Function at 0x4c5c00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4c5c08
push ebx
push esi
push edi
mov esi, dword [0x4ca72c]
mov edi, 0x4cc020
xor eax, eax
push ebp
push 0x4c6335
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.004bbe88
mov eax, dword [edi]
mov eax, dword [eax + 0x374]
mov edx, dword [ebp - 4]
call fcn.004484b4
mov eax, dword [edi]
mov eax, dword [eax + 0x378]
mov edx, dword [ebp - 8]
call fcn.004484b4
mov eax, dword [edi]
mov eax, dword [eax + 0x37c]
mov edx, dword [ebp - 0xc]
call fcn.004484b4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004bbd3c
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.004bc19c
mov eax, 0x4cc07c
call fcn.0040487c
mov eax, 0x4cc084
call fcn.0040487c
mov eax, dword [ebp - 4]
call fcn.00404b3c
dec eax
jge 0x4c5cc3
mov eax, 0x4cc07c
call fcn.0040487c
mov eax, 0x4cc084
mov edx, 0x4c634c
call fcn.004048d0
jmp 0x4c5d0d
lea eax, [ebp - 0x2c]
call fcn.004b8f0c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.00404c88
je 0x4c5cf3
mov eax, 0x4cc07c
call fcn.0040487c
mov eax, 0x4cc084
mov edx, 0x4c634c
call fcn.004048d0
jmp 0x4c5d0d
mov eax, 0x4cc07c
mov edx, dword [ebp - 8]
call fcn.004048d0
mov eax, 0x4cc084
mov edx, dword [ebp - 0x10]
call fcn.004048d0
mov eax, dword [ebp - 0xc]
mov edx, 0x4c6358
call fcn.00404c88
je 0x4c5d35
mov eax, 0x4cc07c
call fcn.0040487c
mov eax, 0x4cc084
mov edx, 0x4c634c
call fcn.004048d0
mov eax, 0x4cc08c
mov edx, 0x4c6358
call fcn.004048d0
mov eax, dword [0x4cc084]
push eax
lea eax, [ebp - 0x30]
call fcn.004b8f0c
mov eax, dword [ebp - 0x30]
mov ecx, 0x4c6358
mov edx, dword [0x4cc07c]
call fcn.004bc000
call fcn.004bcd04
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.004bc504
mov eax, dword [ebp - 0x14]
mov dword [0x4cc094], eax
mov eax, dword [ebp - 0x18]
mov dword [0x4cc098], eax
cmp dword [ebp - 0x1c], 1
jl 0x4c5d98
cmp dword [ebp - 0x20], 1
jge 0x4c5dae
mov eax, dword [edi]
mov eax, dword [eax + 0x40]
mov dword [0x4cc09c], eax
mov eax, dword [edi]
mov eax, dword [eax + 0x44]
mov dword [0x4cc0a0], eax
jmp 0x4c5dbe
mov eax, dword [ebp - 0x1c]
mov dword [0x4cc09c], eax
mov eax, dword [ebp - 0x20]
mov dword [0x4cc0a0], eax
mov edx, dword [0x4cc09c]
mov eax, dword [edi]
call fcn.00447bf4
mov edx, dword [0x4cc0a0]
mov eax, dword [edi]
call fcn.00447c18
mov eax, dword [0x4cc0a0]
push eax
mov ecx, dword [0x4cc09c]
mov edx, dword [0x4cc098]
mov eax, dword [0x4cc094]
call fcn.004bc368
lea eax, [ebp - 0x24]
mov ecx, 0x4c6370
mov edx, dword [0x4cc2bc]
call fcn.00404b88
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x4c6384
mov edx, 0x4c6384
mov eax, dword [ebp - 0x24]
call fcn.004b8b08
lea eax, [ebp - 0x28]
call fcn.004ba398
mov ebx, eax
test bl, bl
jne 0x4c5e51
mov eax, dword [esi]
mov edx, dword [eax + 0x380]
mov eax, dword [esi]
call fcn.004b737c
mov eax, dword [edi]
mov eax, dword [eax + 0x408]
mov edx, 0x4c6394
call fcn.004484b4
jmp 0x4c5eec
mov eax, dword [edi]
