Function at 0x4b1d70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x613ad0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xa170]
and ecx, 0x20000
je 0x4b1da2
xor eax, eax
jmp 0x4b20a2
cmp dword [ebp + 0x10], 0
jl 0x4b1db6
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
cmp eax, dword [edx + 0x5e4]
jl 0x4b1dbd
xor eax, eax
jmp 0x4b20a2
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [ebp + 0x10]
mov ecx, dword [edx + eax*4]
mov edx, dword [ecx]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ebp + 0x10]
mov eax, dword [ecx + edx*4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x24], ecx
cmp dword [ebp + 0x14], 0
jl 0x4b1df4
mov edx, dword [ebp + 0x14]
cmp edx, dword [ebp - 0x24]
jl 0x4b1dfb
xor eax, eax
jmp 0x4b20a2
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004a0bf0
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
imul eax, eax, 0x170
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3434]
cmp dword [edx + eax + 0x144], 0
je 0x4b1e35
xor eax, eax
jmp 0x4b20a2
push 0x5e3cac
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x424], ecx
mov edx, dword [ebp - 0x424]
add edx, 1
mov dword [ebp - 0x428], edx
mov eax, dword [ebp - 0x424]
mov cl, byte [eax]
mov byte [ebp - 0x429], cl
add dword [ebp - 0x424], 1
cmp byte [ebp - 0x429], 0
jne 0x4b1e5c
mov edx, dword [ebp - 0x424]
sub edx, dword [ebp - 0x428]
mov dword [ebp - 0x430], edx
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x24]
jge 0x4b1f0f
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x24]
jle 0x4b1eb7
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], edx
jmp 0x4b1ec8
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x4b1f04
mov ecx, dword [ebp - 0x28]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x18]
push eax
call fcn.004e1a70
add esp, 0xc
test eax, eax
jne 0x4b1ef2
mov dword [ebp - 0x14], 1
jmp 0x4b1f04
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x18]
movzx edx, byte [ecx]
cmp edx, 0x20
jne 0x4b1f02
jmp 0x4b1f04
jmp 0x4b1ebf
cmp dword [ebp - 0x14], 0
je 0x4b1f0f
jmp 0x4b1fed
push str.www.
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x434], ecx
mov edx, dword [ebp - 0x434]
add edx, 1
mov dword [ebp - 0x438], edx
mov eax, dword [ebp - 0x434]
mov cl, byte [eax]
mov byte [ebp - 0x439], cl
add dword [ebp - 0x434], 1
cmp byte [ebp - 0x439], 0
jne 0x4b1f36
mov edx, dword [ebp - 0x434]
sub edx, dword [ebp - 0x438]
mov dword [ebp - 0x440], edx
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x24]
jge 0x4b1fe6
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x24]
jle 0x4b1f91
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], edx
jmp 0x4b1fa2
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x4b1fde
mov ecx, dword [ebp - 0x28]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x18]
push eax
call fcn.004e1a70
add esp, 0xc
test eax, eax
jne 0x4b1fcc
mov dword [ebp - 0x14], 1
jmp 0x4b1fde
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x18]
movzx edx, byte [ecx]
cmp edx, 0x20
jne 0x4b1fdc
jmp 0x4b1fde
jmp 0x4b1f99
cmp dword [ebp - 0x14], 0
je 0x4b1fe6
jmp 0x4b1fed
xor eax, eax
jmp 0x4b20a2
cmp dword [ebp + 0xc], 0
jne 0x4b1ffd
mov eax, 1
jmp 0x4b20a2
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x18], ecx
jmp 0x4b2014
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x24]
jge 0x4b206d
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x18]
movzx edx, byte [ecx]
cmp edx, 0x20
je 0x4b2054
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x18]
movzx ecx, byte [eax]
cmp ecx, 0x20
jl 0x4b2054
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
movzx eax, byte [edx]
cmp eax, 0x3c
je 0x4b2054
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x18]
movzx edx, byte [ecx]
cmp edx, 0x3e
jne 0x4b2056
jmp 0x4b206d
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x18]
mov dl, byte [ecx]
mov byte [ebp + eax - 0x420], dl
jmp 0x4b200b
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
mov byte [ebp + eax - 0x420], 0
push 0
push 0
push 0
lea ecx, [ebp - 0x420]
push ecx
push str.open
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x39c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005aac48
mov esp, ebp
pop ebp
ret