Function at 0x4e3888
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4e3ac8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x428]
call fcn.00406e10
mov edi, eax
dec edi
test edi, edi
jl 0x4e398d
inc edi
xor ebx, ebx
mov eax, 0x4e3ae8
lea edx, [ebx + ebx*4]
mov ecx, dword [esi + 0x428]
mov edx, dword [ecx + edx*8 + 0xc]
call fcn.00406044
jne 0x4e392b
lea eax, [ebx + ebx*4]
mov edx, dword [esi + 0x428]
cmp dword [edx + eax*8 + 4], 0
je 0x4e3901
mov dword [ebp - 0x14], 0xffffffff
jmp 0x4e3985
lea eax, [ebx + ebx*4]
mov edx, dword [esi + 0x428]
mov eax, dword [edx + eax*8 + 0x1c]
test eax, eax
je 0x4e3924
cmp byte [eax + 0x1c0], 0
jne 0x4e3924
mov dword [ebp - 0x14], 0xffffffff
jmp 0x4e3985
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x4e3985
mov eax, 0x4e3b10
lea edx, [ebx + ebx*4]
mov ecx, dword [esi + 0x428]
mov edx, dword [ecx + edx*8 + 0xc]
call fcn.00406044
jne 0x4e3985
lea eax, [ebx + ebx*4]
mov edx, dword [esi + 0x428]
cmp dword [edx + eax*8 + 4], 0
je 0x4e395d
mov dword [ebp - 0x18], 0xffffffff
jmp 0x4e3985
lea eax, [ebx + ebx*4]
mov edx, dword [esi + 0x428]
mov eax, dword [edx + eax*8 + 0x1c]
test eax, eax
je 0x4e3980
cmp byte [eax + 0x1c0], 0
jne 0x4e3980
mov dword [ebp - 0x18], 0xffffffff
jmp 0x4e3985
xor eax, eax
mov dword [ebp - 0x18], eax
inc ebx
dec edi
jne 0x4e38cc
cmp dword [ebp - 0x14], 0
jne 0x4e399d
cmp dword [ebp - 0x18], 0
je 0x4e3aad
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
xor edx, edx
call fcn.00405a4c
cmp dword [ebp - 0x14], 0
je 0x4e39c7
cmp dword [ebp - 0x18], 0
je 0x4e39c7
lea eax, [ebp - 8]
mov edx, 0x4e3b38
call fcn.00405a4c
jmp 0x4e39ef
cmp dword [ebp - 0x14], 0
je 0x4e39dc
lea eax, [ebp - 8]
mov edx, 0x4e3b74
call fcn.00405a4c
jmp 0x4e39ef
cmp dword [ebp - 0x18], 0
je 0x4e39ef
lea eax, [ebp - 8]
mov edx, 0x4e3b98
call fcn.00405a4c
cmp dword [ebp - 8], 0
je 0x4e3aad
lea eax, [ebp - 4]
mov ecx, 0x4e3bbc
mov edx, dword [esi + 0x414]
call fcn.00405dcc
mov eax, dword [ebp - 4]
call fcn.0040cb6c
test al, al
je 0x4e3aad
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x3c
call fcn.004036d4
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x40
xor eax, eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 4]
call fcn.00405a84
mov dword [ebp - 0x44], eax
cmp dword [ebp - 8], 0
jne 0x4e3a5b
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x4e3a66
mov eax, dword [ebp - 8]
call fcn.00405a84
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x54]
push eax
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4e3aad
mov eax, dword [ebp - 0x1c]
mov dword [0x4f0fdc], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x4e3bdc
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3acf
lea eax, [ebp - 8]
mov edx, 2
call fcn.004059f0
ret