Function at 0x4ec250
Capabilities:
Create process on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 4]
sub esp, 0x70
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push ecx
mov dword [0x5f92e8], eax
mov dword [0x5eeeb4], ebp
call fcn.005a1f4e
add esp, 4
mov dword [0x5c8838], eax
call fcn.004e73d0
test eax, eax
je 0x4ec2b5
call fcn.004ec1c0
test eax, eax
je 0x4ec2b5
call fcn.004bf290
mov ecx, dword [esp + 0x90]
call fcn.004e96a0
test eax, eax
jne 0x4ec489
mov eax, dword [0x5f92ec]
cmp eax, ebp
je 0x4ec2b5
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [0x5f67c0]
cmp eax, ebp
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4ec2c7
push eax
call ebx
mov eax, dword [0x5c8838]
cmp eax, ebp
mov dword [0x5f67c0], ebp
je 0x4ec2df
push eax
call fcn.0059112a
add esp, 4
mov dword [0x5c8838], ebp
call fcn.004741d0
call fcn.005372b0
call sub.WSOCK32.dll_WSACleanup
mov eax, dword [0x5ed580]
cmp eax, ebp
mov esi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
je 0x4ec306
push eax
call esi
mov eax, dword [0x5ed574]
cmp eax, ebp
mov dword [0x5ed580], ebp
je 0x4ec318
push eax
call esi
mov dword [0x5ed574], ebp
call fcn.0046a910
cmp dword [0x5ef6d0], ebp
je 0x4ec364
mov eax, dword [0x5eeec8]
cmp eax, ebp
jne 0x4ec348
push 0x5a57b4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebp
mov dword [0x5eeec8], eax
je 0x4ec364
push str.RegisterServiceProcess
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebp
je 0x4ec364
cmp dword [0x5ef6d0], ebp
je 0x4ec364
push ebp
push ebp
call eax
mov eax, dword [0x5eeee0]
cmp eax, ebp
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x5ef6d0], ebp
je 0x4ec37c
push eax
call esi
mov dword [0x5eeee0], ebp
call dword [sym.imp.ole32.dll_OleUninitialize]
mov eax, dword [0x5eeec0]
cmp eax, ebp
je 0x4ec394
push eax
call esi
mov eax, dword [0x5eeec4]
cmp eax, ebp
je 0x4ec3a0
push eax
call esi
mov eax, dword [0x5eeec8]
cmp eax, ebp
je 0x4ec3ac
push eax
call esi
mov eax, dword [0x5eeecc]
cmp eax, ebp
je 0x4ec3b8
push eax
call esi
mov eax, dword [0x5eeed0]
cmp eax, ebp
je 0x4ec3c4
push eax
call esi
mov eax, dword [0x5eeed4]
cmp eax, ebp
je 0x4ec3d0
push eax
call esi
mov eax, dword [0x5eeed8]
cmp eax, ebp
je 0x4ec3dc
push eax
call esi
cmp dword [0x5eeeb4], 2
jne 0x4ec47d
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x3e7
mov ecx, 0x5eef00
call fcn.00420e60
mov ecx, dword [0x5f92e8]
push 0x180
push 0x5eef00
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4ec47d
mov ecx, 0x5eef00
call fcn.00524470
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x3c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x40]
push ecx
push ebp
push ebp
push 0x4000200
push ebp
xor edx, edx
push ebp
mov dword [esp + 0x2c], edx
push ebp
mov dword [esp + 0x34], edx
push ebp
mov dword [esp + 0x3c], edx
push 0x5eef00
mov dword [esp + 0x64], 0x44
mov dword [esp + 0x44], edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, dword [esp + 0x10]
push edx
call ebx
mov eax, dword [esp + 0x14]
push eax
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x70
ret 0x10
call fcn.004e7870
mov edx, dword [0x5f92ec]
push ebp
push ebp
push 0x803c
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov ebx, dword [sym.imp.USER32.dll_GetMessageA]
push ebp
push ebp
push ebp
lea eax, [esp + 0x2c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x4ec4a8
cmp eax, ebp
je 0x4ec2b5
sub esp, 0x1c
mov edi, esp
mov ecx, 7
lea esi, [esp + 0x3c]
rep movsd dword es:[edi], dword [esi]
call fcn.004e79f0
jmp 0x4ec4a8