Function at 0x4e8e78
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
movsx eax, byte [esi]
cmp eax, 0x61
jb 0x4e8e95
sub eax, 0x20
cmp eax, 0x41
jb 0x4e8ea5
cmp eax, 0x5a
ja 0x4e8ea5
cmp byte [esi + 1], 0x3a
je 0x4e8ec3
push 0x2f
push esi
call fcn.004e7a78
add esp, 8
test eax, eax
jne 0x4e8ec3
push 0x5c
push esi
call fcn.004e7a78
add esp, 8
test eax, eax
je 0x4e8ec8
xor edx, edx
mov dword [ebp + 0x18], edx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
push 0x5c
push esi
call fcn.004e7cd4
add esp, 8
mov edi, eax
test eax, eax
je 0x4e8ee1
inc edi
jmp 0x4e8ee3
mov edi, esi
push 0x2e
push edi
call fcn.004e7cd4
add esp, 8
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4e8f4b
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x118]
push edx
push 0x5c48c1
push ecx
push esi
call fcn.004e8c70
add esp, 0x10
mov edi, eax
test eax, eax
je 0x4e8faa
push 0x5c48c2
mov edx, dword [ebp - 0x10]
push edx
call fcn.004e7b24
add esp, 8
test eax, eax
je 0x4e8f42
push 0x5c48c7
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004e7b24
add esp, 8
test eax, eax
jne 0x4e8faa
mov dword [ebp - 0x14], 1
jmp 0x4e8faa
mov eax, dword [ebp + 0x18]
lea edx, [ebp - 0x118]
push eax
push str..EXE
push edx
push esi
call fcn.004e8c70
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x4e8faa
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x118]
push edx
push str..BAT
push ecx
push esi
call fcn.004e8c70
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x4e8faa
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x118]
push edx
push str..CMD
push ecx
push esi
call fcn.004e8c70
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x14], eax
test edi, edi
je 0x4e8fc6
cmp dword [ebp - 0x14], 0
je 0x4e8fd9
push 0x5c48db
call fcn.004e84ac
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x4e8fd9
call fcn.004e7e90
mov dword [eax], 2
or eax, 0xffffffff
jmp 0x4e92a3
cmp dword [ebp - 0x14], 0
je 0x4e8ff8
mov edx, dword [ebp + 0x10]
push edx
push 0x5c48e3
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004e8d28
add esp, 0xc
mov edi, eax
jmp 0x4e9011
mov eax, dword [ebp + 0x10]
add eax, 4
push eax
push 0
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx]
push ecx
call fcn.004e8d28
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x4e9028
call fcn.004e7e90
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x4e92a3
cmp dword [ebp + 0x14], 0
jne 0x4e9035
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4e9060
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.004e8e14
pop ecx
mov dword [ebp - 8], eax
test eax, eax
jne 0x4e9060
call fcn.004e7e90
mov dword [eax], 8
push edi
call fcn.004833dc
pop ecx
or eax, 0xffffffff
jmp 0x4e92a3
call dword [0x5c47cc]
push 0x44
push 0
lea edx, [ebp - 0x168]
push edx
call fcn.004e0898
add esp, 0xc
mov dword [ebp - 0x168], 0x44
mov word [ebp - 0x138], 0xa
cmp dword [0x5c2ff8], 0
je 0x4e90c9
push 0
call dword [0x5c2ff0]
pop ecx
mov esi, eax
mov word [ebp - 0x136], si
movzx eax, si
push eax
call fcn.004dfa10
pop ecx
mov dword [ebp - 0x134], eax
test eax, eax
je 0x4e9046
mov edx, dword [ebp - 0x134]
push edx
call dword [0x5c2ff0]
pop ecx
mov dword [ebp - 0x124], 0xc
xor ecx, ecx
xor esi, esi
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], 1
test bl, 0x20
je 0x4e90f1
or esi, 0x10
jmp 0x4e90f9
test bl, 0x10
je 0x4e90f9
or esi, 8
test bl, 0x40
je 0x4e9104
or esi, 0x200
test bl, 0x80
je 0x4e910c
or esi, 4
test bh, 2
je 0x4e9119
or esi, 0x800
jmp 0x4e9124
test bh, 4
je 0x4e9124
or esi, 0x1000
test bh, 8
je 0x4e912f
or esi, 0x4000000
test bh, 0x20
je 0x4e9139
or esi, 0x20
jmp 0x4e915b
test bh, 0x10
je 0x4e9143
or esi, 0x40
jmp 0x4e915b
test bh, 0x40
je 0x4e9150
or esi, 0x80
jmp 0x4e915b
test bh, 0x80
je 0x4e915b
or esi, 0x100
lea eax, [ebp - 0x178]
lea edx, [ebp - 0x168]
push eax
push edx
push 0
lea eax, [ebp - 0x124]
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x124]
push ecx
push esi
push 1
push eax
push edx
push edi
cmp dword [ebp - 0x14], 0
je 0x4e918c
mov ecx, dword [ebp - 0xc]
jmp 0x4e9192
lea ecx, [ebp - 0x118]
push ecx
call sub.KERNEL32.DLL_CreateProcessA
dec eax
je 0x4e91dd
call sub.KERNEL32.DLL_GetLastError
and eax, 0xffff
dec eax
je 0x4e91bb
sub eax, 7
je 0x4e91c2
sub eax, 0x51
je 0x4e91b4
jmp 0x4e91c9
mov ebx, 0x2a
jmp 0x4e91ce
mov ebx, 0x13
jmp 0x4e91ce
mov ebx, 8
jmp 0x4e91ce
mov ebx, 0x15
call fcn.004e7e90
mov dword [eax], ebx
or esi, 0xffffffff
jmp 0x4e9290
cmp ebx, 0x10
jne 0x4e91e7
mov ebx, 4
mov eax, ebx
and eax, 7
sub eax, 1
jb 0x4e91fe
je 0x4e9243
dec eax
je 0x4e925e
dec eax
sub eax, 2
jb 0x4e9232
jmp 0x4e9277
push 0xffffffffffffffff
mov edx, dword [ebp - 0x178]
push edx
call sub.KERNEL32.DLL_WaitForSingleObject
lea ecx, [ebp - 4]
push ecx
mov eax, dword [ebp - 0x178]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
test bh, 1
jne 0x4e922d
mov edx, dword [ebp - 0x178]
push edx
call sub.KERNEL32.DLL_CloseHandle
mov esi, dword [ebp - 4]
jmp 0x4e927a
test bh, 1
jne 0x4e9243
mov eax, dword [ebp - 0x178]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov edx, dword [ebp - 0x178]
push edx
mov ecx, dword [ebp - 0x170]
push ecx
call dword [0x5c48b8]
add esp, 8
mov esi, eax
jmp 0x4e927a
mov eax, dword [ebp - 8]
push eax
call fcn.004833dc
pop ecx
push edi
call fcn.004833dc
pop ecx
push 0
call fcn.004e845c
pop ecx
or esi, 0xffffffff
test bl, 0x80
jne 0x4e9290
test bh, 1
jne 0x4e9290
mov eax, dword [ebp - 0x174]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov edx, dword [ebp - 8]
push edx
call fcn.004833dc
pop ecx
push edi
call fcn.004833dc
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret