Function at 0x4d2600
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa2c
mov eax, dword [0x506380]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa1c], ecx
lea ecx, [ebp - 0x140]
call fcn.004d37b0
mov byte [ebp - 0x141], 0
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x138]
call fcn.004d95c0
push 0
push 0
push 0x4f8e14
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x138]
call fcn.004d9370
movzx ecx, al
test ecx, ecx
jne 0x4d2666
mov byte [ebp - 0x141], 0
jmp 0x4d26db
xor edx, edx
mov word [ebp - 0x350], dx
push 0x206
push 0
lea eax, [ebp - 0x34e]
push eax
call fcn.0041de10
add esp, 0xc
push 0x4f8e44
push 0x104
lea ecx, [ebp - 0x350]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x138]
call fcn.004d9530
movzx eax, al
test eax, eax
jne 0x4d26b8
mov byte [ebp - 0x141], 0
jmp 0x4d26db
push 4
push str.3.2.0.0000
lea ecx, [ebp - 0x350]
push ecx
call fcn.004d06c0
add esp, 0xc
xor edx, edx
test eax, eax
setg dl
mov byte [ebp - 0x141], dl
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x4d271e
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x140]
push edx
mov ecx, dword [ebp - 0xa1c]
call fcn.004d1c20
movzx eax, al
test eax, eax
je 0x4d271e
lea ecx, [ebp - 0x138]
call fcn.004d8d80
lea ecx, [ebp - 0x140]
call fcn.004d37f0
jmp 0x4d29e7
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x140]
push edx
mov ecx, dword [ebp - 0xa1c]
call fcn.004d2370
movzx eax, al
test eax, eax
jne 0x4d29d1
push 0x104
lea ecx, [ebp - 0x680]
push ecx
call fcn.004d21e0
add esp, 8
lea ecx, [ebp - 0xa10]
call fcn.004d30f0
lea edx, [ebp - 0x680]
push edx
lea ecx, [ebp - 0xa10]
call fcn.004d3670
lea ecx, [ebp - 0x478]
call fcn.004d30f0
lea eax, [ebp - 0x680]
push eax
lea ecx, [ebp - 0x478]
call fcn.004d3670
push 0x5c
lea ecx, [ebp - 0xa10]
call fcn.004d2c40
mov dword [ebp - 0x8e4], eax
lea ecx, [ebp - 0xa10]
call fcn.004d2c00
push eax
mov ecx, dword [ebp - 0x8e4]
push ecx
lea ecx, [ebp - 0xa10]
call fcn.004d2fc0
push 0x5c
lea ecx, [ebp - 0x478]
call fcn.004d2c40
mov dword [ebp - 0x8e4], eax
mov edx, dword [ebp - 0x8e4]
add edx, 1
push edx
push 0
lea ecx, [ebp - 0x478]
call fcn.004d2fc0
lea ecx, [ebp - 0x8e0]
call fcn.004d30f0
push str.____
lea ecx, [ebp - 0x7b0]
call fcn.004d36b0
lea ecx, [ebp - 0x478]
call fcn.004d2d70
push eax
push 0x4f8e7c
lea ecx, [ebp - 0x8e0]
call fcn.004d3330
mov ecx, eax
call fcn.004d3330
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa20], eax
mov ecx, dword [ebp - 0xa20]
add ecx, 2
mov dword [ebp - 0xa24], ecx
mov edx, dword [ebp - 0xa20]
mov ax, word [edx]
mov word [ebp - 0xa26], ax
add dword [ebp - 0xa20], 2
cmp word [ebp - 0xa26], 0
jne 0x4d283e
mov ecx, dword [ebp - 0xa20]
sub ecx, dword [ebp - 0xa24]
sar ecx, 1
mov dword [ebp - 0xa2c], ecx
mov edx, dword [ebp - 0xa2c]
lea eax, [edx + edx + 1]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041a042
add esp, 4
mov dword [ebp - 0xa14], eax
mov eax, dword [ebp - 0xa14]
mov dword [ebp - 0x7b4], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x688], ecx
mov edx, dword [ebp - 0x7b4]
mov dword [ebp - 0x684], edx
mov eax, dword [ebp - 0x688]
movzx ecx, word [eax]
test ecx, ecx
je 0x4d2935
push 0
mov edx, dword [ebp - 0x688]
movzx eax, word [edx]
push eax
lea ecx, [ebp - 0x7b0]
call fcn.004d2ca0
cmp eax, 0xffffffff
je 0x4d2903
mov ecx, 0x5e
mov edx, dword [ebp - 0x684]
mov word [edx], cx
mov eax, dword [ebp - 0x684]
add eax, 2
mov dword [ebp - 0x684], eax
mov ecx, dword [ebp - 0x684]
mov edx, dword [ebp - 0x688]
mov ax, word [edx]
mov word [ecx], ax
mov ecx, dword [ebp - 0x684]
add ecx, 2
mov dword [ebp - 0x684], ecx
mov edx, dword [ebp - 0x688]
add edx, 2
mov dword [ebp - 0x688], edx
jmp 0x4d28bd
xor eax, eax
mov ecx, dword [ebp - 0x684]
mov word [ecx], ax
mov edx, dword [ebp - 0x7b4]
push edx
push 0x4f8e84
lea ecx, [ebp - 0x8e0]
call fcn.004d3330
mov ecx, eax
call fcn.004d3330
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0xa18], eax
mov ecx, dword [ebp - 0xa18]
push ecx
call fcn.0041b18f
add esp, 4
push 0
lea ecx, [ebp - 0xa10]
call fcn.004d2d40
push eax
lea ecx, [ebp - 0x8e0]
call fcn.004d2d40
push eax
push 0x4f8e88
push 0x4f8e98
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x7b0]
call fcn.004d2f20
lea ecx, [ebp - 0x8e0]
call fcn.004d2f20
lea ecx, [ebp - 0x478]
call fcn.004d2f20
lea ecx, [ebp - 0xa10]
call fcn.004d2f20
lea ecx, [ebp - 0x138]
call fcn.004d8d80
lea ecx, [ebp - 0x140]
call fcn.004d37f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a0cf
mov esp, ebp
pop ebp
ret 4