Function at 0x4a2928
Capabilities:
Create process on windows
Find taskbar

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x76
push 0
push 0
dec ecx
jne 0x4a2930
push ebx
push esi
xor eax, eax
push ebp
push 0x4a2c32
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x324], 0x114
lea eax, [ebp - 0x324]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [ebp - 0x318], 0x5397
jbe 0x4a2a21
push 0x4a2c4c
mov eax, dword [ebp - 0x320]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x380]
call fcn.0040c470
push dword [ebp - 0x380]
push 0x4a2c98
mov eax, dword [ebp - 0x31c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x384]
call fcn.0040c470
push dword [ebp - 0x384]
push 0x4a2c98
mov eax, dword [ebp - 0x318]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x388]
call fcn.0040c470
push dword [ebp - 0x388]
lea eax, [ebp - 0x37c]
mov edx, 6
call fcn.00405ea8
mov eax, dword [ebp - 0x37c]
call fcn.0040597c
mov esi, eax
lea edx, [ebp - 0x38c]
mov eax, 0x4a2ca8
call fcn.004a8854
mov eax, dword [ebp - 0x38c]
call fcn.0040597c
mov ebx, eax
call fcn.0049e15c
push 0x40
push esi
push ebx
push 0
call sub.user32.dll_MessageBoxW
call fcn.004a4ccc
jmp 0x4a2bfc
push 0x104
lea eax, [ebp - 0x20e]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x20e]
push eax
call sub.shlwapi.dll_PathRemoveFileSpecW
lea eax, [ebp - 0x20e]
push eax
call sub.shlwapi.dll_PathAddBackslashW
lea eax, [ebp - 0x390]
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.00405af0
mov eax, dword [ebp - 0x390]
mov dl, 1
call fcn.0049eb30
push 0
push 0x4a2d34
call sub.user32.dll_FindWindowW
test eax, eax
je 0x4a2bfc
push 0xffffffffffffffff
push 0x4a2d50
push 0
push 0x100000
call sub.kernel32.dll_OpenEventW
push eax
call sub.kernel32.dll_WaitForSingleObject
call fcn.0049eab0
test al, al
je 0x4a2af6
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x3a0]
mov eax, dword [0x4c681c]
mov eax, dword [eax]
call fcn.0049abd0
mov eax, dword [ebp - 0x3a0]
lea edx, [ebp - 0x39c]
call fcn.0040cc44
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x394], 0x11
lea edx, [ebp - 0x398]
xor ecx, ecx
mov eax, 0x4a2d9c
call fcn.0040d380
jmp 0x4a2b99
call fcn.0049ea98
test al, al
je 0x4a2b4d
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x3a8]
mov eax, dword [0x4c681c]
mov eax, dword [eax]
call fcn.0049abd0
mov eax, dword [ebp - 0x3a8]
lea edx, [ebp - 0x3a4]
call fcn.0040cc44
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x394], 0x11
lea edx, [ebp - 0x398]
xor ecx, ecx
mov eax, 0x4a2e0c
call fcn.0040d380
jmp 0x4a2b99
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x3b0]
mov eax, dword [0x4c681c]
mov eax, dword [eax]
call fcn.0049abd0
mov eax, dword [ebp - 0x3b0]
lea edx, [ebp - 0x3ac]
call fcn.0040cc44
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x394], 0x11
lea edx, [ebp - 0x398]
xor ecx, ecx
mov eax, 0x4a2e74
call fcn.0040d380
lea eax, [ebp - 0x368]
xor ecx, ecx
mov edx, 0x44
call fcn.004035a0
mov dword [ebp - 0x368], 0x44
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x368]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040597c
call fcn.0040d258
push eax
push 0
call sub.kernel32.dll_CreateProcessW
mov eax, dword [ebp - 0x378]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x374]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a2c39
lea eax, [ebp - 0x3b0]
mov edx, 6
call fcn.004058e8
lea eax, [ebp - 0x390]
mov edx, 6
call fcn.004058e8
lea eax, [ebp - 4]
call fcn.004058e0