Function at 0x4a7c30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae62c
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x4df798]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x6c], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
sub ecx, 0x111
mov dword [ebp - 0x70], ecx
cmp dword [ebp - 0x70], 0xf4
ja case.0x4a84c6.2
mov edx, dword [ebp - 0x70]
movzx eax, byte [edx + 0x4a8784]
jmp dword [eax*4 + 0x4a876c]
mov ecx, dword [ebp - 0x6c]
call fcn.00433d08
mov byte [0x4e762f], 1
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
movzx edx, cx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
mov dword [0x52e138], edx
mov eax, dword [ebp - 0x10]
mov dword [0x52e13c], eax
xor eax, eax
jmp 0x4a875b
mov byte [0x4e762f], 0
xor eax, eax
jmp 0x4a875b
movzx ecx, byte [0x4e762f]
test ecx, ecx
je 0x4a7d98
lea ecx, [ebp - 0x20]
call fcn.00402460
mov edx, dword [ebp + 0x10]
and edx, 0xffff
movzx eax, dx
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp + 0x10]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x44], 0x1388
jg 0x4a7d27
cmp dword [ebp - 0x40], 0x1388
jle 0x4a7d37
mov byte [0x4e762f], 0
xor eax, eax
jmp 0x4a875b
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x20]
sub edx, dword [0x52e138]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x1c]
sub eax, dword [0x52e13c]
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x30]
call fcn.00402460
lea ecx, [ebp - 0x30]
call fcn.00402460
push eax
mov ecx, dword [ebp - 0x6c]
call fcn.004011e0
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x30]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], ecx
xor eax, eax
jmp 0x4a875b
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea ecx, [ebp - 0x50]
call fcn.00403ce0
mov dword [ebp - 4], 0
push 0x124
lea ecx, [ebp - 0x50]
call fcn.00403c20
push 0
lea ecx, [ebp - 0x50]
call fcn.00403bf0
mov dword [ebp - 0x5c], eax
push 0
mov ecx, dword [ebp - 0x5c]
call fcn.00403bf0
mov dword [ebp - 0x48], eax
push 0xf3
mov ecx, 0x53550c
call fcn.00481790
push eax
push 0
mov ecx, dword [ebp - 0x5c]
call fcn.00403ba0
push eax
push 0x400
push 0
mov ecx, dword [ebp - 0x5c]
call fcn.00403bc0
push 0x74
mov ecx, 0x53550c
call fcn.00481790
push eax
push 1
mov ecx, dword [ebp - 0x5c]
call fcn.00403ba0
push eax
push 0x400
push 1
mov ecx, dword [ebp - 0x5c]
call fcn.00403bc0
push 0xf4
mov ecx, 0x53550c
call fcn.00481790
push eax
push 2
mov ecx, dword [ebp - 0x5c]
call fcn.00403ba0
push eax
push 0x400
push 2
mov ecx, dword [ebp - 0x5c]
call fcn.00403bc0
push 0xf5
mov ecx, 0x53550c
call fcn.00481790
push eax
push 3
mov ecx, dword [ebp - 0x5c]
call fcn.00403ba0
push eax
push 0x400
push 3
mov ecx, dword [ebp - 0x5c]
call fcn.00403bc0
push 0x18
mov ecx, 0x53550c
call fcn.00481790
push eax
push 0
mov ecx, dword [ebp - 0x48]
call fcn.00403ba0
push eax
push 0x400
push 0
mov ecx, dword [ebp - 0x48]
call fcn.00403bc0
push 0x12
mov ecx, 0x53550c
call fcn.00481790
push eax
push 1
mov ecx, dword [ebp - 0x48]
call fcn.00403ba0
push eax
push 0x400
push 1
mov ecx, dword [ebp - 0x48]
call fcn.00403bc0
push 0x14
mov ecx, 0x53550c
call fcn.00481790
push eax
push 2
mov ecx, dword [ebp - 0x48]
call fcn.00403ba0
push eax
push 0x400
push 2
mov ecx, dword [ebp - 0x48]
call fcn.00403bc0
push 0x13
mov ecx, 0x53550c
call fcn.00481790
push eax
push 3
mov ecx, dword [ebp - 0x48]
call fcn.00403ba0
push eax
push 0x400
push 3
mov ecx, dword [ebp - 0x48]
call fcn.00403bc0
push 0x15
mov ecx, 0x53550c
call fcn.00481790
push eax
push 4
mov ecx, dword [ebp - 0x48]
call fcn.00403ba0
push eax
push 0x400
push 4
mov ecx, dword [ebp - 0x48]
call fcn.00403bc0
push 0x16
mov ecx, 0x53550c
call fcn.00481790
push eax
push 5
mov ecx, dword [ebp - 0x48]
call fcn.00403ba0
push eax
push 0x400
push 5
mov ecx, dword [ebp - 0x48]
call fcn.00403bc0
push 0x17
mov ecx, 0x53550c
call fcn.00481790
push eax
push 6
mov ecx, dword [ebp - 0x48]
call fcn.00403ba0
push eax
push 0x400
push 6
mov ecx, dword [ebp - 0x48]
call fcn.00403bc0
push 0xd5
mov ecx, 0x53550c
call fcn.00481790
push eax
push 7
mov ecx, dword [ebp - 0x48]
call fcn.00403ba0
push eax
push 0x400
push 7
mov ecx, dword [ebp - 0x48]
call fcn.00403bc0
movzx eax, byte [0x4e762d]
test eax, eax
jne 0x4a7fe0
mov byte [0x4e22b3], 0
push 0x401
push 0
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx ecx, byte [0x4e7628]
test ecx, ecx
jne 0x4a8001
mov byte [0x4e20ae], 0
push 0x401
push 1
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx edx, byte [0x4e7629]
test edx, edx
jne 0x4a8022
mov byte [0x4e20af], 0
push 0x401
push 2
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx eax, byte [0x4e762a]
test eax, eax
jne 0x4a8043
mov byte [0x4e22b0], 0
push 0x401
push 3
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx ecx, byte [0x4e7627]
test ecx, ecx
jne 0x4a8064
mov byte [0x4e20ad], 0
push 0x401
push 4
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx edx, byte [0x4e762b]
test edx, edx
jne 0x4a8085
mov byte [0x4e22b1], 0
push 0x401
push 5
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx eax, byte [0x4e762c]
test eax, eax
jne 0x4a80a6
mov byte [0x4e22b2], 0
push 0x401
push 6
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx ecx, byte [0x4e762e]
test ecx, ecx
jne 0x4a80c7
mov byte [0x4e22b4], 0
push 0x401
push 7
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx edx, byte [0x4e22b3]
neg edx
sbb edx, edx
and edx, 8
or edx, 0x400
push edx
push 0
mov ecx, dword [ebp - 0x48]
call fcn.00403b40
movzx eax, byte [0x4e20ae]
neg eax
sbb eax, eax
and eax, 8
or eax, 0x400
push eax
push 1
mov ecx, dword [ebp - 0x48]
call fcn.00403b40
movzx ecx, byte [0x4e20af]
neg ecx
sbb ecx, ecx
and ecx, 8
or ecx, 0x400
push ecx
push 2
mov ecx, dword [ebp - 0x48]
call fcn.00403b40
movzx edx, byte [0x4e22b0]
neg edx
sbb edx, edx
and edx, 8
or edx, 0x400
push edx
push 3
mov ecx, dword [ebp - 0x48]
call fcn.00403b40
movzx eax, byte [0x4e20ad]
neg eax
sbb eax, eax
and eax, 8
or eax, 0x400
push eax
push 4
mov ecx, dword [ebp - 0x48]
call fcn.00403b40
movzx ecx, byte [0x4e22b1]
neg ecx
sbb ecx, ecx
and ecx, 8
or ecx, 0x400
push ecx
push 5
mov ecx, dword [ebp - 0x48]
call fcn.00403b40
movzx edx, byte [0x4e22b2]
neg edx
sbb edx, edx
and edx, 8
or edx, 0x400
push edx
push 6
mov ecx, dword [ebp - 0x48]
call fcn.00403b40
movzx eax, byte [0x4e22b4]
neg eax
sbb eax, eax
and eax, 8
or eax, 0x400
push eax
push 7
mov ecx, dword [ebp - 0x48]
call fcn.00403b40
mov dword [ebp - 0x60], 0
movzx ecx, byte [0x4e22b3]
test ecx, ecx
je 0x4a81d7
mov edx, dword [ebp - 0x60]
add edx, 1
mov dword [ebp - 0x60], edx
movzx eax, byte [0x4e20ae]
test eax, eax
je 0x4a81eb
mov ecx, dword [ebp - 0x60]
add ecx, 1
mov dword [ebp - 0x60], ecx
movzx edx, byte [0x4e20af]
test edx, edx
je 0x4a81ff
mov eax, dword [ebp - 0x60]
add eax, 1
mov dword [ebp - 0x60], eax
movzx ecx, byte [0x4e22b0]
test ecx, ecx
je 0x4a8213
mov edx, dword [ebp - 0x60]
add edx, 1
mov dword [ebp - 0x60], edx
movzx eax, byte [0x4e20ad]
test eax, eax
je 0x4a8227
mov ecx, dword [ebp - 0x60]
add ecx, 1
mov dword [ebp - 0x60], ecx
movzx edx, byte [0x4e22b1]
test edx, edx
je 0x4a823b
mov eax, dword [ebp - 0x60]
add eax, 1
mov dword [ebp - 0x60], eax
movzx ecx, byte [0x4e22b2]
test ecx, ecx
je 0x4a824f
mov edx, dword [ebp - 0x60]
add edx, 1
mov dword [ebp - 0x60], edx
movzx eax, byte [0x4e22b4]
test eax, eax
je 0x4a8263
mov ecx, dword [ebp - 0x60]
add ecx, 1
mov dword [ebp - 0x60], ecx
cmp dword [ebp - 0x60], 4
jg 0x4a8342
movzx edx, byte [0x4e22b3]
test edx, edx
je 0x4a8287
push 0x401
push 0
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx eax, byte [0x4e20ae]
test eax, eax
je 0x4a82a1
push 0x401
push 1
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx ecx, byte [0x4e20af]
test ecx, ecx
je 0x4a82bb
push 0x401
push 2
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx edx, byte [0x4e22b0]
test edx, edx
je 0x4a82d5
push 0x401
push 3
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx eax, byte [0x4e20ad]
test eax, eax
je 0x4a82ef
push 0x401
push 4
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx ecx, byte [0x4e22b1]
test ecx, ecx
je 0x4a8309
push 0x401
push 5
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx edx, byte [0x4e22b2]
test edx, edx
je 0x4a8323
push 0x401
push 6
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx eax, byte [0x4e22b4]
test eax, eax
je 0x4a833d
push 0x401
push 7
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
jmp 0x4a8412
movzx ecx, byte [0x4e22b3]
test ecx, ecx
je 0x4a835c
push 0x400
push 0
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx edx, byte [0x4e20ae]
test edx, edx
je 0x4a8376
push 0x400
push 1
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx eax, byte [0x4e20af]
test eax, eax
je 0x4a8390
push 0x400
push 2
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx ecx, byte [0x4e22b0]
test ecx, ecx
je 0x4a83aa
push 0x400
push 3
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx edx, byte [0x4e20ad]
test edx, edx
je 0x4a83c4
push 0x400
push 4
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx eax, byte [0x4e22b1]
test eax, eax
je 0x4a83de
push 0x400
push 5
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx ecx, byte [0x4e22b2]
test ecx, ecx
je 0x4a83f8
push 0x400
push 6
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx edx, byte [0x4e22b4]
test edx, edx
je 0x4a8412
push 0x400
push 7
mov ecx, dword [ebp - 0x48]
call fcn.00403b70
movzx eax, byte [0x4e7625]
test eax, eax
je 0x4a843d
push 0x401
push 0
mov ecx, dword [ebp - 0x5c]
call fcn.00403b70
push 0x408
push 1
mov ecx, dword [ebp - 0x5c]
call fcn.00403b40
jmp 0x4a845b
push 0x400
push 0
mov ecx, dword [ebp - 0x5c]
call fcn.00403b70
push 0x400
push 1
mov ecx, dword [ebp - 0x5c]
call fcn.00403b40
push 0
mov ecx, dword [ebp - 0x6c]
push ecx
mov edx, dword [ebp - 0x54]
push edx
mov eax, dword [ebp - 0x58]
push eax
push 0
mov ecx, dword [ebp - 0x5c]
call fcn.0042f028
mov dword [ebp - 0x68], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.00403c50
mov eax, dword [ebp - 0x68]
