Function at 0x4ba6e8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x4baa09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4dac20]
cmp byte [eax], 0
jne 0x4ba9c3
cmp byte [0x4da8c4], 0
je 0x4ba8a0
mov eax, dword [0x4dade8]
mov eax, dword [eax]
mov eax, dword [eax + 0x48c]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x4ba880
mov eax, 0x4baa20
call fcn.004c4130
lea ecx, [ebp - 8]
mov eax, dword [0x4dac14]
mov eax, dword [eax]
mov edx, 0x4baa40
call fcn.004745e0
mov edx, dword [ebp - 8]
mov eax, dword [0x4dade8]
mov eax, dword [eax]
mov eax, dword [eax + 0x3f0]
call fcn.004967b0
lea eax, [ebp - 0xc]
call fcn.004b9f18
mov edx, dword [ebp - 0xc]
mov eax, 0x4e25c0
call fcn.004051d0
cmp dword [0x4e25c0], 0
je 0x4ba860
lea ecx, [ebp - 0x10]
mov eax, dword [0x4dac14]
mov eax, dword [eax]
mov edx, 0x4baa68
call fcn.004745e0
mov edx, dword [ebp - 0x10]
mov eax, dword [0x4dade8]
mov eax, dword [eax]
mov eax, dword [eax + 0x4d8]
call fcn.004967b0
mov eax, dword [0x4dade8]
mov eax, dword [eax]
mov ebx, dword [eax + 0x384]
mov eax, ebx
call fcn.0048449c
mov edx, eax
sar edx, 1
jns 0x4ba7d6
adc edx, 0
mov eax, dword [0x4dade8]
mov eax, ebx
call fcn.00484684
mov eax, 0x4e25c0
mov edx, 0x4baa8c
call fcn.00405448
lea eax, [ebp - 0x14]
mov ecx, dword [0x4e25c0]
mov edx, 0x4baaa4
call fcn.00405494
mov eax, dword [ebp - 0x14]
call fcn.004c4130
push 0
mov eax, dword [0x4e25c0]
call fcn.0040560c
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x4dade8]
mov eax, dword [eax]
mov ebx, dword [eax + 0x384]
mov eax, ebx
call fcn.0048449c
mov edx, eax
mov eax, dword [0x4dade8]
mov eax, ebx
call fcn.00484684
push 0x80000001
push 0
mov ecx, 0x4baadc
mov edx, 0x4baaf8
mov eax, 0x4bab40
call fcn.004ae46c
jmp 0x4ba95e
push 0x80000001
push 0
mov ecx, 0x4baadc
mov edx, 0x4bab5c
mov eax, 0x4bab40
call fcn.004ae46c
jmp 0x4ba95e
push 0x80000001
push 0
mov ecx, 0x4baadc
mov edx, 0x4bab5c
mov eax, 0x4bab40
call fcn.004ae46c
jmp 0x4ba95e
lea eax, [ebp - 4]
mov edx, 0x4babac
call fcn.00405214
test dword [0x4da8c0], 1
jle 0x4ba8c6
lea eax, [ebp - 4]
mov edx, 0x4babc0
call fcn.00405448
test dword [0x4da8c0], 2
jle 0x4ba8df
lea eax, [ebp - 4]
mov edx, 0x4babd8
call fcn.00405448
test dword [0x4da8c0], 4
jle 0x4ba8f8
lea eax, [ebp - 4]
mov edx, 0x4babf0
call fcn.00405448
test dword [0x4da8c0], 8
jle 0x4ba911
lea eax, [ebp - 4]
mov edx, 0x4bac10
call fcn.00405448
test dword [0x4da8c0], 0x10
jle 0x4ba92a
lea eax, [ebp - 4]
mov edx, 0x4bac28
call fcn.00405448
push 0x80000001
push 0
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, 0x4bac44
call fcn.00405494
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.00405b5c
mov edx, dword [ebp - 0x18]
mov ecx, 0x4baadc
mov eax, 0x4bab40
call fcn.004ae46c
push 0x80000001
push 0
mov eax, dword [0x4dade8]
mov eax, dword [eax]
mov eax, dword [eax + 0x48c]
mov edx, dword [eax]
call dword [edx + 0xd8]
xor ecx, ecx
mov edx, 1
call fcn.00425de8
mov edx, eax
mov ecx, 0x4bac5c
mov eax, 0x4bac80
call fcn.004ae3dc
mov ecx, 0x80000001
mov edx, 0x4bac94
mov eax, 0x4bacbc
call fcn.004ae590
test al, al
je 0x4ba9c3
mov ecx, 0x80000001
mov edx, 0x4bac94
mov eax, 0x4bacbc
call fcn.004ae50c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4baa10
lea eax, [ebp - 0x1c]
call fcn.0040517c
lea eax, [ebp - 0x18]
call fcn.00405984
lea eax, [ebp - 0x14]
call fcn.0040517c
lea eax, [ebp - 0x10]
call fcn.00405984
lea eax, [ebp - 0xc]
call fcn.0040517c
lea eax, [ebp - 8]
call fcn.00405984
lea eax, [ebp - 4]
call fcn.0040517c
ret