Function at 0x4a9604
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4a960c
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4a9905
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
call fcn.00403300
mov eax, 0x64
call fcn.00403328
mov esi, eax
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004a99e4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00408bb8
mov eax, dword [ebx + 0x394]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4a9669
mov edi, 1
jmp 0x4a966b
xor edi, edi
lea eax, [ebp - 8]
push eax
mov ecx, esi
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0048ef90
test al, al
jne 0x4a969d
push 0x40
push 0x4a9918
push 0x4a9920
mov eax, ebx
call fcn.0044b8b4
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x4a98dd
lea eax, [ebp - 0x14]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405048
mov eax, dword [ebp - 0x14]
mov edx, 0x4a993c
call fcn.00404f78
jne 0x4a96fe
push 0x40
push 0x4a9918
push 0x4a9948
push dword [ebp - 4]
push 0x4a9958
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404ee4
mov eax, dword [ebp - 0x18]
call fcn.00404fe0
push eax
mov eax, ebx
call fcn.0044b8b4
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x4a98dd
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405048
mov eax, dword [ebp - 0x1c]
mov edx, 0x4a9970
call fcn.00404f78
jne 0x4a975e
push 0x40
push 0x4a9918
push 0x4a9974
mov eax, ebx
call fcn.0044b8b4
push eax
call sub.user32.dll_MessageBoxA_1
push 1
push 0
push 0
push 0x4a9984
push 0x4a999c
mov eax, ebx
call fcn.0044b8b4
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4a98dd
lea eax, [ebp - 0x20]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405048
mov eax, dword [ebp - 0x20]
mov edx, 0x4a99ac
call fcn.00404f78
jne 0x4a97bb
lea eax, [ebp - 8]
push eax
mov ecx, 0x7fffffff
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00405048
push 0x40
push 0x4a9918
mov eax, dword [ebp - 8]
call fcn.00404fe0
push eax
mov eax, ebx
call fcn.0044b8b4
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x4a98dd
lea eax, [ebp - 0x24]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405048
mov eax, dword [ebp - 0x24]
mov edx, 0x4a99b8
call fcn.00404f78
jne 0x4a98c4
lea eax, [ebp - 8]
push eax
mov ecx, 0x7fffffff
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00405048
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x20
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405048
mov eax, dword [ebp - 0x28]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.0048f5c8
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00404f78
je 0x4a9848
push 0x40
push 0x4a9918
push 0x4a99bc
mov eax, ebx
call fcn.0044b8b4
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x4a98dd
lea eax, [ebx + 0x410]
push eax
mov ecx, 0x12
mov edx, 0x21
mov eax, dword [ebp - 8]
call fcn.00405048
lea eax, [ebx + 0x414]
push eax
mov ecx, 0x12
mov edx, 0x33
mov eax, dword [ebp - 8]
call fcn.00405048
lea eax, [ebx + 0x418]
push eax
mov ecx, 0x12
mov edx, 0x45
mov eax, dword [ebp - 8]
call fcn.00405048
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x7fffffff
mov edx, 0x57
mov eax, dword [ebp - 8]
call fcn.00405048
mov eax, dword [ebp - 0x30]
call fcn.0040ca44
fstp qword [ebx + 0x408]
wait
mov dword [ebx + 0x41c], esi
mov byte [ebp - 9], 1
jmp 0x4a98dd
push 0x40
push 0x4a9918
push 0x4a99cc
mov eax, ebx
call fcn.0044b8b4
push eax
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a990c
lea eax, [ebp - 0x30]
mov edx, 9
call fcn.00404b74
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b74
ret