Function at 0x463070
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
push ebx
push esi
push edi
mov ebx, ecx
mov byte [ebp - 0x11], dl
mov dword [ebp - 0x18], eax
mov esi, dword [0x4be784]
mov edi, dword [ebp - 0x18]
mov eax, dword [0x4bee68]
cmp byte [eax], 4
jae 0x4630aa
mov ax, 0x312
call fcn.004aa600
mov edx, 4
call fcn.004b12a8
cmp byte [edi + 0x442], 0
jle 0x463958
mov eax, edi
call fcn.0044f5d0
test al, al
je 0x463958
test bl, bl
je 0x4630f1
xor eax, eax
mov al, bl
mov edx, dword [0x4be650]
mov edx, dword [edx]
mov dl, byte [edx + eax + 0x1ef]
add dl, 0xfe
mov eax, edi
mov ecx, ebx
call fcn.00461fa4
mov byte [ebp - 0x19], al
jmp 0x463958
mov al, byte [edi + 0x442]
call fcn.004ab84c
mov edx, dword [0x4bedb0]
lea eax, [ebp - 0x1d]
call fcn.004b81b0
movsx eax, byte [edi + 0x442]
mov edx, dword [0x4be4fc]
mov bl, byte [edx + eax - 1]
cmp byte [ebp - 0x11], 0
je 0x463222
cmp dword [ebp + 8], 0
jne 0x463222
call fcn.004ae0a4
mov al, byte [edi + 0x442]
call fcn.004ab84c
mov al, 4
call fcn.00421294
test al, al
je 0x463958
mov edx, dword [0x4bedb0]
lea eax, [ebp - 0x127]
call fcn.004b81b0
lea edx, [ebp - 0x127]
mov eax, dword [0x4beb38]
mov cx, 3
call fcn.004b81d8
mov eax, dword [0x4beb38]
push eax
lea eax, [ebp - 0x1d]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
je 0x4631a1
cmp byte [ebp - 0x1d], 0x3f
je 0x4631a1
mov ax, 0xf6
call fcn.004aa600
mov edx, 3
call fcn.004b12a8
jmp 0x46312f
cmp bl, 1
je 0x4631b0
cmp bl, 2
je 0x4631b0
cmp bl, 3
jne 0x463222
push 0
lea eax, [ebp - 0x26]
push eax
push 0
push 0
lea ecx, [edi + 0x15c]
mov dl, byte [edi + 0x442]
lea eax, [ebp - 0x127]
call fcn.004a5098
mov dword [ebp - 0x24], eax
cmp byte [ebp - 0x26], 0
je 0x463209
mov eax, dword [0x4be9c0]
mov word [eax], 0
cmp byte [edi + 0x449], 0
jne 0x463209
mov eax, edi
call fcn.0046fbdc
add esp, 0xfffffff8
fistp qword [esp]
wait
mov dx, word [edi + 0x424]
mov al, 1
call fcn.00425aac
cmp dword [ebp - 0x24], 0xfffffffd
jb 0x463222
cmp bl, 3
je 0x463958
cmp dword [ebp - 0x24], 0xfffffffd
jne 0x463958
cmp byte [ebp - 0x11], 0
je 0x463287
cmp dword [ebp + 8], 0
jbe 0x463287
cmp bl, 1
je 0x46323d
cmp bl, 2
je 0x46323d
cmp bl, 3
jne 0x463252
lea edx, [ebp - 0x127]
mov eax, edi
call fcn.0045266c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
jmp 0x463275
mov eax, dword [ebp + 8]
push eax
push 0
push 0
lea eax, [ebp - 0x27]
push eax
lea ecx, [edi + 0x15c]
mov dl, byte [edi + 0x442]
lea eax, [ebp - 0x127]
call fcn.004a1440
lea edx, [ebp - 0x127]
mov eax, dword [0x4be50c]
call fcn.004b81b0
jmp 0x46328f
mov eax, dword [0x4be50c]
mov byte [eax], 0
call fcn.004aa1d8
cmp byte [ebp - 0x11], 0
jne 0x4632af
