Function at 0x48daba
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffc14
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push ebx
call fcn.0048be97
test eax, eax
je 0x48e16a
cmp dword [ebx + 0x380], 0
jne 0x48e16a
mov dword [ebx + 0x380], 1
push 0
call fcn.0055aa70
pop ecx
mov esi, eax
mov dword [ebx + 0x38c], esi
mov eax, dword [ebx + 0x388]
cmp esi, eax
jne 0x48db16
inc eax
mov dword [ebx + 0x38c], eax
mov eax, dword [ebx + 0x35c]
test eax, eax
je 0x48db28
cmp eax, dword [ebx + 0x350]
ja 0x48db3c
mov dword [ebx + 0x33c], 9
mov dword [ebx + 0x344], 1
push ebx
call fcn.0048d8b9
mov edx, dword [ebp + 0x10]
cmp byte [edx], 0
je 0x48db5b
push dword [ebp + 0x10]
push 1
push 1
push 1
push 1
push ebx
call fcn.00517489
mov dword [ebx + 0x370], 0xffffffff
push dword [ebx]
call fcn.0051dd0a
push eax
call fcn.00417312
push ebx
call fcn.0048d936
push 0
push dword [ebx]
call fcn.0051dd0a
push eax
call fcn.00515490
xor ecx, ecx
mov edi, ecx
mov esi, ecx
cmp dword [ebx + 0x344], 0
je 0x48dd5d
cmp dword [ebx + 0x35c], 0
jbe 0x48dbe4
mov eax, dword [ebx + 0x38c]
sub eax, dword [ebx + 0x388]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jae 0x48dbbf
mov dword [ebp - 4], 1
mov eax, dword [ebx + 0x350]
mov edx, dword [ebx + 0x360]
cmp eax, edx
jae 0x48dbd3
mov ecx, eax
jmp 0x48dbd7
mov ecx, eax
sub ecx, edx
mov eax, ecx
xor edx, edx
div dword [ebp - 4]
mov dword [ebx + 0x364], eax
cmp dword [0x55c624], 0
je 0x48dbf5
push 0x1e
push ebx
call fcn.0048bfd7
mov eax, dword [ebx + 0x338]
test eax, eax
jl 0x48dc06
push eax
call fcn.0054f720
pop ecx
mov dword [ebx + 0x338], 0xffffffff
cmp dword [0x56acb4], 0
je 0x48dc78
push 0x7f8
push 0
lea edx, [ebp - 0xbec]
push edx
call fcn.0054c150
add esp, 0xc
mov dword [ebp - 0xbe8], ebx
lea ecx, [ebx + 0x234]
push ecx
lea eax, [ebx + 0x130]
push eax
push 0x564432
lea edx, [ebp - 0xbc4]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0x10
lea ecx, [ebp - 0xbec]
push ecx
push 0
push 0
push 0x19
push 0x564438
push 0
push 0
push dword [ebx + 0x3b0]
call fcn.004fd2f4
push 0
push 1
lea eax, [ebp - 0x3f4]
push eax
lea edx, [ebx + 0x234]
push edx
call fcn.00482188
cmp byte [ebp - 0x3f4], 0
je 0x48de30
lea ecx, [ebp - 0x3f4]
push ecx
call fcn.0054c2d0
pop ecx
add eax, 0xa
push eax
call fcn.00557db4
pop ecx
mov esi, eax
test esi, esi
je 0x48de30
push esi
lea edi, [ebp - 0x3f4]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
lea eax, [ebx + 0x234]
push eax
lea edx, [ebx + 0x130]
push edx
push 0x564442
lea ecx, [ebp - 0x3f4]
push ecx
call sub.USER32.dll_wsprintfA
add esp, 0x10
lea eax, [ebp - 0x3f4]
push eax
call fcn.0054c2d0
pop ecx
add eax, 0xa
push eax
call fcn.00557db4
pop ecx
mov edi, eax
test edi, edi
je 0x48dd4f
push esi
push edi
mov esi, edi
lea edi, [ebp - 0x3f4]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x48de30
push esi
call fcn.00557ca0
pop ecx
xor esi, esi
jmp 0x48de30
cmp dword [0x55c624], 0
je 0x48dd6e
push 0x1d
push ebx
call fcn.0048bfd7
cmp dword [0x56a1d4], 0
je 0x48ddad
cmp dword [0x569e00], 1
jne 0x48dd8d
push dword [0x56a1e0]
call fcn.0042c48d
jmp 0x48ddad
cmp dword [0x569e00], 2
jne 0x48ddad
push dword [ebx + 0x3b0]
push 1
push 0
push 7
call fcn.00477d00
push eax
call fcn.0050b5a6
mov eax, dword [ebx + 0x338]
test eax, eax
jl 0x48ddbe
push eax
call fcn.0054f720
pop ecx
mov dword [ebx + 0x338], 0xffffffff
cmp dword [0x56acb4], 0
je 0x48de30
push 0x7f8
push 0
lea edx, [ebp - 0x13e4]
push edx
call fcn.0054c150
add esp, 0xc
mov dword [ebp - 0x13e0], ebx
lea ecx, [ebx + 0x234]
push ecx
lea eax, [ebx + 0x130]
push eax
push 0x564448
lea edx, [ebp - 0x13bc]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0x10
lea ecx, [ebp - 0x13e4]
push ecx
push 0
push 0
push 0x1b
push 0x56444e
push 0
push 0
push dword [ebx + 0x3b0]
call fcn.004fd2f4
push ebx
call fcn.0048be97
test eax, eax
je 0x48e16a
cmp dword [ebp + 0xc], 0
jne 0x48e07b
cmp dword [ebx + 0x384], 0
je 0x48e07b
mov eax, dword [ebx]
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 0xc], edx
push dword [ebx + 0x3b0]
call fcn.00412773
test eax, eax
je 0x48de79
mov ecx, dword [ebx + 0x3b0]
mov eax, dword [ecx]
mov dword [ebp - 8], eax
push dword [0x55f89c]
push dword [ebp - 8]
call fcn.004ee341
cmp dword [ebx + 0x344], 0
je 0x48dec3
lea edx, [ebx + 4]
push edx
lea ecx, [ebx + 0x234]
push ecx
push 0
push 0xb6b
call fcn.0042c564
push eax
lea eax, [ebp - 0x3f4]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
mov dword [ebp - 0xc], 1
jmp 0x48df55
cmp dword [ebx + 0x33c], 5
jne 0x48def5
lea edx, [ebx + 4]
push edx
lea ecx, [ebx + 0x234]
push ecx
push 0
push 0x1008
call fcn.0042c564
push eax
lea eax, [ebp - 0x3f4]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x48df55
cmp dword [ebx + 0x33c], 4
jne 0x48df2e
lea edx, [ebx + 4]
push edx
lea ecx, [ebx + 0x234]
push ecx
push 0
push 0xb68
call fcn.0042c564
push eax
lea eax, [ebp - 0x3f4]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
mov dword [ebp - 0xc], 1
jmp 0x48df55
lea edx, [ebx + 4]
push edx
lea ecx, [ebx + 0x234]
push ecx
push 0
push 0xb69
call fcn.0042c564
push eax
lea eax, [ebp - 0x3f4]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
cmp dword [ebp - 0xc], 0
je 0x48e037
push 0x564457
lea edx, [ebp - 0x3f4]
push edx
call fcn.0054c1f4
add esp, 8
mov eax, dword [ebx + 0x388]
test eax, eax
jle 0x48dfc8
mov edx, dword [ebx + 0x38c]
sub edx, eax
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 1
jae 0x48df95
mov dword [ebp - 4], 1
push 1
push dword [ebp - 4]
push 0x56445b
call fcn.00511048
push eax
lea ecx, [ebp - 0x3f4]
push ecx
call fcn.0054c1f4
add esp, 8
push 0x56445f
lea eax, [ebp - 0x3f4]
push eax
call fcn.0054c1f4
add esp, 8
push 1
push 0
push 1
push 1
push 0
push 0
lea edx, [ebp - 0x3f4]
push edx
call fcn.0054c2d0
pop ecx
lea ecx, [ebp - 0x3f4]
add eax, ecx
push eax
mov eax, dword [ebx + 0x364]
mov dword [ebp - 0x13ec], eax
xor edx, edx
mov dword [ebp - 0x13e8], edx
fild qword [ebp - 0x13ec]
add esp, 0xfffffff4
fstp xword [esp]
call fcn.004e5ac5
push 0x564462
lea ecx, [ebp - 0x3f4]
push ecx
call fcn.0054c1f4
add esp, 8
push 0x564468
lea eax, [ebp - 0x3f4]
push eax
call fcn.0054c1f4
add esp, 8
xor edx, edx
mov dword [0x56ac00], edx
mov dword [0x56ac10], 1
push dword [0x55f898]
lea ecx, [ebp - 0x3f4]
push ecx
push dword [ebp - 8]
call fcn.004ee447
push dword [0x55f89c]
push dword [ebp - 8]
call fcn.004ee341
push 0
push 0
push 0x10
push dword [ebx]
call sub.USER32.dll_SendMessageA
jmp 0x48e0d7
cmp dword [ebx + 0x344], 0
je 0x48e095
push 0
push 0xb6a
call fcn.0042c564
mov dword [ebp + 0x10], eax
jmp 0x48e0be
cmp dword [ebx + 0x33c], 4
jne 0x48e0af
push 0
push 0xb67
call fcn.0042c564
mov dword [ebp + 0x10], eax
jmp 0x48e0be
push 0
push 0xb60
call fcn.0042c564
mov dword [ebp + 0x10], eax
push dword [ebp + 0x10]
push 1
push 1
push 1
push 1
push ebx
call fcn.00517489
push 1
push ebx
call fcn.0048bdab
test esi, esi
je 0x48e16a
cmp byte [esi], 0x2f
jne 0x48e0fb
push dword [ebx + 0x3b0]
push 0
push 0
push 1
push edi
push esi
push dword [ebx]
call fcn.004b099c
jmp 0x48e158
push 5
push 0x57fd38
push edi
push esi
push 0
push dword [0x56cee8]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x1f
jae 0x48e158
xor eax, eax
mov dword [0x56ac00], eax
mov dword [0x56ac10], 1
push esi
push 0
push 0xb6c
call fcn.0042c564
push eax
lea edx, [ebp - 0x3f4]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0xc
push dword [0x55f89c]
lea ecx, [ebp - 0x3f4]
push ecx
push dword [ebx]
call fcn.004ef100
push esi
call fcn.00557ca0
pop ecx
test edi, edi
je 0x48e16a
push edi
call fcn.00557ca0
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc