Function at 0x4ea1ec
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x1e
push 0
push 0
dec ecx
jne 0x4ea1f5
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ea92a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.004057c0
je 0x4ea8f2
mov eax, dword [0x574604]
cmp byte [eax], 0
je 0x4ea2e8
lea eax, [ebp - 0xcc]
xor ecx, ecx
mov edx, 0x44
call fcn.00403628
mov dword [ebp - 0xcc], 0x44
mov dword [ebp - 0xa0], 1
mov word [ebp - 0x9c], 0xa
cmp dword [ebp + 0x14], 0
jl 0x4ea2a4
cmp dword [ebp + 0x10], 0
jl 0x4ea2a4
mov eax, dword [ebp + 0x14]
test eax, eax
jns 0x4ea285
call fcn.00403c14
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp + 0x10]
test eax, eax
jns 0x4ea297
call fcn.00403c14
mov dword [ebp - 0xb8], eax
or dword [ebp - 0xa0], 4
cmp dword [ebp + 0xc], 0
jle 0x4ea36d
cmp dword [ebp + 8], 0
jle 0x4ea36d
mov eax, dword [ebp + 0xc]
test eax, eax
jns 0x4ea2c4
call fcn.00403c14
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp + 8]
test eax, eax
jns 0x4ea2d6
call fcn.00403c14
mov dword [ebp - 0xb0], eax
or dword [ebp - 0xa0], 2
jmp 0x4ea36d
lea eax, [ebp - 0x88]
xor ecx, ecx
mov edx, 0x44
call fcn.00403628
mov dword [ebp - 0x88], 0x44
mov dword [ebp - 0x5c], 1
mov word [ebp - 0x58], 0xa
cmp dword [ebp + 0x14], 0
jl 0x4ea33f
cmp dword [ebp + 0x10], 0
jl 0x4ea33f
mov eax, dword [ebp + 0x14]
test eax, eax
jns 0x4ea329
call fcn.00403c14
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x10]
test eax, eax
jns 0x4ea338
call fcn.00403c14
mov dword [ebp - 0x74], eax
or dword [ebp - 0x5c], 4
cmp dword [ebp + 0xc], 0
jle 0x4ea36d
cmp dword [ebp + 8], 0
jle 0x4ea36d
mov eax, dword [ebp + 0xc]
test eax, eax
jns 0x4ea357
call fcn.00403c14
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 8]
test eax, eax
jns 0x4ea366
call fcn.00403c14
mov dword [ebp - 0x6c], eax
or dword [ebp - 0x5c], 2
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
call fcn.00405514
mov edx, dword [ebp - 0x28]
mov eax, 0x4ea944
call fcn.0056dddc
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jle 0x4ea3ac
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x40]
sub ecx, 1
jno 0x4ea39f
call fcn.00403c1c
mov edx, 1
mov eax, dword [ebp - 0x28]
call fcn.00405844
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
call fcn.00483fc8
push 0
lea eax, [ebp - 0xe0]
push eax
xor ecx, ecx
mov edx, 0x4ea94c
mov eax, dword [ebp - 0x2c]
call fcn.004af81c
mov edx, dword [ebp - 0xe0]
lea eax, [ebp - 0x2c]
call fcn.00405514
mov eax, dword [ebp - 0x2c]
call fcn.0048426c
test al, al
jne 0x4ea3f1
lea eax, [ebp - 0x2c]
call fcn.004054b0
push 0
lea eax, [ebp - 0xe4]
push eax
xor ecx, ecx
mov edx, 0x4ea94c
mov eax, dword [ebp - 0x28]
call fcn.004af81c
mov edx, dword [ebp - 0xe4]
lea eax, [ebp - 0x28]
call fcn.00405514
lea edx, [ebp - 0xec]
mov eax, dword [ebp - 0x28]
call fcn.00484068
mov eax, dword [ebp - 0xec]
lea ecx, [ebp - 0xe8]
xor edx, edx
call fcn.00483ed0
mov eax, dword [ebp - 0xe8]
lea edx, [ebp - 0x30]
call fcn.00409f28
mov edx, dword [ebp - 0x30]
mov eax, 0x4ea954
call fcn.004059bc
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jle 0x4ea47a
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x40]
sub ecx, 1
jno 0x4ea46d
call fcn.00403c1c
mov edx, 1
mov eax, dword [ebp - 0x30]
call fcn.00405844
lea edx, [ebp - 0xf0]
mov eax, dword [ebp - 8]
call fcn.004840b4
mov eax, dword [ebp - 0xf0]
lea edx, [ebp - 0x34]
call fcn.00409f28
lea eax, [ebp - 0x34]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 0x34]
call fcn.00405844
mov eax, dword [0x574604]
cmp byte [eax], 0
je 0x4ea50c
mov eax, dword [ebp - 0x2c]
call fcn.0040568c
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
call fcn.004057c0
jne 0x4ea4d2
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0xcc]
push eax
mov eax, dword [ebp - 0x24]
push eax
push 0
push 0x4000000
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040568c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x19], al
jmp 0x4ea576
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x2c]
call fcn.00404f2c
mov eax, dword [ebp - 0x14]
call fcn.00405168
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
call fcn.004057c0
jne 0x4ea533
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.00404f2c
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x88]
push eax
mov eax, dword [ebp - 0x20]
push eax
push 0
push 0x4000000
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.00405168
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x4ea8db
test byte [ebp - 0xc], 1
jne 0x4ea7d1
mov dword [ebp - 0x40], 0x4e20
mov eax, dword [ebp - 0x34]
mov edx, 0x4ea95c
call fcn.004057c0
je 0x4ea5af
mov eax, dword [ebp - 0x34]
mov edx, 0x4ea96c
call fcn.004057c0
jne 0x4ea5b6
mov dword [ebp - 0x40], 0x1f4
mov eax, dword [ebp - 0x40]
test eax, eax
jns 0x4ea5c2
call fcn.00403c14
push eax
mov eax, dword [ebp - 0xdc]
push eax
call sub.user32.dll_WaitForInputIdle
mov eax, dword [ebp - 0x30]
mov edx, 0x4ea97c
call fcn.004057c0
je 0x4ea600
mov eax, dword [ebp - 0x34]
mov edx, 0x4ea95c
call fcn.004057c0
je 0x4ea600
mov eax, dword [ebp - 0x34]
mov edx, 0x4ea96c
call fcn.004057c0
jne 0x4ea71f
xor eax, eax
mov dword [ebp - 0x40], eax
mov edx, 5
mov eax, dword [ebp - 4]
call fcn.00533a40
call sub.user32.dll_GetForegroundWindow
mov dword [ebp - 0x3c], eax
lea edx, [ebp - 0xf4]
mov eax, dword [ebp - 0x3c]
call fcn.0056da58
mov eax, dword [ebp - 0xf4]
lea edx, [ebp - 0x28]
call fcn.00409f28
mov eax, dword [ebp - 0x30]
mov edx, 0x4ea97c
call fcn.004057c0
jne 0x4ea680
mov eax, dword [ebp - 0x28]
mov edx, 0x4ea994
call fcn.004057c0
je 0x4ea672
mov eax, dword [ebp - 0x28]
mov edx, 0x4ea9b4
call fcn.004057c0
je 0x4ea672
mov eax, dword [ebp - 0x28]
mov edx, 0x4ea9d4
call fcn.004057c0
jne 0x4ea680
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.004ea004
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x34]
mov edx, 0x4ea95c
call fcn.004057c0
jne 0x4ea6bb
mov eax, dword [ebp - 0x28]
mov edx, 0x4ea9e8
call fcn.004057c0
je 0x4ea6ad
mov eax, dword [ebp - 0x28]
mov edx, 0x4ea9fc
call fcn.004057c0
jne 0x4ea6bb
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.004ea004
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x34]
mov edx, 0x4ea96c
call fcn.004057c0
jne 0x4ea6e7
mov eax, dword [ebp - 0x28]
mov edx, 0x4eaa10
call fcn.004057c0
jne 0x4ea6e7
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.004ea004
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jg 0x4ea6fa
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xb
jne 0x4ea605
mov eax, dword [ebp - 0x34]
mov edx, 0x4ea95c
call fcn.004057c0
jne 0x4ea778
push 0x14
call sub.kernel32.dll_Sleep_1
mov edx, 0x14
mov eax, dword [ebp - 4]
call fcn.0053392c
jmp 0x4ea778
xor eax, eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0xd4]
push eax
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004e81d8
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x4ea74d
mov eax, dword [ebp - 0x3c]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
jne 0x4ea76a
push 0x14
call sub.kernel32.dll_Sleep_1
mov edx, 0xa
mov eax, dword [ebp - 4]
call fcn.0053392c
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0x33
jne 0x4ea724
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.004ea004
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp + 0x14], 0
jl 0x4ea789
cmp dword [ebp + 0x10], 0
jge 0x4ea78d
or dword [ebp - 0x44], 2
cmp dword [ebp + 0xc], 0
jle 0x4ea799
cmp dword [ebp + 8], 0
jg 0x4ea79d
or dword [ebp - 0x44], 1
cmp dword [ebp - 0x44], 3
je 0x4ea84f
mov eax, dword [ebp - 0x44]
test eax, eax
jns 0x4ea7b3
call fcn.00403c14
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
push 0
mov eax, dword [ebp - 0x3c]
push eax
call sub.user32.dll_SetWindowPos
jmp 0x4ea84f
push 0xffffffffffffffff
mov eax, dword [ebp - 0xdc]
push eax
call sub.user32.dll_WaitForInputIdle
jmp 0x4ea7f5
push 0xa
call sub.kernel32.dll_Sleep_1
mov edx, 0xa
mov eax, dword [ebp - 4]
call fcn.0053392c
push 0xa
mov eax, dword [ebp - 0xdc]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x4ea7e1
xor eax, eax
push ebp
push 0x4ea845
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0xdc]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x4ea83b
mov eax, dword [ebp - 0x38]
test eax, eax
jns 0x4ea838
call fcn.00403c14
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ea84f
xor eax, eax
push ebp
push 0x4ea88b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xd8]
test eax, eax
jns 0x4ea86c
call fcn.00403c14
call fcn.004b1ce8
test al, al
je 0x4ea881
mov eax, dword [ebp - 0xd8]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ea895
xor eax, eax
push ebp
push 0x4ea8d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xdc]
test eax, eax
jns 0x4ea8b2
call fcn.00403c14
call fcn.004b1ce8
test al, al
je 0x4ea8c7
mov eax, dword [ebp - 0xdc]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ea8db
mov eax, dword [ebp - 4]
mov byte [eax + 0x37f], 1
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00533a40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea931
lea eax, [ebp - 0xf4]
mov edx, 6
call fcn.004054c8
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.004054c8
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404cac
ret