Function at 0x4b4d24
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff10
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xec], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405518
mov eax, dword [ebp - 8]
call fcn.00405518
xor eax, eax
push ebp
push 0x4b4fa4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xec]
mov eax, dword [ebp - 4]
call fcn.004099e4
mov eax, dword [ebp - 0xec]
call fcn.00405328
test eax, eax
je 0x4b4f79
lea eax, [ebp - 0xac]
push eax
push 0
push 0
call sub.user32.dll_EnumDisplaySettingsA
push 0
push 0x4b4fb4
call sub.user32.dll_FindWindowA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4b4e15
lea eax, [ebp - 0xe8]
mov edx, 0x3c
call fcn.0040841c
mov dword [ebp - 0xe8], 0x3c
mov dword [ebp - 0xe4], 0x40
mov eax, 0x4b4fc4
mov dword [ebp - 0xdc], eax
mov eax, 0x4b4fcc
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xcc], 1
lea eax, [ebp - 0xe8]
push eax
call sub.shell32.dll_ShellExecuteExA
push 0xffffffffffffffff
mov eax, dword [ebp - 0xb0]
push eax
call sub.user32.dll_WaitForInputIdle
push 0
push 0x4b4fb4
call sub.user32.dll_FindWindowA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4b4e33
push 0x10
push 0x4b4fd8
push 0x4b4fe0
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x4b4f79
push 5
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 0x4b4ff8
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_FindWindowExA
mov edi, eax
push edi
call sub.user32.dll_SetForegroundWindow
push edi
call sub.user32.dll_SetFocus
mov ebx, 0x1f
mov esi, 0x25
push 0
push esi
push pe_nt_image_headers32
push edi
call sub.user32.dll_SendMessageA
dec ebx
jne 0x4b4e6c
push 0x32
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebp - 4]
call fcn.00405328
test eax, eax
jle 0x4b4ee3
mov dword [ebp - 0x10], eax
mov ebx, 1
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx - 1]
mov edx, eax
sub dl, 0x5c
jne 0x4b4ec7
mov esi, 0x27
push 0
push esi
push pe_nt_image_headers32
push edi
call sub.user32.dll_SendMessageA
push 0x32
call sub.kernel32.dll_Sleep_1
jmp 0x4b4edd
mov esi, eax
and esi, 0xff
push 0
push esi
push 0x102
push edi
call sub.user32.dll_SendMessageA
inc ebx
dec dword [ebp - 0x10]
jne 0x4b4e9d
lea edx, [ebp - 0xf0]
mov eax, dword [ebp - 8]
call fcn.004099e4
mov eax, dword [ebp - 0xf0]
call fcn.00405328
test eax, eax
je 0x4b4f79
mov esi, 0x24
push 0
push 0x4b5008
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_FindWindowExA
mov edi, eax
push edi
call sub.user32.dll_SetForegroundWindow
push edi
call sub.user32.dll_SetFocus
push 0x3e8
call sub.kernel32.dll_Sleep_1
push 0
push esi
push pe_nt_image_headers32
push edi
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 8]
call fcn.00405328
test eax, eax
jle 0x4b4f79
mov dword [ebp - 0x10], eax
mov ebx, 1
mov eax, dword [ebp - 8]
mov al, byte [eax + ebx - 1]
call fcn.00403004
mov esi, eax
and esi, 0xff
push 0
push esi
push 0x102
push edi
call sub.user32.dll_SendMessageA
inc ebx
dec dword [ebp - 0x10]
jne 0x4b4f51
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4fab
lea eax, [ebp - 0xf0]
mov edx, 2
call fcn.0040508c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040508c
ret