Function at 0x4a7464
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x4a778a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4c3fe8]
cmp byte [eax], 0
jne 0x4a7744
cmp byte [0x4c3888], 0
je 0x4a7621
mov eax, dword [0x4c4190]
mov eax, dword [eax]
mov eax, dword [eax + 0x3e8]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4a7601
mov eax, 0x4a77a0
call fcn.004b3ba4
lea ecx, [ebp - 8]
mov eax, dword [0x4c3fdc]
mov eax, dword [eax]
mov edx, 0x4a77c0
call fcn.00481078
mov edx, dword [ebp - 8]
mov eax, dword [0x4c4190]
mov eax, dword [eax]
mov eax, dword [eax + 0x370]
call fcn.0048aef8
lea eax, [ebp - 0xc]
call fcn.004a6ca8
mov edx, dword [ebp - 0xc]
mov eax, 0x4c6438
call fcn.00404dac
cmp dword [0x4c6438], 0
je 0x4a75e1
lea ecx, [ebp - 0x10]
mov eax, dword [0x4c3fdc]
mov eax, dword [eax]
mov edx, 0x4a77e8
call fcn.00481078
mov edx, dword [ebp - 0x10]
mov eax, dword [0x4c4190]
mov eax, dword [eax]
mov eax, dword [eax + 0x374]
call fcn.0048aef8
mov eax, dword [0x4c4190]
mov eax, dword [eax]
mov ebx, dword [eax + 0x37c]
mov eax, ebx
call fcn.00441d74
mov edx, eax
sar edx, 1
jns 0x4a7552
adc edx, 0
mov eax, dword [0x4c4190]
mov eax, ebx
call fcn.00441f5c
mov eax, 0x4c6438
mov edx, 0x4a780c
call fcn.00405030
lea eax, [ebp - 0x14]
mov ecx, dword [0x4c6438]
mov edx, 0x4a7824
call fcn.00405074
mov eax, dword [ebp - 0x14]
call fcn.004b3ba4
push 0
mov eax, dword [0x4c6438]
call fcn.00405228
push eax
call sub.kernel32.dll_WinExec
call fcn.004a72c4
mov eax, dword [0x4c4190]
mov eax, dword [eax]
mov ebx, dword [eax + 0x37c]
mov eax, ebx
call fcn.00441d74
mov edx, eax
mov eax, dword [0x4c4190]
mov eax, ebx
call fcn.00441f5c
push 0x80000001
push 0
mov ecx, 0x4a785c
mov edx, 0x4a7878
mov eax, 0x4a78c0
call fcn.004a2494
jmp 0x4a76df
push 0x80000001
push 0
mov ecx, 0x4a785c
mov edx, 0x4a78dc
mov eax, 0x4a78c0
call fcn.004a2494
jmp 0x4a76df
push 0x80000001
push 0
mov ecx, 0x4a785c
mov edx, 0x4a78dc
mov eax, 0x4a78c0
call fcn.004a2494
jmp 0x4a76df
lea eax, [ebp - 4]
mov edx, 0x4a792c
call fcn.00404df0
test dword [0x4c3884], 1
jle 0x4a7647
lea eax, [ebp - 4]
mov edx, 0x4a7940
call fcn.00405030
test dword [0x4c3884], 2
jle 0x4a7660
lea eax, [ebp - 4]
mov edx, 0x4a7958
call fcn.00405030
test dword [0x4c3884], 4
jle 0x4a7679
lea eax, [ebp - 4]
mov edx, 0x4a7970
call fcn.00405030
test dword [0x4c3884], 8
jle 0x4a7692
lea eax, [ebp - 4]
mov edx, 0x4a7990
call fcn.00405030
test dword [0x4c3884], 0x10
jle 0x4a76ab
lea eax, [ebp - 4]
mov edx, 0x4a79a8
call fcn.00405030
push 0x80000001
push 0
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, 0x4a79c4
call fcn.00405074
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.00405684
mov edx, dword [ebp - 0x18]
mov ecx, 0x4a785c
mov eax, 0x4a78c0
call fcn.004a2494
push 0x80000001
push 0
mov eax, dword [0x4c4190]
mov eax, dword [eax]
mov eax, dword [eax + 0x3e8]
mov edx, dword [eax]
call dword [edx + 0xc8]
xor ecx, ecx
mov edx, 1
call fcn.0042f4a4
mov edx, eax
mov ecx, 0x4a79dc
mov eax, 0x4a7a00
call fcn.004a2408
mov ecx, 0x80000001
mov edx, 0x4a7a14
mov eax, 0x4a7a3c
call fcn.004a25b4
test al, al
je 0x4a7744
mov ecx, 0x80000001
mov edx, 0x4a7a14
mov eax, 0x4a7a3c
call fcn.004a2530
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7791
lea eax, [ebp - 0x1c]
call fcn.00404d58
lea eax, [ebp - 0x18]
call fcn.004054b0
lea eax, [ebp - 0x14]
call fcn.00404d58
lea eax, [ebp - 0x10]
call fcn.004054b0
lea eax, [ebp - 0xc]
call fcn.00404d58
lea eax, [ebp - 8]
call fcn.004054b0
lea eax, [ebp - 4]
call fcn.00404d58
ret