Function at 0x4a367c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x4a3684
push ebx
push esi
mov eax, 0x4a339c
call fcn.004063e0
mov esi, dword [0x4a5f1c]
xor eax, eax
push ebp
push 0x4a3b04
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4a3b14
call sub.user32.dll_FindWindowA
test eax, eax
jbe 0x4a36cf
push 0
push 0
push 0x1400
push eax
call sub.user32.dll_PostMessageA
jmp 0x4a3ac9
push 1
push 0x4a3b2c
call sub.kernel32.dll_WinExec
mov eax, dword [esi]
call fcn.00471368
mov eax, dword [esi]
mov edx, 0x4a3b50
call fcn.00470f60
mov ecx, dword [0x4a5cf4]
mov eax, dword [esi]
mov edx, dword [0x49c5ac]
call fcn.00471380
mov ecx, dword [0x4a5ef8]
mov eax, dword [esi]
mov edx, dword [0x49eb5c]
call fcn.00471380
mov ecx, dword [0x4a60c8]
mov eax, dword [esi]
mov edx, dword [0x49b7f0]
call fcn.00471380
mov ecx, dword [0x4a60d8]
mov eax, dword [esi]
mov edx, dword [0x49bd84]
call fcn.00471380
mov dl, 1
mov eax, dword [0x43613c]
call fcn.0043623c
mov ebx, eax
mov edx, 0x80000003
mov eax, ebx
call fcn.004362dc
xor ecx, ecx
mov edx, 0x4a3b70
mov eax, ebx
call fcn.00436340
test al, al
je 0x4a3a1b
call fcn.004a3218
mov eax, dword [0x4a5cb4]
cmp dword [eax], 0
je 0x4a386b
mov eax, dword [0x4a5d4c]
cmp dword [eax], 0
je 0x4a386b
mov eax, 0x4a7d4c
mov edx, dword [0x4a5d4c]
mov edx, dword [edx]
call fcn.00404168
mov edx, 0x4a7d30
mov eax, dword [0x4a7d4c]
call fcn.004a0590
mov eax, 0x4a7d4c
call fcn.00404114
lea edx, [ebp - 0x18]
mov eax, dword [0x4a5cf4]
mov eax, dword [eax]
mov eax, dword [eax + 0x418]
call fcn.004513e4
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408558
mov eax, dword [ebp - 0x14]
mov edx, 0x4a7d34
call fcn.004a0984
lea edx, [ebp - 0x20]
mov eax, dword [0x4a5cf4]
mov eax, dword [eax]
mov eax, dword [eax + 0x41c]
call fcn.004513e4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00408558
mov eax, dword [ebp - 0x1c]
mov edx, 0x4a7d3c
call fcn.004a0984
push 0x4a7d44
push 0x4a7d44
push 0x4a7d44
push 0x4a7d44
push 0x4a7d4c
mov ecx, 0x4a7d3c
mov edx, 0x4a7d34
mov eax, dword [0x4a7d30]
call fcn.004a2de8
mov eax, dword [0x4a5d4c]
mov edx, dword [0x4a7d4c]
call fcn.00404168
mov eax, 0x4a7d34
call fcn.004a0bfc
mov eax, 0x4a7d3c
call fcn.004a0bfc
mov eax, 0x4a7d44
call fcn.004a0bfc
mov eax, dword [0x4a5cb4]
mov eax, dword [eax]
mov edx, dword [0x4a5d4c]
mov edx, dword [edx]
call fcn.00404520
jne 0x4a38ae
mov eax, dword [0x4a60d8]
mov eax, dword [eax]
mov eax, dword [eax + 0x338]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [0x4a60d8]
mov eax, dword [eax]
mov eax, dword [eax + 0x34c]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
jmp 0x4a3abb
lea ecx, [ebp - 0x28]
mov edx, 0x4a3bac
mov eax, ebx
call fcn.00436508
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x24]
xor edx, edx
call fcn.00472de4
mov edx, dword [ebp - 0x24]
mov eax, dword [0x4a5cc0]
call fcn.00404168
lea ecx, [ebp - 0x30]
mov edx, 0x4a3bc0
mov eax, ebx
call fcn.00436508
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x2c]
xor edx, edx
call fcn.00472de4
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x4a5bbc]
call fcn.00404168
call fcn.0040a384
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x34]
call fcn.0040af98
mov edx, dword [ebp - 0x34]
mov eax, dword [0x4a5cc0]
mov eax, dword [eax]
call fcn.00404520
je 0x4a3997
call fcn.0040a384
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x3c]
call fcn.0040af98
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x38]
xor edx, edx
call fcn.00472de4
mov ecx, dword [ebp - 0x38]
mov edx, 0x4a3bac
mov eax, ebx
call fcn.004364dc
mov eax, dword [0x4a5bbc]
mov eax, dword [eax]
call fcn.004088fc
inc eax
lea edx, [ebp - 0x40]
call fcn.004087c0
mov edx, dword [ebp - 0x40]
mov eax, dword [0x4a5bbc]
call fcn.00404168
lea ecx, [ebp - 0x44]
mov eax, dword [0x4a5bbc]
mov eax, dword [eax]
xor edx, edx
call fcn.00472de4
mov ecx, dword [ebp - 0x44]
mov edx, 0x4a3bc0
mov eax, ebx
call fcn.004364dc
mov eax, dword [0x4a5db0]
mov edx, dword [0x4a5bbc]
mov edx, dword [edx]
call fcn.00404168
call fcn.0040a384
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x48]
call fcn.0040af98
mov edx, dword [ebp - 0x48]
mov eax, dword [0x4a5eb0]
call fcn.00404168
mov eax, dword [0x4a5db0]
cmp dword [eax], 0
je 0x4a3abb
mov eax, dword [0x4a5db0]
mov eax, dword [eax]
call fcn.004088fc
cmp eax, 7
jle 0x4a3abb
push 0x30
mov ecx, 0x4a3b14
mov edx, 0x4a3bcc
mov eax, dword [esi]
call fcn.00471590
mov eax, dword [0x4a60d8]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xec]
mov eax, dword [esi]
call fcn.004714ec
jmp 0x4a3abb
mov cl, 1
mov edx, 0x4a3b70
mov eax, ebx
call fcn.00436340
call fcn.0040a384
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x50]
call fcn.0040af98
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x4c]
xor edx, edx
call fcn.00472de4
mov ecx, dword [ebp - 0x4c]
mov edx, 0x4a3bac
mov eax, ebx
call fcn.004364dc
mov eax, dword [0x4a5bbc]
mov edx, 0x4a3c0c
call fcn.00404168
lea ecx, [ebp - 0x54]
mov eax, dword [0x4a5bbc]
mov eax, dword [eax]
xor edx, edx
call fcn.00472de4
mov ecx, dword [ebp - 0x54]
mov edx, 0x4a3bc0
mov eax, ebx
call fcn.004364dc
mov eax, dword [0x4a5db0]
mov edx, dword [0x4a5bbc]
mov edx, dword [edx]
call fcn.00404168
call fcn.0040a384
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x58]
call fcn.0040af98
mov edx, dword [ebp - 0x58]
mov eax, dword [0x4a5eb0]
call fcn.00404168
mov eax, ebx
call fcn.004033a8
mov eax, dword [esi]
call fcn.00471400
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3b0b
lea eax, [ebp - 0x58]
mov edx, 0xe
call fcn.00404138
lea eax, [ebp - 0x20]
call fcn.00404114
lea eax, [ebp - 0x1c]
call fcn.00404114
lea eax, [ebp - 0x18]
call fcn.00404114
lea eax, [ebp - 0x14]
call fcn.00404114
ret