mov dl, 0x32
mov ax, 0x29
call fcn.0048841c
test eax, eax
je 0x463958
jmp 0x4632c2
mov dl, 0x33
mov ax, 0x29
call fcn.0048841c
test eax, eax
je 0x463958
cmp byte [esi + 0x190b], 0
je 0x4632e7
cmp byte [esi + 0x198f], 0
je 0x4632e7
mov dl, 0x53
mov ax, 0x25
call fcn.0048841c
test eax, eax
je 0x463958
xor eax, eax
mov dword [ebp - 0x10], eax
cmp byte [esi + 0x1987], 0
je 0x463302
call fcn.004b4058
test al, al
je 0x463958
mov eax, dword [edi + 0x84]
test eax, eax
je 0x463313
mov byte [esi + 0x1981], 1
cmp byte [esi + 0x1981], 0
je 0x46348e
mov byte [0x4c1da0], 0
test eax, eax
je 0x463354
mov edx, dword [0x4bedb0]
mov ax, word [eax + 2]
call fcn.00481a50
mov eax, dword [0x4bedb0]
call fcn.004aedb4
mov eax, dword [0x4bedb0]
push eax
push 0x4c1da0
call sub.kernel32.dll_lstrcatA
mov ax, 0x12e
call fcn.004aa600
push eax
push 0x4c1da0
call sub.kernel32.dll_lstrcatA
cmp byte [ebp - 0x11], 0
jne 0x4633ce
cmp dword [edi + 0x84], 0
jne 0x46341b
push 0x463964
push 0x4c1da0
call sub.kernel32.dll_lstrcatA
cmp byte [edi + 0x442], 0x1a
jg 0x4633b6
lea edx, [ebp - 0x1d]
mov eax, dword [0x4beb38]
mov cx, 1
call fcn.004b81d8
mov eax, dword [0x4beb38]
push eax
push 0x4c1da0
call sub.kernel32.dll_lstrcatA
jmp 0x46341b
mov eax, dword [edi + 0xc]
mov eax, dword [eax + 0xc]
call fcn.004aed10
push eax
push 0x4c1da0
call sub.kernel32.dll_lstrcatA
jmp 0x46341b
push 0x463964
push 0x4c1da0
call sub.kernel32.dll_lstrcatA
cmp byte [ebp - 0x124], 0x5c
jne 0x463405
cmp byte [ebp - 0x123], 0
jne 0x463405
mov ax, 0x222
call fcn.004aa600
push eax
push 0x4c1da0
call sub.kernel32.dll_lstrcatA
jmp 0x46341b
lea eax, [ebp - 0x127]
call fcn.004aed10
push eax
push 0x4c1da0
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4be728]
push eax
push 0x4c1da0
call sub.kernel32.dll_lstrcatA
mov edx, 0x4c1da0
mov eax, dword [0x4be538]
call fcn.004b81b0
call fcn.004ae0a4
mov al, 1
call fcn.00421294
test al, al
je 0x463958
mov eax, dword [0x4be538]
call fcn.004b1914
test al, al
je 0x46346c
mov eax, dword [0x4be538]
xor edx, edx
call fcn.004b0584
test al, al
je 0x46343a
mov edx, dword [0x4be538]
mov eax, 0x4c1da0
call fcn.004b81b0
mov eax, 0x4c1da0
call fcn.00461718
test al, al
je 0x463958
mov eax, dword [edi + 0x84]
test eax, eax
je 0x4634a9
mov edx, 0x4c1da0
xor ecx, ecx
call fcn.00481528
mov byte [ebp - 0x25], al
jmp 0x4634ad
mov byte [ebp - 0x25], 1
cmp byte [esi + 0x19c1], 0
je 0x4634e6
push 0
lea eax, [esi + 0x201f]
push eax
call sub.kernel32.dll__lcreat
mov dword [0x4c1394], eax
cmp dword [0x4c1394], 0xffffffff
jne 0x4634e6
lea edx, [esi + 0x201f]
mov ax, 3
call fcn.004acdac
jmp 0x4637f5
cmp byte [esi + 0x19c3], 0
jbe 0x463518
call fcn.00421f58
cmp byte [esi + 0x19c2], 0
je 0x463518
lea eax, [esi + 0x211f]
call fcn.00421f60
test al, al
jne 0x463518
mov byte [esi + 0x19c2], 0
jmp 0x4637f5
cmp byte [esi + 0x1982], 0
je 0x46358f
cmp dword [edi + 0x4c], 0
je 0x463550
xor eax, eax
mov al, byte [edi + 0x43d]
xor edx, edx
mov dl, byte [esi + 0x1987]
cmp ax, dx
je 0x463550
mov eax, edi
call fcn.00451ec8
push 0
mov eax, edi
xor ecx, ecx
xor edx, edx
call fcn.00455090
cmp dword [edi + 0x4c], 0
jne 0x463569
push 0
mov cl, byte [esi + 0x1987]
mov eax, edi
mov dl, 1
call fcn.00455090
jmp 0x463588
mov ax, 0x12d
call fcn.004aa600
mov edx, eax
lea eax, [edi + 0x1fb]
call fcn.004b81b0
mov al, byte [ebp - 0x25]
mov byte [edi + 0x43b], al
mov eax, edi
call fcn.00451ec8
cmp byte [edi + 0x442], 0x1a
jg 0x463603
cmp bl, 1
je 0x4635a7
cmp bl, 2
je 0x4635a7
cmp bl, 3
jne 0x463603
cmp byte [esi + 0x190b], 0
jne 0x463603
cmp byte [esi + 0x1874], 0
je 0x463603
lea ecx, [edi + 0x15c]
mov al, byte [edi + 0x442]
mov dl, 1
call fcn.004a7190
mov eax, dword [0x4be9c0]
mov word [eax], 0
cmp byte [edi + 0x449], 0
jne 0x4635fb
mov eax, edi
call fcn.0046fbdc
add esp, 0xfffffff8
fistp qword [esp]
wait
mov dx, word [edi + 0x424]
mov al, 1
call fcn.00425aac
mov eax, dword [0x4beb20]
mov byte [eax], 1
mov ax, 0x311
call fcn.004aa600
mov edx, eax
mov eax, dword [0x4bec98]
call fcn.004b81b0
mov eax, dword [0x4be6c8]
mov byte [eax], 1
cmp bl, 0xff
jne 0x463673
mov eax, dword [0x4bec98]
xor edx, edx
call fcn.004ad8ec
cmp byte [ebp - 0x11], 0
jne 0x463642
mov eax, dword [0x4bed58]
xor edx, edx
mov dword [eax], edx
jmp 0x463650
lea eax, [ebp - 0x127]
mov edx, dword [0x4bed58]
mov dword [edx], eax
lea edx, [ebp - 0x10]
mov eax, edi
mov cl, 2
call fcn.004610dc
mov eax, dword [0x4bed58]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4bec40]
xor edx, edx
mov dword [eax], edx
jmp 0x4637b9
mov eax, dword [0x4bec98]
mov dl, 1
call fcn.004ad8ec
cmp byte [edi + 0x442], 0x1a
jg 0x4636b9
cmp bl, 1
jl 0x463692
cmp bl, 3
jle 0x4636b9
cmp byte [ebp - 0x11], 0
jne 0x4636a7
push ebp
lea eax, [ebp - 0x1d]
call fcn.00462cf4
pop ecx
jmp 0x4637b0
push ebp
lea eax, [ebp - 0x127]
call fcn.00462cf4
pop ecx
jmp 0x4637b0
lea eax, [edi + 0x15c]
mov dl, 1
call fcn.004a3734
test eax, eax
je 0x4637f5
cmp byte [ebp - 0x11], 0
jne 0x46378c
push 4
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x463710
push 0
push 0x1000
call fcn.004b1e30
mov edx, eax
mov ax, 0xb
call fcn.004acdac
jmp 0x463958
mov eax, dword [ebp - 8]
mov ecx, 0xff
mov edx, 0x1000
call fcn.00402ff0
mov dword [ebp - 4], 0x1000
xor eax, eax
mov dword [ebp - 0xc], eax
cmp bl, 3
jne 0x46373b
mov eax, dword [edi + 0x1c8]
jmp 0x463740
mov eax, 0xfffffffd
push ebp
push 1
push 1
mov edx, dword [edi + 0x16c]
lea ecx, [ebp - 0x1d]
xchg ecx, eax
call fcn.00462520
pop ecx
mov eax, dword [0x4bed48]
cmp byte [eax], 0
jne 0x463778
cmp byte [esi + 0x190b], 0
je 0x463778
cmp byte [esi + 0x194a], 0
je 0x463778
push ebp
call fcn.00462afc
pop ecx
push 0x4000
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_VirtualFree_1
jmp 0x4637b0
push ebp
push 1
push 1
lea edx, [edi + 0x15c]
mov eax, dword [ebp - 0x24]
call fcn.004a25d8
mov edx, eax
lea eax, [ebp - 0x127]
mov ecx, dword [ebp - 0x24]
call fcn.00462520
pop ecx
mov eax, dword [0x4be91c]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4beef0]
mov byte [eax], 0
mov eax, dword [0x4bed48]
cmp byte [eax], 0
jne 0x4637f5
cmp byte [ebp - 0x11], 0
jne 0x4637f5
cmp byte [esi + 0x190b], 0
je 0x4637f5
cmp byte [esi + 0x198f], 0
je 0x4637f5
call fcn.004adbe0
lea ecx, [ebp - 0x10]
mov eax, edi
mov dl, byte [ebp - 0x25]
call fcn.0045d338
cmp byte [esi + 0x1981], 0
je 0x463808
mov eax, 0x4c1bd4
call fcn.00402d90
mov eax, dword [0x4beb20]
mov byte [eax], 0
cmp byte [esi + 0x19c1], 0
je 0x463824
mov eax, dword [0x4c1394]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp byte [esi + 0x19c3], 0
jbe 0x46383b
cmp byte [esi + 0x19c2], 0
je 0x46383b
call fcn.00421f80
cmp byte [esi + 0x1982], 0
je 0x46386c
mov eax, dword [edi]
call fcn.00456ac0
mov ax, word [edi + 0x424]
call fcn.0042b734
xor ecx, ecx
mov cl, byte [esi + 0x189a]
mov edx, 0x451d5c
mov eax, dword [edi + 0x4c]
call fcn.00410218
cmp dword [edi + 0x84], 0
je 0x46387c
xor eax, eax
call fcn.00482388
call fcn.004adbe0
mov eax, dword [0x4bed48]
mov byte [eax], 0
cmp byte [esi + 0x1861], 0
je 0x46389f
mov eax, edi
mov cl, byte [ebp - 0x25]
or edx, 0xffffffff
call fcn.00461fa4
cmp byte [esi + 0x185f], 0
je 0x46390d
mov eax, dword [0x4bedb0]
call fcn.004ae768
test al, al
je 0x46390d
cmp dword [ebp - 0x10], 0
jle 0x46390d
push 0x463968
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
push 0x4c1da0
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
push 0x46396c
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
push 1
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jae 0x46390d
mov edx, dword [0x4bedb0]
mov ax, 7
call fcn.004acdac
fild dword [ebp - 0x10]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004b21b4
mov ax, 0x314
call fcn.004aa600
push eax
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4bedb0]
mov edx, 4
call fcn.004b12a8
mov eax, dword [0x4be6c8]
mov byte [eax], 0
cmp dword [edi + 0x1e4], 0
je 0x463958
mov eax, edi
call fcn.00453e58
mov al, byte [ebp - 0x19]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4