Function at 0x4a70c0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4f354b
mov eax, dword fs:[0]
push eax
sub esp, 0x88
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x9c]
mov dword fs:[0], eax
push 0x44
xor ebx, ebx
lea eax, [esp + 0x5c]
push ebx
push eax
call sub.MSVCR90.dll_memset
xor eax, eax
add esp, 0xc
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x58], 0x44
cmp dword [0x10d7c90], ebx
je 0x4a7138
cmp dword [0x10d7c94], ebx
je 0x4a7138
mov eax, dword [esp + 0xac]
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], eax
xor ecx, ecx
mov word [esp + 0x88], cx
lea ecx, [esp + 0x14]
mov dword [esp + 0x84], 1
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov dword [esp + 0xa4], ebx
mov ebp, dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, 0x1010101
mov dword [0x10bc158], eax
mov dword [0x10bc15c], eax
mov dword [0x10bc160], eax
mov dword [0x10bc164], eax
mov dword [0x10bc168], eax
mov dword [0x10bc16c], eax
mov dword [0x10bc170], eax
mov dword [0x10bc174], eax
mov dword [0x10bc178], eax
mov dword [0x10bc17c], eax
xor edi, edi
lea ecx, [ecx]
push 0x5116d8
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov dword [edi*4 + 0x10bc158], ebx
cmp edi, ebx
jne 0x4a7249
push 0x4ff418
lea ecx, [esp + 0x3c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa4], 1
push eax
lea edx, [esp + 0x24]
push 0x103a570
push edx
call fcn.00410070
mov byte [esp + 0xb0], 2
mov ecx, dword [str.notepad.exe]
push ecx
push eax
lea edx, [esp + 0x54]
push edx
call fcn.00402a60
add esp, 0x18
mov byte [esp + 0xa4], 3
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa4], 2
lea ecx, [esp + 0x40]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0xa4], 1
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0xa4], bl
lea ecx, [esp + 0x38]
jmp 0x4a73d8
cmp edi, 1
jne 0x4a72dd
push 0x4ff418
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa4], 4
push eax
lea eax, [esp + 0x58]
push 0x1038d30
push eax
call fcn.00410070
mov byte [esp + 0xb0], 5
mov ecx, dword [str.cmd.exe]
push ecx
push eax
lea edx, [esp + 0x3c]
push edx
call fcn.00402a60
add esp, 0x18
mov byte [esp + 0xa4], 6
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa4], 5
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0xa4], 4
lea ecx, [esp + 0x54]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0xa4], bl
lea ecx, [esp + 0x30]
jmp 0x4a73d8
cmp edi, 2
jne 0x4a736e
push 0x4ff418
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0xa4], 7
push eax
lea eax, [esp + 0x20]
push 0x1038d30
push eax
call fcn.00410070
mov byte [esp + 0xb0], 8
mov ecx, dword [str.MsPaint.exe]
push ecx
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.00402a60
add esp, 0x18
mov byte [esp + 0xa4], 9
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa4], 8
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0xa4], 7
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0xa4], bl
lea ecx, [esp + 0x24]
jmp 0x4a73d8
cmp edi, 3
jne 0x4a74b0
push 0x4ff418
lea eax, [esp + 0x38]
push 0x10dd268
push eax
call fcn.00402a60
mov byte [esp + 0xb0], 0xa
mov ecx, dword [str.excel.exe]
push ecx
push eax
lea edx, [esp + 0x40]
push edx
call fcn.00402a60
add esp, 0x18
mov byte [esp + 0xa4], 0xb
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0xa4], 0xa
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0xa4], bl
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x5c]
push ecx
push ebx
push ebx
push 0x210
push 1
push ebx
push ebx
push ebx
push edx
call ebp
test eax, eax
je 0x4a740a
mov eax, dword [esp + 0x4c]
mov dword [edi*4 + 0x10bc158], eax
mov eax, dword [edi*4 + 0x10bc158]
cmp eax, 0x28
jae 0x4a7485
push eax
push ebx
push 0x401
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x4a7452
lea ecx, [esp + 0x3c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x3c], 0x103
jne 0x4a744b
push 0x103
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x5c]
push eax
push ebx
push ebx
push 0x210
push 1
push ebx
push ebx
push ebx
push ecx
mov dword [edi*4 + 0x10bc158], ebx
call ebp
test eax, eax
je 0x4a7485
mov edx, dword [esp + 0x4c]
mov dword [edi*4 + 0x10bc158], edx
mov eax, dword [edi*4 + 0x10bc158]
mov ecx, dword [edi*4 + 0x53efac]
push eax
push ecx
push str.RunAppOtherDesktop__s__d_
push 8
call fcn.0043d500
inc edi
add esp, 0x10
cmp edi, 0xa
jl 0x4a71a0
jmp 0x4a74b6
mov dword [0x10d7ca0], edi
mov dword [esp + 0xa4], 0xffffffff
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x9c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret