Function at 0x4bf39c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4bf668
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov byte [esi + 0x420], 0
mov eax, esi
call fcn.004bf2fc
test al, al
jne 0x4bf3e9
mov eax, 0x4bf680
call fcn.0049e180
jmp 0x4bf638
cmp dword [0x4c613c], 0
je 0x4bf403
mov eax, dword [0x4c613c]
call fcn.00403a70
xor eax, eax
mov dword [0x4c613c], eax
mov eax, dword [0x4c3b0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b0]
mov edx, dword [eax]
call dword [edx + 0xc4]
test al, al
jne 0x4bf4a1
lea edx, [ebp - 0x5c]
mov eax, dword [0x4c3b0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x31c]
call fcn.0044a044
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x58]
call fcn.00408f48
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x54]
mov edx, 0x4bf6a0
call fcn.00404b64
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x4a130c]
call fcn.004a1384
mov dword [0x4c613c], eax
mov eax, dword [0x4c613c]
cmp byte [eax + 0x10], 0
je 0x4bf4a1
mov eax, dword [0x4c613c]
call fcn.004a1884
test al, al
je 0x4bf487
mov eax, dword [0x4c613c]
call fcn.004a194c
mov eax, dword [0x4c613c]
mov eax, dword [eax + 0x14]
mov edx, dword [eax]
call dword [edx + 0x14]
test al, al
je 0x4bf4a1
xor edx, edx
mov eax, esi
call fcn.004c0960
mov eax, 0x4bf6b4
call fcn.0049df64
mov dl, 1
mov eax, dword [esi + 0x35c]
call fcn.0048f76c
xor edx, edx
mov eax, dword [esi + 0x334]
call fcn.00456bc8
mov dl, 1
mov eax, dword [esi + 0x338]
call fcn.00456bc8
mov byte [esi + 0x450], 1
mov edx, 0x4bf6c4
mov eax, esi
call fcn.004bf7c8
xor edx, edx
mov eax, esi
call fcn.004bf824
mov edx, 1
mov eax, esi
call fcn.004c0374
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00403200
mov dword [ebp - 0x50], 0x44
mov ebx, 0x8000000
lea eax, [ebp - 4]
push eax
mov ecx, 0x4bf6b4
mov edx, dword [esi + 0x42c]
pop eax
call fcn.00404b64
xor edi, edi
lea edx, [ebp - 0xc]
mov eax, 0x4bf6dc
call fcn.0049e014
test al, al
jne 0x4bf556
mov eax, dword [0x4c3b0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x4cc]
mov edx, dword [eax]
call dword [edx + 0xc4]
test al, al
je 0x4bf55b
mov edi, 0x4bf6ec
mov eax, dword [esi + 0x430]
call fcn.0049de70
mov dword [0x4c6144], eax
cmp dword [esi + 0x438], 2
jne 0x4bf57a
add ebx, 0x400
mov word [ebp - 0x20], 0
mov dword [ebp - 0x24], 0x181
mov eax, dword [0x4c6144]
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x43c]
push eax
lea eax, [ebp - 0x50]
push eax
mov eax, dword [esi + 0x42c]
call fcn.00404d10
push eax
push 0
push ebx
push 0xffffffffffffffff
push 0
push 0
push edi
mov eax, dword [ebp - 4]
call fcn.00404d10
push eax
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
je 0x4bf622
mov eax, dword [esi + 0x44c]
test eax, eax
je 0x4bf5d9
call fcn.00403a70
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x444]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0
lea edx, [ebp - 0x64]
xor ecx, ecx
mov eax, 0x4bf6f8
call fcn.0040a164
push 1
push 0
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x48d874]
call fcn.0048d970
mov dword [esi + 0x44c], eax
mov eax, dword [esi + 0x460]
call fcn.00427588
jmp 0x4bf638
push 0
push 2
push 0x805
mov eax, esi
call fcn.00450820
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf66f
lea eax, [ebp - 0x5c]
call fcn.00404860
lea eax, [ebp - 0x58]
mov edx, 2
call fcn.00404884
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404884
ret