Function at 0x4c15e0
Capabilities:
Create process on windows

Disassembly:
add esp, 0xfffffef8
push 0x2101
push 0
call fcn.004c119c
add esp, 8
test eax, eax
jne 0x4c160c
push 0x2201
push 0
call fcn.004c119c
add esp, 8
test eax, eax
je 0x4c1637
mov eax, dword [0x51a5d0]
shr eax, 0x10
and ax, 0xffff
movzx eax, ax
shl eax, 0x10
or eax, 0x6232
mov dword [0x51a5d0], eax
push eax
call fcn.0041a6f0
pop ecx
push 3
call fcn.004d9f54
pop ecx
push 0x2101
push 0
call fcn.004c119c
add esp, 8
test eax, eax
jne 0x4c165d
push 0x2201
push 0
call fcn.004c119c
add esp, 8
test eax, eax
je 0x4c1665
push 1
call fcn.004d967c
pop ecx
push 0
push 0x202
push 0
lea edx, [esp + 0x10]
push edx
call fcn.00453684
add esp, 0x10
push 9
lea ecx, [esp + 8]
push ecx
call fcn.00403da4
add esp, 8
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
jne 0x4c16a6
push 1
lea edx, [esp + 8]
push edx
call fcn.00403da4
add esp, 8
mov dword [esp], eax
mov ecx, dword [esp]
test ecx, ecx
jne 0x4c1712
mov eax, dword [0x51a5d0]
shr eax, 0x10
and ax, 0xffff
movzx eax, ax
shl eax, 0x10
or eax, 0x6432
mov dword [0x51a5d0], eax
push eax
call fcn.0041a6f0
pop ecx
push 0xa
call fcn.004d9f54
pop ecx
push 9
lea edx, [esp + 8]
push edx
call fcn.00403da4
add esp, 8
mov dword [esp], eax
mov ecx, dword [esp]
test ecx, ecx
jne 0x4c1703
push 1
lea eax, [esp + 8]
push eax
call fcn.00403da4
add esp, 8
mov dword [esp], eax
mov edx, dword [esp]
test edx, edx
jne 0x4c1712
push 1
call fcn.004d967c
pop ecx
push esp
call fcn.00403e78
pop ecx
mov dword [esp], eax
mov ecx, dword [0x519bfc]
test ecx, ecx
jne 0x4c18b1
mov al, byte [0x519bf7]
test al, al
jne 0x4c17d2
push 0
push 0x2001
push 0x5e7d65
lea edx, [esp + 0x10]
push edx
call fcn.00453684
add esp, 0x10
push 0x2100
lea ecx, [esp + 8]
push ecx
call fcn.00405b9c
add esp, 8
test eax, eax
je 0x4c17d2
mov al, byte [0x5f605c]
test al, al
je 0x4c1793
push 0x5e7d6e
lea edx, [esp + 8]
push edx
call fcn.004cdf10
add esp, 8
push 0x5f605c
lea ecx, [esp + 8]
push ecx
call fcn.004cdf10
add esp, 8
push 5
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_WinExec
mov eax, dword [0x51a5d0]
shr eax, 0x10
and ax, 0xffff
movzx eax, ax
shl eax, 0x10
or eax, 0x6632
mov dword [0x51a5d0], eax
push eax
call fcn.0041a6f0
pop ecx
push 2
call fcn.004d9f54
pop ecx
push 1
call fcn.004d967c
pop ecx
push 0
push 0x102
push 0
lea edx, [esp + 0x10]
push edx
call fcn.00453684
add esp, 0x10
push 9
lea ecx, [esp + 8]
push ecx
call fcn.00403da4
add esp, 8
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
jne 0x4c1813
push 1
lea edx, [esp + 8]
push edx
call fcn.00403da4
add esp, 8
mov dword [esp], eax
mov ecx, dword [esp]
test ecx, ecx
jne 0x4c1845
mov eax, dword [0x51a5d0]
shr eax, 0x10
and ax, 0xffff
movzx eax, ax
shl eax, 0x10
or eax, 0x6932
mov dword [0x51a5d0], eax
push eax
call fcn.0041a6f0
pop ecx
push 9
call fcn.004d9f54
pop ecx
mov edx, dword [esp]
test edx, edx
jne 0x4c18b1
push 9
lea ecx, [esp + 8]
push ecx
call fcn.00403da4
add esp, 8
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
jne 0x4c1877
push 1
lea edx, [esp + 8]
push edx
call fcn.00403da4
add esp, 8
mov dword [esp], eax
mov ecx, dword [esp]
test ecx, ecx
jne 0x4c18b1
mov eax, dword [0x51a5d0]
shr eax, 0x10
and ax, 0xffff
movzx eax, ax
shl eax, 0x10
or eax, 0x6b32
mov dword [0x51a5d0], eax
push eax
call fcn.0041a6f0
pop ecx
push 1
call fcn.004d9f54
pop ecx
push 1
call fcn.004d967c
pop ecx
mov eax, 1
add esp, 0x108
ret