Function at 0x4e6c50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x594b6e
mov eax, dword fs:[0]
push eax
sub esp, 0x63c
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x648]
mov ecx, 0x18f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x5dd1c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x390], 0
mov dword [ebp - 0x24], 0
call fcn.004864bf
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x48], 0
mov esi, esp
lea eax, [ebp - 0x54]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ole32.dll_StringFromCLSID]
cmp esi, esp
call fcn.0048515a
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x4e6cf1
mov dword [ebp - 0x63c], 0
jmp 0x4e6d82
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.00486267
add esp, 4
add eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x3fffffff
jle 0x4e6d18
mov dword [ebp - 0x640], 0
jmp 0x4e6d76
mov edx, dword [ebp - 0x24]
shl edx, 1
add edx, 0x24
mov dword [ebp - 0x644], edx
mov eax, dword [ebp - 0x644]
call fcn.00487586
mov dword [ebp - 0x648], esp
lea eax, [ebp - 0x390]
push eax
mov edx, dword [ebp - 0x644]
mov ecx, dword [ebp - 0x648]
call fcn.004839ae
add dword [ebp - 0x648], 0x20
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x24]
shl edx, 1
push edx
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x648]
push ecx
call fcn.00484bbf
mov dword [ebp - 0x640], eax
mov edx, dword [ebp - 0x640]
mov dword [ebp - 0x63c], edx
mov eax, dword [ebp - 0x63c]
mov dword [ebp - 0x6c], eax
mov esi, esp
mov eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp esi, esp
call fcn.0048515a
mov esi, esp
mov eax, dword [ebp - 0x6c]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp esi, esp
call fcn.0048515a
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x4e6dea
push str.hEvtHnd
push 0x59bb64
push 0
mov eax, dword [0x5dd18c]
add eax, 7
push eax
push str.c:_fireworks_source_fwkserver_fwkserver.cpp
push 2
call fcn.0048242d
add esp, 0x18
cmp eax, 1
jne 0x4e6dea
int3
cmp dword [ebp - 0x6c], 0
jne 0x4e6e1a
push 0x5acbbc
push 0x59bb64
push 0
mov eax, dword [0x5dd18c]
add eax, 8
push eax
push str.c:_fireworks_source_fwkserver_fwkserver.cpp
push 2
call fcn.0048242d
add esp, 0x18
cmp eax, 1
jne 0x4e6e1a
int3
lea eax, [ebp - 0x184]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00481bdb
add esp, 8
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jge 0x4e6eca
mov esi, esp
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0048515a
mov eax, dword [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x190]
call fcn.004845d9
mov dword [ebp - 4], 0
push str.Class_is_not_registered.
lea ecx, [ebp - 0x19c]
call fcn.004845d9
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x19c]
push eax
mov ecx, dword [ebp - 0x190]
push ecx
call fcn.00486cf3
add esp, 8
mov ecx, dword [ebp - 0x18]
call fcn.004857b3
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x5dc], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x19c]
call fcn.00485155
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x190]
call fcn.00485155
mov eax, dword [ebp - 0x5dc]
jmp 0x4e737d
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, esp
call fcn.0048515a
push eax
lea eax, [ebp - 0x184]
push eax
push str._s__X_x
lea ecx, [ebp - 0x2b4]
push ecx
call fcn.004853bc
add esp, 0x10
push 0x44
push 0
lea eax, [ebp - 0x318]
push eax
call fcn.00482ae0
add esp, 0xc
mov dword [ebp - 0x318], 0x44
mov esi, esp
lea eax, [ebp - 0x2cc]
push eax
lea ecx, [ebp - 0x318]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea edx, [ebp - 0x2b4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp esi, esp
call fcn.0048515a
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
je 0x4e7295
mov esi, esp
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, esp
call fcn.0048515a
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0
je 0x4e6fa5
push str.dRetVal______DWORD__0x00000000L_____0__
push 0x59bb64
push 0
mov eax, dword [0x5dd18c]
add eax, 0x22
push eax
push str.c:_fireworks_source_fwkserver_fwkserver.cpp
push 2
call fcn.0048242d
add esp, 0x18
cmp eax, 1
jne 0x4e6fa5
int3
mov esi, esp
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0048515a
mov esi, esp
mov eax, dword [ebp - 0x2c8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0048515a
cmp dword [ebp - 0x6c], 0
jne 0x4e6ffe
push 0x5acbbc
push 0x59bb64
push 0
mov eax, dword [0x5dd18c]
add eax, 0x25
push eax
push str.c:_fireworks_source_fwkserver_fwkserver.cpp
push 2
call fcn.0048242d
add esp, 0x18
cmp eax, 1
jne 0x4e6ffe
int3
mov eax, dword [ebp - 0x6c]
push eax
call fcn.00481b77
add esp, 4
mov ecx, dword [ebp - 0x6c]
mov byte [ecx + eax - 1], 0
mov edx, dword [ebp - 0x6c]
add edx, 1
mov dword [ebp - 0x6c], edx
mov esi, esp
mov eax, dword [ebp - 0x6c]
push eax
push 1
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp esi, esp
call fcn.0048515a
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0
jne 0x4e70b9
mov esi, esp
push 0
push 0
lea eax, [ebp - 0x348]
push eax
push 0
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, esp
call fcn.0048515a
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
cmp esi, esp
call fcn.0048515a
mov esi, esp
push 0x40
push 0x5ad480
mov eax, dword [ebp - 0x348]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.0048515a
mov esi, esp
mov eax, dword [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, esp
call fcn.0048515a
mov eax, 0x80004005
jmp 0x4e737d
mov esi, esp
push 0
push 0
push 0
push 2
mov eax, dword [ebp - 0x33c]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp esi, esp
call fcn.0048515a
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0
jne 0x4e70f0
mov eax, 0x80004005
jmp 0x4e737d
mov eax, dword [ebp - 0x354]
mov byte [eax], 0
mov esi, esp
mov eax, dword [ebp - 0x354]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp esi, esp
call fcn.0048515a
mov dword [ebp - 0x360], 0
mov eax, dword [0x5ada20]
mov dword [ebp - 0x5f4], eax
mov ecx, dword [0x5ada24]
mov dword [ebp - 0x5f0], ecx
mov edx, dword [0x5ada28]
mov dword [ebp - 0x5ec], edx
mov eax, dword [0x5ada2c]
mov dword [ebp - 0x5e8], eax
lea ecx, [ebp - 0x5f4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00483517
add esp, 8
test eax, eax
je 0x4e7171
push str.FWK_SystemControl.exe
call fcn.00485394
add esp, 4
mov dword [ebp - 0x360], eax
push 0x28
call fcn.0048602d
add esp, 4
mov dword [ebp - 0x618], eax
mov dword [ebp - 4], 2
cmp dword [ebp - 0x618], 0
je 0x4e71ea
mov eax, dword [ebp - 0x360]
push eax
movzx ecx, byte [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x2c0]
push edx
mov eax, dword [ebp - 0x33c]
push eax
mov ecx, dword [ebp - 0x2cc]
push ecx
lea edx, [ebp - 0x184]
push edx
mov eax, dword [ebp + 8]
sub esp, 0x10
mov ecx, esp
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x618]
call fcn.00481d07
mov dword [ebp - 0x63c], eax
jmp 0x4e71f4
mov dword [ebp - 0x63c], 0
mov ecx, dword [ebp - 0x63c]
mov dword [ebp - 0x60c], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x60c]
mov dword [ebp - 0x600], edx
lea eax, [ebp - 0x600]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x38
call fcn.00484d7c
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x4c]
add ecx, 1
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0x48
call fcn.00486e33
mov ecx, dword [ebp - 0x18]
add ecx, 0x38
call fcn.004834a9
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x4c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x48]
mov eax, dword [eax + 0x14]
mov dword [ecx + edx*4 - 4], eax
lea eax, [ebp - 0x184]
push eax
push str._s_started___n
mov ecx, dword [0x5dd18c]
add ecx, 0x42
push ecx
push 0x5ad310
lea ecx, [ebp - 0x628]
call fcn.00484b10
push eax
call fcn.00485bb4
add esp, 0xc
xor eax, eax
jmp 0x4e737d
mov esi, esp
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0048515a
mov esi, esp
push 0
push 0
lea eax, [ebp - 0x36c]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
cmp edi, esp
call fcn.0048515a
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, esp
call fcn.0048515a
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
cmp esi, esp
call fcn.0048515a
lea eax, [ebp - 0x184]
push eax
lea ecx, [ebp - 0x378]
call fcn.004845d9
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x36c]
push eax
lea ecx, [ebp - 0x384]
call fcn.004845d9
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x384]
push eax
mov ecx, dword [ebp - 0x378]
push ecx
call fcn.00486cf3
add esp, 8
mov esi, esp
mov eax, dword [ebp - 0x36c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, esp
call fcn.0048515a
mov ecx, dword [ebp - 0x18]
call fcn.004857b3
mov dword [ebp - 0x634], 0x80041039
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x384]
call fcn.00485155
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x378]
call fcn.00485155
mov eax, dword [ebp - 0x634]
push edx
mov ecx, ebp
push eax
lea edx, [0x4e73b8]
push dword [ebp - 0x390]
call fcn.0048178f
pop eax
pop edx
lea esp, [ebp - 0x658]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048493f
mov esp, ebp
pop ebp
ret 8