Function at 0x4b4c20
Capabilities:
Accept command line arguments
Create process on windows
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c7268
mov eax, dword fs:[0]
push eax
sub esp, 0x170
mov eax, dword [0x623ec0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x5eeecc
mov dword [ebp - 0x134], 0
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
push 0
mov dword [ebp - 0x17c], eax
call edi
test eax, eax
jne 0x4b5273
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x5fdb88
push 0x6249d8
call fcn.00445aa0
push 0x1d0
call fcn.0046677d
mov esi, eax
mov dword [ebp - 0x16c], esi
mov dword [ebp - 4], 0
push 0x1d0
push 0
push esi
call fcn.00468b40
add esp, 0x18
mov ecx, esi
call fcn.004b97c0
mov esi, eax
mov dword [ebp - 0x178], esi
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x110]
push 0x100
push 0
push eax
call fcn.00468b40
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
mov eax, dword [ebp + 0x10]
mov ecx, 0x5fdb8c
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4b4d16
test dl, dl
je 0x4b4d12
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4b4d16
add eax, 2
add ecx, 2
test dl, dl
jne 0x4b4cf6
xor eax, eax
jmp 0x4b4d1b
sbb eax, eax
or eax, 1
xor ecx, ecx
test eax, eax
push str.Ember_Dashboard
setne cl
push 0
mov dword [ebp - 0x16c], ecx
call edi
test eax, eax
jne 0x4b5237
lea eax, [ebp - 0x14c]
mov dword [ebp - 0x114], eax
mov dword [ebp - 4], 2
call fcn.004648b7
mov edi, eax
mov dword [ebp - 4], 3
xor eax, eax
push eax
push eax
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 0x13c], 0
push str.Dashboard.exe
movups xmmword [ebp - 0x14c], xmm0
mov dword [ebp - 0x138], 0
push edi
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x138], 7
mov word [ebp - 0x14c], ax
mov dword [ebp - 0x134], 4
call fcn.004648d4
mov esi, eax
test edx, edx
jne 0x4b5292
mov ecx, dword [ebp - 0x13c]
cmp esi, ecx
ja 0x4b4de7
cmp dword [ebp - 0x138], 7
lea eax, [ebp - 0x14c]
mov dword [ebp - 0x13c], esi
mov ecx, esi
jbe 0x4b4ddf
mov eax, dword [ebp - 0x14c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x4b4df7
sub eax, ecx
lea ecx, [ebp - 0x14c]
push 0
push eax
call fcn.0045b110
cmp dword [ebp - 0x138], 7
lea eax, [ebp - 0x14c]
push esi
cmova eax, dword [ebp - 0x14c]
push eax
push 0xd
push str.Dashboard.exe
push edi
call fcn.004648d4
test edx, edx
jne 0x4b5299
mov esi, 4
mov dword [ebp - 0x134], esi
and esi, 0xfffffffb
mov dword [ebp - 0x134], esi
mov dword [ebp - 4], 2
or esi, 2
mov dword [ebp - 0x134], esi
and esi, 0xfffffffd
mov dword [ebp - 0x134], esi
mov dword [ebp - 4], 1
or esi, 1
mov dword [ebp - 0x134], esi
mov dword [ebp - 4], 0xffffffff
and esi, 0xfffffffe
mov dword [ebp - 0x134], esi
mov dword [ebp - 4], 6
xorps xmm0, xmm0
xor eax, eax
mov dword [ebp - 0x158], edx
movups xmmword [ebp - 0x168], xmm0
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], 7
mov word [ebp - 0x168], ax
mov dword [ebp - 4], 6
or esi, 0x10
push eax
mov dword [ebp - 0x134], esi
lea ecx, [ebp - 0x168]
mov eax, 0x104
sub eax, dword [ebp - 0x158]
push eax
call fcn.0045b110
nop dword [eax]
cmp dword [ebp - 0x154], 7
lea eax, [ebp - 0x168]
mov ecx, dword [ebp - 0x158]
cmova eax, dword [ebp - 0x168]
push eax
push ecx
mov dword [ebp - 0x170], ecx
call fcn.004649bb
mov ecx, dword [ebp - 0x158]
mov edi, eax
mov dword [ebp - 0x150], edx
cmp edi, ecx
ja 0x4b4f34
cmp dword [ebp - 0x154], 7
lea eax, [ebp - 0x168]
mov dword [ebp - 0x158], edi
mov ecx, edi
jbe 0x4b4f26
mov eax, dword [ebp - 0x168]
xor esi, esi
mov word [eax + ecx*2], si
mov dword [ebp - 0x114], esi
jmp 0x4b4f56
mov eax, edi
sub eax, ecx
lea ecx, [ebp - 0x168]
push 0
push eax
call fcn.0045b110
mov edx, dword [ebp - 0x150]
mov dword [ebp - 0x114], 0
mov eax, edx
cmp edi, dword [ebp - 0x170]
jae 0x4b4ed0
mov esi, dword [ebp - 0x134]
and esi, 0xffffffef
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x114], 0x62961c
mov dword [ebp - 0x134], esi
mov dword [ebp - 4], 5
or esi, 8
mov dword [ebp - 0x134], esi
test eax, eax
jne 0x4b52a0
mov byte [ebp - 4], 8
lea eax, [ebp - 0x168]
push eax
lea ecx, [ebp - 0x130]
call fcn.0045bcc0
lea eax, [ebp - 0x14c]
or esi, 0x20
push eax
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x134], esi
call fcn.0045c2c0
and esi, 0xfffffff7
mov dword [ebp - 0x134], esi
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x154]
cmp eax, 7
jbe 0x4b4ffa
push eax
push dword [ebp - 0x168]
lea eax, [ebp - 0x168]
push eax
call fcn.0045c470
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 7
mov word [ebp - 0x168], ax
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x138]
cmp eax, 7
jbe 0x4b503c
push eax
push dword [ebp - 0x14c]
lea eax, [ebp - 0x14c]
push eax
call fcn.0045c470
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x138], 7
mov word [ebp - 0x14c], ax
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x130]
cmp dword [ebp - 0x11c], 7
mov edi, dword [ebp - 0x120]
cmova eax, dword [ebp - 0x130]
mov dword [ebp - 0x150], eax
mov dword [ebp - 4], 0xf
call fcn.004648b7
mov dword [ebp - 0x114], eax
mov dword [ebp - 4], 0x10
xorps xmm0, xmm0
or esi, 0x200
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x138], 0xf
mov dword [ebp - 0x134], esi
movups xmmword [ebp - 0x14c], xmm0
mov byte [ebp - 0x14c], 0
test edi, edi
je 0x4b514c
cmp edi, 0x7fffffff
ja 0x4b52ab
push 0
push 0
push edi
push dword [ebp - 0x150]
push eax
call fcn.00464908
mov dword [ebp - 0x170], eax
test edx, edx
jne 0x4b52b0
push edx
push eax
lea ecx, [ebp - 0x14c]
call fcn.0044b520
push dword [ebp - 0x170]
cmp dword [ebp - 0x138], 0xf
lea eax, [ebp - 0x14c]
cmova eax, dword [ebp - 0x14c]
push eax
push edi
push dword [ebp - 0x150]
push dword [ebp - 0x114]
call fcn.00464908
test edx, edx
jne 0x4b52b7
and esi, 0xfffffdff
mov dword [ebp - 0x134], esi
mov dword [ebp - 4], 0xf
or esi, 0x100
mov dword [ebp - 0x134], esi
and esi, 0xfffffeff
mov dword [ebp - 0x134], esi
mov dword [ebp - 4], 0xe
or esi, 0x80
mov dword [ebp - 0x134], esi
and esi, 0xffffff7f
mov dword [ebp - 0x134], esi
mov dword [ebp - 4], 0xd
or esi, 0x40
push 5
mov dword [ebp - 0x134], esi
lea eax, [ebp - 0x14c]
cmp dword [ebp - 0x138], 0xf
push 0
cmova eax, dword [ebp - 0x14c]
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
and esi, 0xffffffbf
mov dword [ebp - 0x134], esi
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x14c]
call fcn.0044b910
and esi, 0xffffffdf
mov dword [ebp - 0x134], esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x11c]
cmp eax, 7
jbe 0x4b5214
push eax
push dword [ebp - 0x130]
lea eax, [ebp - 0x130]
push eax
call fcn.0045c470
add esp, 0xc
mov esi, dword [ebp - 0x178]
xor eax, eax
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 7
mov word [ebp - 0x130], ax
mov eax, dword [esi]
mov ecx, esi
push dword [ebp - 0x16c]
push dword [ebp - 0x17c]
mov eax, dword [eax + 4]
call eax
test eax, eax
je 0x4b5273
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xc]
call eax
mov ecx, dword [esi + 8]
mov edi, eax
test ecx, ecx
je 0x4b5267
call fcn.004a75e0
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov eax, edi
jmp 0x4b5275
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046676f
mov esp, ebp
pop ebp
ret 0x10
mov ecx, edx
call fcn.0045b0d0
mov ecx, edx
call fcn.0045b0d0
lea edx, [ebp - 0x118]
call fcn.0045bc60
call fcn.0045afa0
mov ecx, edx
call fcn.0045b0d0
mov ecx, edx
call fcn.0045b0d0
int3