Function at 0x4c5bc8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4c5bd0
push ebx
push esi
push edi
mov esi, dword [0x4ca72c]
mov edi, 0x4cc020
xor eax, eax
push ebp
push 0x4c62fd
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.004bbe74
mov eax, dword [edi]
mov eax, dword [eax + 0x374]
mov edx, dword [ebp - 4]
call fcn.004484b4
mov eax, dword [edi]
mov eax, dword [eax + 0x378]
mov edx, dword [ebp - 8]
call fcn.004484b4
mov eax, dword [edi]
mov eax, dword [eax + 0x37c]
mov edx, dword [ebp - 0xc]
call fcn.004484b4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004bbd28
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.004bc188
mov eax, 0x4cc07c
call fcn.0040487c
mov eax, 0x4cc084
call fcn.0040487c
mov eax, dword [ebp - 4]
call fcn.00404b3c
dec eax
jge 0x4c5c8b
mov eax, 0x4cc07c
call fcn.0040487c
mov eax, 0x4cc084
mov edx, 0x4c6314
call fcn.004048d0
jmp 0x4c5cd5
lea eax, [ebp - 0x2c]
call fcn.004b8ef8
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.00404c88
je 0x4c5cbb
mov eax, 0x4cc07c
call fcn.0040487c
mov eax, 0x4cc084
mov edx, 0x4c6314
call fcn.004048d0
jmp 0x4c5cd5
mov eax, 0x4cc07c
mov edx, dword [ebp - 8]
call fcn.004048d0
mov eax, 0x4cc084
mov edx, dword [ebp - 0x10]
call fcn.004048d0
mov eax, dword [ebp - 0xc]
mov edx, 0x4c6320
call fcn.00404c88
je 0x4c5cfd
mov eax, 0x4cc07c
call fcn.0040487c
mov eax, 0x4cc084
mov edx, 0x4c6314
call fcn.004048d0
mov eax, 0x4cc08c
mov edx, 0x4c6320
call fcn.004048d0
mov eax, dword [0x4cc084]
push eax
lea eax, [ebp - 0x30]
call fcn.004b8ef8
mov eax, dword [ebp - 0x30]
mov ecx, 0x4c6320
mov edx, dword [0x4cc07c]
call fcn.004bbfec
call fcn.004bccf0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.004bc4f0
mov eax, dword [ebp - 0x14]
mov dword [0x4cc094], eax
mov eax, dword [ebp - 0x18]
mov dword [0x4cc098], eax
cmp dword [ebp - 0x1c], 1
jl 0x4c5d60
cmp dword [ebp - 0x20], 1
jge 0x4c5d76
mov eax, dword [edi]
mov eax, dword [eax + 0x40]
mov dword [0x4cc09c], eax
mov eax, dword [edi]
mov eax, dword [eax + 0x44]
mov dword [0x4cc0a0], eax
jmp 0x4c5d86
mov eax, dword [ebp - 0x1c]
mov dword [0x4cc09c], eax
mov eax, dword [ebp - 0x20]
mov dword [0x4cc0a0], eax
mov edx, dword [0x4cc09c]
mov eax, dword [edi]
call fcn.00447bf4
mov edx, dword [0x4cc0a0]
mov eax, dword [edi]
call fcn.00447c18
mov eax, dword [0x4cc0a0]
push eax
mov ecx, dword [0x4cc09c]
mov edx, dword [0x4cc098]
mov eax, dword [0x4cc094]
call fcn.004bc354
lea eax, [ebp - 0x24]
mov ecx, 0x4c6338
mov edx, dword [0x4cc2bc]
call fcn.00404b88
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x4c634c
mov edx, 0x4c634c
mov eax, dword [ebp - 0x24]
call fcn.004b8af4
lea eax, [ebp - 0x28]
call fcn.004ba384
mov ebx, eax
test bl, bl
jne 0x4c5e19
mov eax, dword [esi]
mov edx, dword [eax + 0x380]
mov eax, dword [esi]
call fcn.004b737c
mov eax, dword [edi]
mov eax, dword [eax + 0x408]
mov edx, 0x4c635c
call fcn.004484b4
jmp 0x4c5eb4
mov eax, dword [edi]
mov eax, dword [eax + 0x408]
mov edx, dword [ebp - 0x28]
call fcn.004484b4
mov eax, dword [esi]
mov eax, dword [eax + 0x374]
mov edx, dword [ebp - 0x28]
call fcn.004484b4
mov eax, dword [ebp - 0x28]
mov edx, 0x4c636c
call fcn.00404c88
jne 0x4c5e5c
mov eax, dword [esi]
mov eax, dword [eax + 0x37c]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0xcc]
jmp 0x4c5eb4
mov eax, dword [ebp - 0x28]
mov edx, 0x4c635c
call fcn.00404c88
jne 0x4c5e7f
mov eax, dword [esi]
mov eax, dword [eax + 0x380]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0xcc]
jmp 0x4c5eb4
mov eax, dword [ebp - 0x28]
mov edx, 0x4c637c
call fcn.00404c88
jne 0x4c5ea2
mov eax, dword [esi]
mov eax, dword [eax + 0x384]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0xcc]
jmp 0x4c5eb4
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0xcc]
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x4c638c
mov edx, 0x4c634c
mov eax, dword [ebp - 0x24]
call fcn.004b8af4
lea eax, [ebp - 0x28]
call fcn.004ba384
mov ebx, eax
test bl, bl
jne 0x4c5eec
mov eax, dword [edi]
mov eax, dword [eax + 0x40c]
mov edx, 0x4c635c
call fcn.004484b4
jmp 0x4c5efc
mov eax, dword [edi]
mov eax, dword [eax + 0x40c]
mov edx, dword [ebp - 0x28]
call fcn.004484b4
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x4c639c
mov edx, 0x4c634c
mov eax, dword [ebp - 0x24]
call fcn.004b8af4
lea eax, [ebp - 0x28]
call fcn.004ba384
mov ebx, eax
test bl, bl
jne 0x4c5f68
mov eax, dword [esi]
mov eax, dword [eax + 0x378]
mov edx, 0x4c63ac
call fcn.004484b4
mov eax, dword [esi]
mov eax, dword [eax + 0x378]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [esi]
mov eax, dword [eax + 0x370]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [edi]
mov eax, dword [eax + 0x410]
mov edx, 0x4c63ac
call fcn.004484b4
jmp 0x4c6053
lea ecx, [ebp - 4]
mov edx, dword [ebp - 0x28]
mov eax, 0x4c63b8
call fcn.004b91a4
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.00409148
mov eax, dword [ebp - 0x34]
call fcn.00404b3c
dec eax
jge 0x4c5fda
mov eax, dword [esi]
mov eax, dword [eax + 0x378]
mov dword [eax + 0xc], 1
mov edx, 0x4c63ac
call fcn.004484b4
mov eax, dword [esi]
mov eax, dword [eax + 0x378]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [esi]
mov eax, dword [eax + 0x370]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [edi]
mov eax, dword [eax + 0x410]
mov edx, 0x4c63ac
call fcn.004484b4
jmp 0x4c6053
mov eax, dword [esi]
mov eax, dword [eax + 0x378]
mov dword [eax + 0xc], 1
mov edx, dword [ebp - 4]
call fcn.004484b4
mov eax, dword [esi]
mov eax, dword [eax + 0x378]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [edi]
mov eax, dword [eax + 0x410]
mov edx, dword [ebp - 4]
call fcn.004484b4
lea ecx, [ebp - 4]
mov edx, dword [ebp - 0x28]
mov eax, 0x4c6314
call fcn.004b91a4
mov eax, dword [ebp - 4]
mov edx, 0x4c63c4
call fcn.00404c88
jne 0x4c6041
mov eax, dword [esi]
mov eax, dword [eax + 0x370]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0xcc]
jmp 0x4c6053
mov eax, dword [esi]
mov eax, dword [eax + 0x370]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xcc]
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x4c63d0
mov edx, 0x4c634c
mov eax, dword [ebp - 0x24]
call fcn.004b8af4
lea eax, [ebp - 0x28]
call fcn.004ba384
mov ebx, eax
test bl, bl
jne 0x4c60c6
mov eax, dword [esi]
mov eax, dword [eax + 0x39c]
mov dword [eax + 0xc], 1
mov edx, 0x4c63e0
call fcn.004484b4
mov eax, dword [esi]
mov eax, dword [eax + 0x39c]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [esi]
mov eax, dword [eax + 0x398]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [edi]
mov eax, dword [eax + 0x414]
mov edx, 0x4c63f4
call fcn.004484b4
jmp 0x4c61df
lea ecx, [ebp - 4]
mov edx, dword [ebp - 0x28]
mov eax, 0x4c63b8
call fcn.004b91a4
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.00409148
mov eax, dword [ebp - 0x38]
call fcn.00404b3c
dec eax
jge 0x4c613b
mov eax, dword [esi]
mov eax, dword [eax + 0x39c]
mov dword [eax + 0xc], 1
mov edx, 0x4c63e0
call fcn.004484b4
mov eax, dword [esi]
mov eax, dword [eax + 0x39c]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [esi]
mov eax, dword [eax + 0x398]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [edi]
mov eax, dword [eax + 0x414]
mov edx, 0x4c63f4
call fcn.004484b4
jmp 0x4c61df
lea ecx, [ebp - 8]
mov edx, dword [ebp - 0x28]
mov eax, 0x4c6400
call fcn.004b91a4
mov eax, dword [ebp - 8]
mov edx, 0x4c63c4
call fcn.00404c88
jne 0x4c615e
mov bl, 1
jmp 0x4c6160
xor ebx, ebx
mov eax, dword [esi]
mov eax, dword [eax + 0x398]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0xcc]
cmp bl, 1
jne 0x4c619d
mov eax, dword [esi]
mov eax, dword [eax + 0x39c]
mov dword [eax + 0xc], 1
mov edx, dword [ebp - 4]
call fcn.004484b4
mov eax, dword [esi]
mov eax, dword [eax + 0x39c]
xor edx, edx
mov dword [eax + 0xc], edx
jmp 0x4c61c3
mov eax, dword [esi]
mov eax, dword [eax + 0x39c]
mov dword [eax + 0xc], 1
mov edx, 0x4c63e0
call fcn.004484b4
mov eax, dword [esi]
mov eax, dword [eax + 0x39c]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [0x4ca638]
mov eax, dword [eax]
call fcn.00467d54
mov eax, dword [edi]
mov eax, dword [eax + 0x414]
mov edx, dword [ebp - 4]
call fcn.004484b4
call fcn.004bc7f0
call fcn.004bf298
call fcn.004bca98
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x4c640c
mov edx, 0x4c634c
mov eax, dword [ebp - 0x24]
call fcn.004b8af4
lea eax, [ebp - 0x28]
call fcn.004ba384
mov ebx, eax
test bl, bl
jne 0x4c6226
mov eax, dword [esi]
mov eax, dword [eax + 0x354]
mov edx, 0x4c641c
call fcn.004484b4
jmp 0x4c6236
mov eax, dword [esi]
mov eax, dword [eax + 0x354]
mov edx, dword [ebp - 0x28]
call fcn.004484b4
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x4c6428
mov edx, 0x4c634c
mov eax, dword [ebp - 0x24]
call fcn.004b8af4
lea eax, [ebp - 0x28]
call fcn.004ba384
mov ebx, eax
test bl, bl
jne 0x4c626e
mov eax, dword [esi]
mov eax, dword [eax + 0x35c]
mov edx, 0x4c63ac
call fcn.004484b4
jmp 0x4c627e
mov eax, dword [esi]
mov eax, dword [eax + 0x35c]
mov edx, dword [ebp - 0x28]
call fcn.004484b4
push 0x4c6438
push 0xa
mov ecx, dword [0x4cb668]
mov dl, 1
mov eax, dword [0x41c310]
call fcn.00421108
mov ebx, eax
mov edx, 0x4c6448
mov eax, ebx
call fcn.00420dd4
mov eax, ebx
call fcn.0040398c
lea eax, [ebp - 0x28]
mov edx, 0x4c6448
call fcn.00404914
mov eax, dword [0x4ca638]
mov eax, dword [eax]
call fcn.00467d54
push 0
mov eax, dword [ebp - 0x28]
call fcn.00404d3c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6304
lea eax, [ebp - 0x38]
mov edx, 6
call fcn.004048a0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004048a0
ret