jmp 0x4a875b
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff
movzx edx, cx
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x74]
sub ecx, 0x801c
mov dword [ebp - 0x74], ecx
cmp dword [ebp - 0x74], 0x12
ja case.0x4a84c6.2
mov edx, dword [ebp - 0x74]
movzx eax, byte [edx + 0x4a88ac]
jmp dword [eax*4 + 0x4a887c]
movzx ecx, byte [0x4e22b3]
neg ecx
sbb ecx, ecx
add ecx, 1
mov byte [0x4e22b3], cl
mov edx, dword [ebp + 0x10]
push edx
push 1
push 0x7e8
mov ecx, dword [ebp - 0x6c]
call fcn.00402080
mov ecx, eax
call fcn.00403b10
jmp case.0x4a84c6.2
movzx eax, byte [0x4e20ae]
neg eax
sbb eax, eax
add eax, 1
mov byte [0x4e20ae], al
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0x7e8
mov ecx, dword [ebp - 0x6c]
call fcn.00402080
mov ecx, eax
call fcn.00403b10
jmp case.0x4a84c6.2
movzx edx, byte [0x4e20af]
neg edx
sbb edx, edx
add edx, 1
mov byte [0x4e20af], dl
mov eax, dword [ebp + 0x10]
push eax
push 1
push 0x7e8
mov ecx, dword [ebp - 0x6c]
call fcn.00402080
mov ecx, eax
call fcn.00403b10
jmp case.0x4a84c6.2
movzx ecx, byte [0x4e22b0]
neg ecx
sbb ecx, ecx
add ecx, 1
mov byte [0x4e22b0], cl
mov edx, dword [ebp + 0x10]
push edx
push 1
push 0x7e8
mov ecx, dword [ebp - 0x6c]
call fcn.00402080
mov ecx, eax
call fcn.00403b10
jmp case.0x4a84c6.2
movzx eax, byte [0x4e20ad]
neg eax
sbb eax, eax
add eax, 1
mov byte [0x4e20ad], al
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0x7e8
mov ecx, dword [ebp - 0x6c]
call fcn.00402080
mov ecx, eax
call fcn.00403b10
jmp case.0x4a84c6.2
movzx edx, byte [0x4e22b1]
neg edx
sbb edx, edx
add edx, 1
mov byte [0x4e22b1], dl
mov eax, dword [ebp + 0x10]
push eax
push 1
push 0x7e8
mov ecx, dword [ebp - 0x6c]
call fcn.00402080
mov ecx, eax
call fcn.00403b10
jmp case.0x4a84c6.2
movzx ecx, byte [0x4e22b2]
neg ecx
sbb ecx, ecx
add ecx, 1
mov byte [0x4e22b2], cl
mov edx, dword [ebp + 0x10]
push edx
push 1
push 0x7e8
mov ecx, dword [ebp - 0x6c]
call fcn.00402080
mov ecx, eax
call fcn.00403b10
jmp case.0x4a84c6.2
movzx eax, byte [0x4e22b4]
neg eax
sbb eax, eax
add eax, 1
mov byte [0x4e22b4], al
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0x7e8
mov ecx, dword [ebp - 0x6c]
call fcn.00402080
mov ecx, eax
call fcn.00403b10
jmp case.0x4a84c6.2
movzx edx, byte [0x4e7625]
neg edx
sbb edx, edx
add edx, 1
mov byte [0x4e7625], dl
movzx eax, byte [0x4e7625]
test eax, eax
je 0x4a868a
mov byte [0x4e7626], 1
jmp 0x4a86c9
push 4
push 0
push 0xf6
mov ecx, 0x53550c
call fcn.00481790
push eax
mov ecx, dword [ebp - 0x6c]
call fcn.0042f175
cmp eax, 6
jne 0x4a86c9
push 1
push 0
push 0
mov ecx, 0x52e134
call fcn.0040b6f0
push eax
push 0x4cb490
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.0x4a84c6.2
mov byte [0x4e7624], 1
push 0
mov ecx, dword [ebp - 0x6c]
call fcn.00433c9f
mov byte [0x4e20ac], 1
jmp case.0x4a84c6.2
movzx ecx, byte [0x4e7625]
test ecx, ecx
je 0x4a8736
mov byte [0x4e7625], 0
push 4
push 0
push 0xf6
mov ecx, 0x53550c
call fcn.00481790
push eax
mov ecx, dword [ebp - 0x6c]
call fcn.0042f175
cmp eax, 6
jne 0x4a8736
push 1
push 0
push 0
mov ecx, 0x52e134
call fcn.0040b6f0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
mov ecx, dword [ebp - 0x6c]
call fcn.00433c9f
mov byte [0x4e20ac], 1
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x6c]
call fcn.0042e41e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc