Function at 0x4b3a60
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x870
mov eax, dword [0x53273c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x803]
push esi
push 0x7fe
push ecx
push eax
call fcn.004b0560
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4b3aa4
lea eax, [esi + 1]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret
push ebx
push edi
push 0x44
lea eax, [ebp - 0x870]
push 0
push eax
call fcn.004d0130
mov eax, 5
mov dword [ebp - 0x870], 0x44
mov word [ebp - 0x840], ax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x808], ebx
mov dword [ebp - 0x810], eax
add esp, 0xc
movsx eax, byte [esi]
xor edi, edi
lea ecx, [ebx + 1]
test eax, eax
je 0x4b3b06
nop dword [eax + eax]
cmp eax, 0x20
movsx eax, byte [edi + esi + 1]
cmovle ebx, ecx
inc edi
test eax, eax
jne 0x4b3af0
mov dword [ebp - 0x808], ebx
test ebx, ebx
je 0x4b3b17
mov word [edi + esi], 0x22
add edi, 2
dec esi
mov byte [esi], 0x22
mov al, byte [esi]
mov ecx, esi
mov edx, esi
test al, al
je 0x4b3b36
inc ecx
cmp al, 0x2f
je 0x4b3b2e
cmp al, 0x3a
je 0x4b3b2e
cmp al, 0x5c
jne 0x4b3b30
mov edx, ecx
mov al, byte [ecx]
test al, al
jne 0x4b3b21
sub edx, esi
mov dword [ebp - 0x81c], edx
lea eax, [edx + 0xc]
add eax, ebx
mov dword [ebp - 0x80c], eax
add eax, eax
mov dword [ebp - 0x818], eax
add eax, 3
add eax, edi
mov dword [ebp - 0x814], eax
cmp eax, 0x800
jbe 0x4b3bb8
push eax
mov ebx, esi
call fcn.004d2dc9
mov esi, eax
add esp, 4
mov dword [ebp - 0x810], esi
test esi, esi
jne 0x4b3ba1
push dword [ebp - 0x814]
push str.malloc__ld__failed
call fcn.004afb30
add esp, 8
lea eax, [esi + 1]
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret
mov ecx, esi
sub ecx, ebx
mov al, byte [ebx]
lea ebx, [ebx + 1]
mov byte [ecx + ebx - 1], al
test al, al
jne 0x4b3ba5
mov ebx, dword [ebp - 0x808]
lea eax, [edi + esi]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x818]
add eax, 2
add eax, esi
test edi, edi
js 0x4b3be4
mov edx, esi
lea ecx, [eax + edi]
sub edx, eax
sub edi, 1
mov al, byte [ecx + edx]
mov byte [ecx], al
lea ecx, [ecx - 1]
jns 0x4b3bd7
mov edi, dword [ebp - 0x81c]
movq xmm0, qword [str.alic_run.exe]
add edi, esi
push 0x4fc778
movq qword [edi], xmm0
mov eax, dword [0x508550]
mov dword [edi + 8], eax
mov al, byte [0x508554]
mov byte [edi + 0xc], al
lea eax, [ebx + esi]
push eax
call fcn.004d5440
add esp, 8
test eax, eax
je 0x4b3c5f
push eax
call fcn.004d5359
mov eax, dword [ebp - 0x80c]
mov edi, dword [ebp - 0x808]
dec eax
push eax
push esi
inc edi
mov dword [ebp - 0x80c], eax
push edi
call fcn.004cfba0
mov eax, dword [ebp - 0x80c]
add esp, 0x10
mov word [edi + eax], 0x2022
test ebx, ebx
je 0x4b3c7d
mov eax, dword [ebp - 0x808]
inc esi
mov byte [eax - 1], 0
jmp 0x4b3c7d
mov esi, edi
mov edi, dword [ebp - 0x808]
inc edi
mov ecx, esi
mov edx, edi
sub edx, esi
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x4b3c70
push 1
push 2
call fcn.004d362b
push esi
push str.Invoking___s_
mov ebx, eax
call fcn.004afb30
push eax
call fcn.004d9e2c
add esp, 0x14
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x870]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4b3cde
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.CreateProcess___s___failure__nError_code__ld
call fcn.004afb30
add esp, 0xc
mov esi, 1
jmp 0x4b3cf6
push dword [ebp - 0x828]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x82c]
call esi
xor esi, esi
push ebx
push 2
call fcn.004d362b
mov eax, dword [ebp - 0x810]
add esp, 8
test eax, eax
je 0x4b3d14
push eax
call fcn.004d2dae
add esp, 4
test esi, esi
jne 0x4b3d23
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret