Function at 0x4ad1d0
Capabilities:
Create process on windows
Create process suspended
Get common file path
Hide graphical window
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf80
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xf80]
mov ecx, 0x3e0
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x5ddc34]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
push 0x44
push 0
lea eax, [ebp - 0x58]
push eax
call fcn.004f6010
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0xa4]
push eax
call fcn.004f6010
add esp, 0xc
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0xa4], 0x44
mov esi, esp
push 0x5901d4
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x508]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x508]
mov edx, dword [eax + 0x2c]
call edx
cmp esi, esp
call fcn.004f4cf0
mov esi, esp
push 0x5901d4
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x504]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x504]
mov edx, dword [eax + 0x2c]
call edx
cmp esi, esp
call fcn.004f4cf0
xor eax, eax
mov word [ebp - 0x4f4], ax
push 0x206
push 0
lea eax, [ebp - 0x4f2]
push eax
call fcn.004f6010
add esp, 0xc
xor eax, eax
mov word [ebp - 0x704], ax
push 0x206
push 0
lea eax, [ebp - 0x702]
push eax
call fcn.004f6010
add esp, 0xc
mov esi, esp
push 0x103
lea eax, [ebp - 0x2e4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp esi, esp
call fcn.004f4cf0
push 0x5c
lea eax, [ebp - 0x2e4]
push eax
call fcn.004014f1
add esp, 8
mov dword [ebp - 0x710], eax
mov eax, dword [ebp - 0x710]
add eax, 2
mov dword [ebp - 0x710], eax
xor eax, eax
mov ecx, dword [ebp - 0x710]
mov word [ecx], ax
lea eax, [ebp - 0x2e4]
push eax
lea ecx, [ebp - 0x4f4]
push ecx
call fcn.00401140
add esp, 8
push str.LinLogin.bin
lea eax, [ebp - 0x4f4]
push eax
call fcn.004018e3
add esp, 8
push 0x5d93f0
lea eax, [ebp - 0x704]
push eax
call fcn.00401140
add esp, 8
mov esi, esp
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0xa4]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x704]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp esi, esp
call fcn.004f4cf0
xor eax, eax
mov word [ebp - 0x920], ax
push 0x206
push 0
lea eax, [ebp - 0x91e]
push eax
call fcn.004f6010
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0x4f4]
push eax
push 0x58f9a8
lea ecx, [ebp - 0x920]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp esi, esp
call fcn.004f4cf0
xor eax, eax
mov word [ebp - 0xb30], ax
push 0x206
push 0
lea eax, [ebp - 0xb2e]
push eax
call fcn.004f6010
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0x2e4]
push eax
push 0x58f9a8
lea ecx, [ebp - 0xb30]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp esi, esp
call fcn.004f4cf0
mov esi, esp
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 0xb30]
push edx
push 0
push 0x404
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x920]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp esi, esp
call fcn.004f4cf0
test eax, eax
je 0x4ad943
push 1
mov eax, dword [ebp - 0xb4]
push eax
call fcn.0040101e
add esp, 8
mov dword [ebp - 0xb3c], eax
cmp dword [ebp - 0xb3c], 0
jne 0x4ad4b0
mov esi, esp
push 0x40
push 0x590d58
push 0x590ec4
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.004f4cf0
mov esi, esp
push 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x4c8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x4c8]
mov edx, dword [eax + 0xd8]
call edx
cmp esi, esp
call fcn.004f4cf0
jmp 0x4ad9af
push 0x20
mov eax, dword [ebp - 0xc]
imul ecx, dword [eax + 0x720], 0xd5
mov edx, dword [ebp - 0xc]
lea eax, [edx + ecx + 0x768]
push eax
mov ecx, dword [ebp - 0xb3c]
push ecx
call fcn.004f57f0
add esp, 0xc
push 0x10
mov eax, dword [ebp - 0xc]
imul ecx, dword [eax + 0x720], 0xd5
mov edx, dword [ebp - 0xc]
lea eax, [edx + ecx + 0x78d]
push eax
mov ecx, dword [ebp - 0xb3c]
add ecx, 0x26
push ecx
call fcn.004f57f0
add esp, 0xc
mov eax, dword [ebp - 0xc]
imul ecx, dword [eax + 0x720], 0xd5
mov edx, dword [ebp - 0xb3c]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + ecx + 0x788]
mov dword [edx + 0x20], ecx
mov eax, dword [ebp - 0xc]
imul ecx, dword [eax + 0x720], 0xd5
mov edx, dword [ebp - 0xb3c]
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + ecx + 0x79d]
mov byte [edx + 0x24], cl
mov eax, dword [ebp - 0xc]
imul ecx, dword [eax + 0x720], 0xd5
mov edx, dword [ebp - 0xb3c]
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + ecx + 0x79e]
mov byte [edx + 0x25], cl
mov eax, dword [ebp - 0xc]
imul ecx, dword [eax + 0x720], 0xd5
mov edx, dword [ebp - 0xb3c]
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + ecx + 0x79f]
mov byte [edx + 0x36], cl
mov eax, dword [ebp - 0xb3c]
mov byte [eax + 0x37], 1
mov eax, dword [ebp - 0xc]
imul ecx, dword [eax + 0x720], 0xd5
mov edx, dword [ebp - 0xb3c]
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + ecx + 0x7e0]
mov byte [edx + 0x79], cl
mov eax, dword [ebp - 0xc]
imul ecx, dword [eax + 0x720], 0xd5
mov edx, dword [ebp - 0xb3c]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + ecx + 0x7e5]
mov dword [edx + 0x80], ecx
mov eax, dword [ebp - 0xc]
imul ecx, dword [eax + 0x720], 0xd5
mov edx, dword [ebp - 0xb3c]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + ecx + 0x7e9]
mov dword [edx + 0x7c], ecx
push 0x20
mov eax, dword [ebp - 0xc]
imul ecx, dword [eax + 0x720], 0xd5
mov edx, dword [ebp - 0xc]
lea eax, [edx + ecx + 0x7a0]
push eax
mov ecx, dword [ebp - 0xb3c]
add ecx, 0x38
push ecx
call fcn.004f57f0
add esp, 0xc
mov eax, dword [ebp - 0xb3c]
mov byte [eax + 0x78], 0
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 0xb3c]
mov al, byte [ecx + 0x5d94f0]
mov byte [edx + 0x84], al
mov eax, 1
shl eax, 0
mov ecx, dword [ebp - 0xb3c]
mov dl, byte [eax + 0x5d94f0]
mov byte [ecx + 0x85], dl
mov eax, 1
shl eax, 1
mov ecx, dword [ebp - 0xb3c]
mov dl, byte [eax + 0x5d94f0]
mov byte [ecx + 0x86], dl
mov eax, 1
imul ecx, eax, 3
mov edx, dword [ebp - 0xb3c]
mov al, byte [ecx + 0x5d94f0]
mov byte [edx + 0x87], al
mov eax, 1
shl eax, 2
mov ecx, dword [ebp - 0xb3c]
mov dl, byte [eax + 0x5d94f0]
mov byte [ecx + 0x88], dl
mov eax, 1
imul ecx, eax, 5
mov edx, dword [ebp - 0xb3c]
mov al, byte [ecx + 0x5d94f0]
mov byte [edx + 0x89], al
mov eax, 1
imul ecx, eax, 6
mov edx, dword [ebp - 0xb3c]
mov al, byte [ecx + 0x5d94f0]
mov byte [edx + 0x8a], al
mov eax, 1
imul ecx, eax, 7
mov edx, dword [ebp - 0xb3c]
mov al, byte [ecx + 0x5d94f0]
mov byte [edx + 0x8b], al
mov eax, 1
shl eax, 3
mov ecx, dword [ebp - 0xb3c]
mov dl, byte [eax + 0x5d94f0]
mov byte [ecx + 0x8c], dl
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xb3c]
mov al, byte [ecx + 0x5d94f0]
mov byte [edx + 0x8d], al
cmp dword [0x5e37b8], 0
je 0x4ad746
mov eax, dword [ebp - 0xb3c]
mov ecx, dword [0x5e37b8]
mov dword [eax + 0x90], ecx
mov esi, esp
lea eax, [ebp - 0xc48]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp esi, esp
call fcn.004f4cf0
push str.LauncherDll.dll
lea eax, [ebp - 0xc48]
push eax
call fcn.0040114a
add esp, 8
lea eax, [ebp - 0xc48]
push eax
mov ecx, dword [ebp - 0xb4]
push ecx
call fcn.00401177
add esp, 8
test eax, eax
jne 0x4ad7f5
mov esi, esp
push 0
push 0x590efc
push 0x590f04
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.004f4cf0
mov esi, esp
push 0
mov eax, dword [ebp - 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp esi, esp
call fcn.004f4cf0
mov esi, esp
push 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x4c8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x4c8]
mov edx, dword [eax + 0xd8]
call edx
cmp esi, esp
call fcn.004f4cf0
jmp 0x4ad9af
mov esi, esp
mov eax, dword [ebp - 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.004f4cf0
mov esi, esp
push 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, esp
call fcn.004f4cf0
mov eax, dword [ebp - 0xb3c]
movzx ecx, byte [eax + 0x78]
test ecx, ecx
jne 0x4ad845
mov esi, esp
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.004f4cf0
call fcn.004019dd
push 0x44
push 0
lea eax, [ebp - 0xc94]
push eax
call fcn.004f6010
add esp, 0xc
mov dword [ebp - 0xc94], 0x44
mov esi, esp
lea eax, [ebp - 0xebc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp esi, esp
call fcn.004f4cf0
push str.C:WINDOWSsystem32cmd.exe_ipconfig_flushdns
lea eax, [ebp - 0xebc]
push eax
call fcn.004018e3
add esp, 8
mov esi, esp
lea eax, [ebp - 0xcac]
push eax
lea ecx, [ebp - 0xc94]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0xebc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp esi, esp
call fcn.004f4cf0
test eax, eax
je 0x4ad8e4
mov esi, esp
push 0xffffffffffffffff
mov eax, dword [ebp - 0xcac]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, esp
call fcn.004f4cf0
cmp dword [0x5e37bc], 0
je 0x4ad908
mov eax, dword [ebp - 0xb4]
push eax
mov ecx, dword [ebp - 0xbc]
push ecx
mov ecx, dword [0x5e37bc]
call fcn.00401122
jmp 0x4ad941
push 0
push 0xf020
push 0x112
mov ecx, dword [ebp - 0xc]
call fcn.00410c30
push 0
push 0xf060
push 0x112
mov ecx, dword [ebp - 0xc]
call fcn.00410c30
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x4ad988
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.004f4cf0
push eax
push 0x590f90
lea eax, [ebp - 0x4f4]
push eax
call fcn.00401bd6
add esp, 0xc
mov esi, esp
push 0
push 0
lea eax, [ebp - 0x4f4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.004f4cf0
mov esi, esp
push 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x4c8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x4c8]
mov edx, dword [eax + 0xd8]
call edx
cmp esi, esp
call fcn.004f4cf0
push edx
mov ecx, ebp
push eax
lea edx, [0x4ad9e0]
call fcn.004f4c90
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f4d70
add esp, 0xf80
cmp ebp, esp
call fcn.004f4cf0
mov esp, ebp
pop ebp
ret