dword [ebp - 4]
dec eax
test edx, edx
je 0x4e4b5b
cmp eax, dword [edx - 4]
jb 0x4e4b60
call fcn.004045bc
inc eax
cmp byte [edx + eax - 1], 0x6f
jne 0x4e4ba8
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e5e4c
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x1ac]
mov ecx, 0x4e5e74
mov edx, dword [ebp - 8]
call fcn.00405914
mov edx, dword [ebp - 0x1ac]
mov cl, 1
mov eax, 0x4e5e88
call fcn.004862cc
push 0x4e5ebc
push dword [ebp - 8]
push dword [ebp - 4]
lea eax, [ebp - 0x1b0]
mov edx, 3
call fcn.00405988
mov edx, dword [ebp - 0x1b0]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0xc]
mov edx, 0x4e5ee0
mov eax, dword [ebp - 4]
call fcn.0040aa8c
lea eax, [ebp - 0x1b4]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4e5ef0
call fcn.00405914
mov edx, dword [ebp - 0x1b4]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 2
lea eax, [ebp - 0x1b8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405914
mov eax, dword [ebp - 0x1b8]
mov ecx, 0x4e5f20
mov edx, dword [ebp - 0xc]
call fcn.0048859c
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e5f38
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 8]
push eax
lea edx, [ebp - 0x1bc]
mov eax, dword [ebp - 4]
call fcn.00409970
mov ecx, dword [ebp - 0x1bc]
mov edx, 0x4e4ef4
mov eax, 0x80000001
call fcn.00488a9c
lea eax, [ebp - 0x1c0]
mov ecx, dword [ebp - 4]
mov edx, 0x4e5f70
call fcn.00405914
mov edx, dword [ebp - 0x1c0]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov ecx, dword [eax]
call dword [ecx + 0x38]
call fcn.004889ac
test al, al
je 0x4e4e17
lea eax, [ebp - 0x1c8]
mov edx, 1
mov ecx, dword [ebp - 4]
dec edx
test ecx, ecx
je 0x4e4cda
cmp edx, dword [ecx - 4]
jb 0x4e4cdf
call fcn.004045bc
inc edx
movzx edx, byte [ecx + edx - 1]
call fcn.004057dc
mov eax, dword [ebp - 0x1c8]
lea edx, [ebp - 0x1c4]
call fcn.00409970
mov eax, dword [ebp - 0x1c4]
mov edx, 0x4e5fac
call fcn.00405a14
jne 0x4e4d33
lea eax, [ebp - 0x1cc]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405914
mov ecx, dword [ebp - 0x1cc]
mov edx, 0x4e5fb8
mov eax, 0x4e5fd4
call fcn.00488780
lea eax, [ebp - 0x1d4]
mov edx, 1
mov ecx, dword [ebp - 4]
dec edx
test ecx, ecx
je 0x4e4d4b
cmp edx, dword [ecx - 4]
jb 0x4e4d50
call fcn.004045bc
inc edx
movzx edx, byte [ecx + edx - 1]
call fcn.004057dc
mov eax, dword [ebp - 0x1d4]
lea edx, [ebp - 0x1d0]
call fcn.00409970
mov eax, dword [ebp - 0x1d0]
mov edx, 0x4e5fe4
call fcn.00405a14
jne 0x4e4da4
lea eax, [ebp - 0x1d8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405914
mov ecx, dword [ebp - 0x1d8]
mov edx, 0x4e5ff0
mov eax, 0x4e600c
call fcn.00488780
lea eax, [ebp - 0x1e0]
mov edx, 1
mov ecx, dword [ebp - 4]
dec edx
test ecx, ecx
je 0x4e4dbc
cmp edx, dword [ecx - 4]
jb 0x4e4dc1
call fcn.004045bc
inc edx
movzx edx, byte [ecx + edx - 1]
call fcn.004057dc
mov eax, dword [ebp - 0x1e0]
lea edx, [ebp - 0x1dc]
call fcn.00409970
mov eax, dword [ebp - 0x1dc]
mov edx, 0x4e601c
call fcn.00405a14
jne 0x4e4e3c
lea eax, [ebp - 0x1e4]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405914
mov ecx, dword [ebp - 0x1e4]
mov edx, 0x4e6028
mov eax, 0x4e6040
call fcn.00488780
jmp 0x4e4e3c
mov eax, 0x4e6050
call fcn.0043e234
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e626c
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4f65e4]
mov eax, dword [eax + 0x3c4]
mov eax, dword [eax + 0x270]
mov edx, 0x4e5c30
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp byte [0x4f65fd], 0
je 0x4e4e84
push 5
lea eax, [ebp - 0x1e8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405914
mov eax, dword [ebp - 0x1e8]
call fcn.00405ac8
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4eb6
lea eax, [ebp - 0x1e8]
mov edx, 0x22
call fcn.00405618
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00405618
ret