Function at 0x4ac7f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4acb50
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov edx, 0x4acb68
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4acbb8
mov eax, dword [ebx + 0x398]
call fcn.00410aa8
test al, al
je 0x4ac89f
push 5
push 0
push 0x4acbdc
push 0x4acc38
push 0x4acc54
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
ja 0x4ac884
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 4]
call fcn.004151ac
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4acb35
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov edx, 0x4acc6c
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4acb35
mov edx, 0x4acd44
mov eax, dword [ebx + 0x398]
call fcn.00410aa8
test al, al
je 0x4ac913
push 5
push 0
push 0x4acd68
push 0x4acc38
push 0x4acc54
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
ja 0x4ac8f8
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 8]
call fcn.004151ac
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4acb35
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov edx, 0x4acc6c
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4acb35
mov edx, 0x4acdd8
mov eax, dword [ebx + 0x398]
call fcn.00410aa8
test al, al
je 0x4ac987
push 5
push 0
push 0x4ace00
push 0x4acc38
push 0x4acc54
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
ja 0x4ac96c
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0xc]
call fcn.004151ac
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4acb35
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov edx, 0x4acc6c
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4acb35
mov edx, 0x4ace70
mov eax, dword [ebx + 0x398]
call fcn.00410aa8
test al, al
je 0x4ac9fb
push 5
push 0
push 0x4ace88
push 0x4acc38
push 0x4acc54
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
ja 0x4ac9e0
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x10]
call fcn.004151ac
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4acb35
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov edx, 0x4acc6c
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4acb35
mov edx, 0x4acef8
mov eax, dword [ebx + 0x398]
call fcn.00410aa8
test al, al
je 0x4aca6f
push 5
push 0
push 0x4acf14
push 0x4acc38
push 0x4acc54
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
ja 0x4aca54
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x14]
call fcn.004151ac
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4acb35
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov edx, 0x4acc6c
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4acb35
mov edx, 0x4acf84
mov eax, dword [ebx + 0x398]
call fcn.00410aa8
test al, al
je 0x4acadd
push 5
push 0
push 0x4acfa0
push 0x4acc38
push 0x4acc54
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
ja 0x4acac5
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x18]
call fcn.004151ac
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4acb35
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov edx, 0x4acc6c
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4acb35
push 5
push 0
push 0x4acbdc
push 0x4acc38
push 0x4acc54
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
ja 0x4acb1f
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x1c]
call fcn.004151ac
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4acb35
mov eax, dword [ebx + 0x388]
mov eax, dword [eax + 0x2a0]
mov edx, 0x4acc6c
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acb57
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004068a8
ret