Function at 0x4c0a2c
Capabilities:
Create process on windows

Disassembly:
add esp, 0xfffffef8
push 0x2101
push 0
call fcn.004c05e8
add esp, 8
test eax, eax
jne 0x4c0a58
push 0x2201
push 0
call fcn.004c05e8
add esp, 8
test eax, eax
je 0x4c0a83
mov eax, dword [0x519078]
shr eax, 0x10
and ax, 0xffff
movzx eax, ax
shl eax, 0x10
or eax, 0x6232
mov dword [0x519078], eax
push eax
call fcn.0041a548
pop ecx
push 3
call fcn.004d934c
pop ecx
push 0x2101
push 0
call fcn.004c05e8
add esp, 8
test eax, eax
jne 0x4c0aa9
push 0x2201
push 0
call fcn.004c05e8
add esp, 8
test eax, eax
je 0x4c0ab1
push 1
call fcn.004d8a74
pop ecx
push 0
push 0x202
push 0
lea edx, [esp + 0x10]
push edx
call fcn.004530bc
add esp, 0x10
push 9
lea ecx, [esp + 8]
push ecx
call fcn.00403da4
add esp, 8
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
jne 0x4c0af2
push 1
lea edx, [esp + 8]
push edx
call fcn.00403da4
add esp, 8
mov dword [esp], eax
mov ecx, dword [esp]
test ecx, ecx
jne 0x4c0b5e
mov eax, dword [0x519078]
shr eax, 0x10
and ax, 0xffff
movzx eax, ax
shl eax, 0x10
or eax, 0x6432
mov dword [0x519078], eax
push eax
call fcn.0041a548
pop ecx
push 0xa
call fcn.004d934c
pop ecx
push 9
lea edx, [esp + 8]
push edx
call fcn.00403da4
add esp, 8
mov dword [esp], eax
mov ecx, dword [esp]
test ecx, ecx
jne 0x4c0b4f
push 1
lea eax, [esp + 8]
push eax
call fcn.00403da4
add esp, 8
mov dword [esp], eax
mov edx, dword [esp]
test edx, edx
jne 0x4c0b5e
push 1
call fcn.004d8a74
pop ecx
push esp
call fcn.00403e78
pop ecx
mov dword [esp], eax
mov ecx, dword [0x5186a4]
test ecx, ecx
jne 0x4c0cfd
mov al, byte [0x51869f]
test al, al
jne 0x4c0c1e
push 0
push 0x2001
push 0x5e6791
lea edx, [esp + 0x10]
push edx
call fcn.004530bc
add esp, 0x10
push 0x2100
lea ecx, [esp + 8]
push ecx
call fcn.00405b9c
add esp, 8
test eax, eax
je 0x4c0c1e
mov al, byte [0x5f4a40]
test al, al
je 0x4c0bdf
push 0x5e679a
lea edx, [esp + 8]
push edx
call fcn.004cd308
add esp, 8
push 0x5f4a40
lea ecx, [esp + 8]
push ecx
call fcn.004cd308
add esp, 8
push 5
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_WinExec
mov eax, dword [0x519078]
shr eax, 0x10
and ax, 0xffff
movzx eax, ax
shl eax, 0x10
or eax, 0x6632
mov dword [0x519078], eax
push eax
call fcn.0041a548
pop ecx
push 2
call fcn.004d934c
pop ecx
push 1
call fcn.004d8a74
pop ecx
push 0
push 0x102
push 0
lea edx, [esp + 0x10]
push edx
call fcn.004530bc
add esp, 0x10
push 9
lea ecx, [esp + 8]
push ecx
call fcn.00403da4
add esp, 8
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
jne 0x4c0c5f
push 1
lea edx, [esp + 8]
push edx
call fcn.00403da4
add esp, 8
mov dword [esp], eax
mov ecx, dword [esp]
test ecx, ecx
jne 0x4c0c91
mov eax, dword [0x519078]
shr eax, 0x10
and ax, 0xffff
movzx eax, ax
shl eax, 0x10
or eax, 0x6932
mov dword [0x519078], eax
push eax
call fcn.0041a548
pop ecx
push 9
call fcn.004d934c
pop ecx
mov edx, dword [esp]
test edx, edx
jne 0x4c0cfd
push 9
lea ecx, [esp + 8]
push ecx
call fcn.00403da4
add esp, 8
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
jne 0x4c0cc3
push 1
lea edx, [esp + 8]
push edx
call fcn.00403da4
add esp, 8
mov dword [esp], eax
mov ecx, dword [esp]
test ecx, ecx
jne 0x4c0cfd
mov eax, dword [0x519078]
shr eax, 0x10
and ax, 0xffff
movzx eax, ax
shl eax, 0x10
or eax, 0x6b32
mov dword [0x519078], eax
push eax
call fcn.0041a548
pop ecx
push 1
call fcn.004d934c
pop ecx
push 1
call fcn.004d8a74
pop ecx
mov eax, 1
add esp, 0x108
ret