Function at 0x4bda50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x29
push 0
push 0
dec ecx
jne 0x4bda58
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x4be208
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004048ac
xor eax, eax
mov dword [ebp - 0x1c], eax
call fcn.00403094
jmp 0x4bdbab
cmp dword [ebp - 0x1c], 1
jg 0x4be153
xor ecx, ecx
mov dl, 1
mov eax, dword [0x49864c]
call fcn.00498b34
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x9c], 0x1f40
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x110], 1
mov eax, dword [ebp - 0xc]
call fcn.0049a90c
add eax, 0x6c
push eax
lea edx, [ebp - 0xf4]
mov eax, 0x4be224
call fcn.004b1e9c
mov edx, dword [ebp - 0xf4]
pop eax
call fcn.00404900
xor eax, eax
push ebp
push 0x4bdb89
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xf8]
mov eax, 0x4be24c
call fcn.004b1e9c
mov edx, dword [ebp - 0xf8]
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00499080
mov eax, dword [ebp - 0xc]
call fcn.0049a8d0
cmp eax, 0xc8
jne 0x4bdb7f
mov dl, 1
mov eax, dword [0x488b3c]
call fcn.00488d9c
mov ebx, eax
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.004890ec
mov edx, 0x4be280
mov eax, ebx
call fcn.004890c4
jmp 0x4bdb6d
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.00488ef0
jmp 0x4bdb78
mov eax, ebx
call fcn.00488ff4
test al, al
jne 0x4bdb5f
mov eax, ebx
call fcn.00403a7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bdb93
mov eax, dword [ebp - 0xc]
call fcn.00403a7c
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x4bdbab
jmp 0x4be153
cmp dword [ebp - 0x1c], 1
jg 0x4be153
xor eax, eax
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x5c], eax
xor eax, eax
push ebp
push 0x4bdbe7
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004bd9f0
test eax, eax
je 0x4bdbdd
mov dword [ebp - 0x54], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bdbf1
mov dword [ebp - 0xf0], 0x94
lea eax, [ebp - 0xf0]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0xec]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xfc]
call fcn.00409498
push dword [ebp - 0xfc]
mov eax, dword [ebp - 0xe8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x100]
call fcn.00409498
push dword [ebp - 0x100]
lea eax, [ebp - 0x104]
call fcn.004bd4c8
push dword [ebp - 0x104]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404c2c
call fcn.0040b47c
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.004bd8e4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x18]
call fcn.00409498
mov dl, 1
mov eax, dword [0x49b7ac]
call fcn.00403a4c
mov ebx, eax
lea eax, [ebp - 0x2c]
push eax
push 0x4be29c
push dword [ebp - 0x14]
push 0x4be2a8
push dword [ebp - 0x18]
push 0x4be2b4
lea eax, [ebp - 0x108]
mov edx, 5
call fcn.00404c2c
mov edx, dword [ebp - 0x108]
xor ecx, ecx
mov eax, ebx
call fcn.0049ba28
mov eax, ebx
call fcn.00403a7c
xor ecx, ecx
mov dl, 1
mov eax, dword [0x49864c]
call fcn.00498b34
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x9c], 0x1f40
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x110], 1
xor eax, eax
push ebp
push 0x4be132
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 1], 0
je 0x4bdd10
mov dword [ebp - 0x5c], 1
mov eax, dword [ebp - 0xc]
call fcn.0049a90c
add eax, 0x70
mov edx, 0x4be2c4
call fcn.00404900
push 0x4be2f0
push dword [ebp - 0x14]
push 0x4be324
push dword [ebp - 0x18]
push 0x4be330
push 0x4be33c
push 0x4be34c
lea edx, [ebp - 0x10c]
mov eax, dword [ebp - 0x54]
call fcn.004093ac
push dword [ebp - 0x10c]
push 0x4be358
lea edx, [ebp - 0x110]
mov eax, dword [ebp - 0x5c]
call fcn.004093ac
push dword [ebp - 0x110]
push 0x4be364
push dword [ebp - 0x2c]
lea eax, [ebp - 0x30]
mov edx, 0xc
call fcn.00404c2c
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xc]
call fcn.00499080
mov eax, dword [ebp - 0xc]
call fcn.0049a8d0
cmp eax, 0xc8
jne 0x4be128
mov dl, 1
mov eax, dword [0x488b3c]
call fcn.00488d9c
mov ebx, eax
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.004890ec
mov edx, 0x4be280
mov eax, ebx
call fcn.004890c4
jmp 0x4bdddb
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.00488ef0
jmp 0x4bdde6
mov eax, ebx
call fcn.00488ff4
test al, al
jne 0x4bddcd
mov eax, ebx
call fcn.00403a7c
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 0x10]
call fcn.00409130
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
call fcn.00405134
mov eax, dword [ebp - 0x114]
lea edx, [ebp - 0x38]
call fcn.004b4c5c
lea ecx, [ebp - 0x11c]
mov edx, 0x4be36c
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x11c]
mov edx, dword [eax]
call dword [edx + 0x80]
cmp edx, 0
jne 0x4be0e4
cmp eax, 0
jne 0x4be0e4
cmp byte [ebp - 0x55], 0
jne 0x4be128
lea ecx, [ebp - 0x124]
mov edx, 0x4be378
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0x120]
lea eax, [ebp - 0x30]
call fcn.00404b34
lea ecx, [ebp - 0x12c]
mov edx, 0x4be38c
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x12c]
lea edx, [ebp - 0x128]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0x128]
lea eax, [ebp - 0x40]
call fcn.00404b34
cmp dword [ebp - 0x30], 0
je 0x4be128
cmp dword [ebp - 0x40], 0
je 0x4be128
mov dl, 1
mov eax, dword [0x49b7ac]
call fcn.00403a4c
mov ebx, eax
lea eax, [ebp - 0x130]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x40]
mov eax, ebx
call fcn.0049ba28
mov eax, dword [ebp - 0x130]
lea edx, [ebp - 0x2c]
call fcn.00408f08
mov eax, ebx
call fcn.00403a7c
lea edx, [ebp - 0x44]
mov eax, 0x4be39c
call fcn.0040f1e0
cmp dword [ebp - 0x44], 0
jne 0x4bdf39
lea edx, [ebp - 0x134]
xor eax, eax
call fcn.0040302c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x44]
call fcn.00409df8
push dword [ebp - 0x44]
push 0x4be3ac
call sub.kernel32.dll_GetTickCount_1
cdq
xor eax, edx
sub eax, edx
lea edx, [ebp - 0x138]
call fcn.004093ac
push dword [ebp - 0x138]
push 0x4be3ac
lea eax, [ebp - 0x48]
mov edx, 4
call fcn.00404c2c
mov eax, dword [ebp - 0x48]
call fcn.004099d8
test al, al
jne 0x4bdf82
mov eax, dword [ebp - 0x48]
call fcn.004099fc
lea edx, [ebp - 0x13c]
mov eax, 0x4be3b8
call fcn.004b1e9c
mov ecx, dword [ebp - 0x13c]
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x48]
call fcn.00404bb8
push dword [ebp - 0x48]
call sub.kernel32.dll_GetTickCount_1
cdq
xor eax, edx
sub eax, edx
lea edx, [ebp - 0x140]
call fcn.004093ac
push dword [ebp - 0x140]
lea edx, [ebp - 0x144]
mov eax, 0x4be3d4
call fcn.004b1e9c
push dword [ebp - 0x144]
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00404c2c
mov eax, dword [ebp - 0x4c]
call fcn.004099c8
test al, al
je 0x4be002
xor edx, edx
mov eax, dword [ebp - 0x4c]
call fcn.00409ba0
mov eax, dword [ebp - 0x4c]
call fcn.00409cc4
push 0xffff
mov ecx, dword [ebp - 0x34]
mov dl, 1
mov eax, dword [0x417778]
call fcn.0041c28c
mov dword [ebp - 0x3c], eax
xor eax, eax
push ebp
push 0x4be03f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xc]
call fcn.00498c5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4be049
mov eax, dword [ebp - 0x3c]
call fcn.00403a7c
mov eax, dword [ebp - 0xc]
call fcn.0049a8d0
cmp eax, 0xc8
jne 0x4be128
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x34]
call fcn.004bd918
xor edx, edx
mov eax, dword [ebp - 0x34]
call fcn.00409ba0
mov eax, dword [ebp - 0x34]
call fcn.00409cc4
mov eax, dword [ebp - 0x4c]
call fcn.004099c8
test al, al
je 0x4be0a5
push 5
mov eax, dword [ebp - 0x4c]
call fcn.00404d6c
push eax
call sub.kernel32.dll_WinExec
jmp 0x4be128
lea edx, [ebp - 0x148]
mov eax, 0x4be3e8
call fcn.004b1e9c
mov ecx, dword [ebp - 0x148]
lea eax, [ebp - 0x50]
mov edx, dword [ebp - 0x48]
call fcn.00404bb8
mov eax, dword [ebp - 0x50]
call fcn.004099c8
test al, al
je 0x4be128
push 5
mov eax, dword [ebp - 0x50]
call fcn.00404d6c
push eax
call sub.kernel32.dll_WinExec
jmp 0x4be128
lea ecx, [ebp - 0x14c]
mov edx, 0x4be36c
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x14c]
mov edx, dword [eax]
call dword [edx + 0x80]
cmp edx, 0
jne 0x4be128
cmp eax, 2
jne 0x4be128
mov eax, dword [ebp - 8]
call fcn.004048ac
push 0
call sub.kernel32.dll_ExitProcess_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4be13c
mov eax, dword [ebp - 0xc]
call fcn.00403a7c
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x4bdaa1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be212
lea eax, [ebp - 0x14c]
call fcn.00406710
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004048d0
lea eax, [ebp - 0x12c]
call fcn.00406710
lea eax, [ebp - 0x128]
call fcn.00404fb8
lea eax, [ebp - 0x124]
call fcn.00406710
lea eax, [ebp - 0x120]
call fcn.00404fb8
lea eax, [ebp - 0x11c]
call fcn.00406710
lea eax, [ebp - 0x118]
call fcn.004048ac
lea eax, [ebp - 0x114]
call fcn.00404fb8
lea eax, [ebp - 0x110]
mov edx, 8
call fcn.004048d0
lea eax, [ebp - 0x50]
mov edx, 5
call fcn.004048d0
lea eax, [ebp - 0x38]
call fcn.00406710
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.004048d0
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004048d0
ret