mov eax, dword [eax + 0x408]
mov edx, dword [ebp - 0x28]
call fcn.004484b4
mov eax, dword [esi]
mov eax, dword [eax + 0x374]
mov edx, dword [ebp - 0x28]
call fcn.004484b4
mov eax, dword [ebp - 0x28]
mov edx, 0x4c63a4
call fcn.00404c88
jne 0x4c5e94
mov eax, dword [esi]
mov eax, dword [eax + 0x37c]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0xcc]
jmp 0x4c5eec
mov eax, dword [ebp - 0x28]
mov edx, 0x4c6394
call fcn.00404c88
jne 0x4c5eb7
mov eax, dword [esi]
mov eax, dword [eax + 0x380]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0xcc]
jmp 0x4c5eec
mov eax, dword [ebp - 0x28]
mov edx, 0x4c63b4
call fcn.00404c88
jne 0x4c5eda
mov eax, dword [esi]
mov eax, dword [eax + 0x384]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0xcc]
jmp 0x4c5eec
mov eax, dword [esi]
mov eax, dword [eax + 0x388]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0xcc]
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x4c63c4
mov edx, 0x4c6384
mov eax, dword [ebp - 0x24]
call fcn.004b8b08
lea eax, [ebp - 0x28]
call fcn.004ba398
mov ebx, eax
test bl, bl
jne 0x4c5f24
mov eax, dword [edi]
mov eax, dword [eax + 0x40c]
mov edx, 0x4c6394
call fcn.004484b4
jmp 0x4c5f34
mov eax, dword [edi]
mov eax, dword [eax + 0x40c]
mov edx, dword [ebp - 0x28]
call fcn.004484b4
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x4c63d4
mov edx, 0x4c6384
mov eax, dword [ebp - 0x24]
call fcn.004b8b08
lea eax, [ebp - 0x28]
call fcn.004ba398
mov ebx, eax
test bl, bl
jne 0x4c5fa0
mov eax, dword [esi]
mov eax, dword [eax + 0x378]
mov edx, 0x4c63e4
call fcn.004484b4
mov eax, dword [esi]
mov eax, dword [eax + 0x378]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [esi]
mov eax, dword [eax + 0x370]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [edi]
mov eax, dword [eax + 0x410]
mov edx, 0x4c63e4
call fcn.004484b4
jmp 0x4c608b
lea ecx, [ebp - 4]
mov edx, dword [ebp - 0x28]
mov eax, 0x4c63f0
call fcn.004b91b8
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.00409148
mov eax, dword [ebp - 0x34]
call fcn.00404b3c
dec eax
jge 0x4c6012
mov eax, dword [esi]
mov eax, dword [eax + 0x378]
mov dword [eax + 0xc], 1
mov edx, 0x4c63e4
call fcn.004484b4
mov eax, dword [esi]
mov eax, dword [eax + 0x378]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [esi]
mov eax, dword [eax + 0x370]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [edi]
mov eax, dword [eax + 0x410]
mov edx, 0x4c63e4
call fcn.004484b4
jmp 0x4c608b
mov eax, dword [esi]
mov eax, dword [eax + 0x378]
mov dword [eax + 0xc], 1
mov edx, dword [ebp - 4]
call fcn.004484b4
mov eax, dword [esi]
mov eax, dword [eax + 0x378]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [edi]
mov eax, dword [eax + 0x410]
mov edx, dword [ebp - 4]
call fcn.004484b4
lea ecx, [ebp - 4]
mov edx, dword [ebp - 0x28]
mov eax, 0x4c634c
call fcn.004b91b8
mov eax, dword [ebp - 4]
mov edx, 0x4c63fc
call fcn.00404c88
jne 0x4c6079
mov eax, dword [esi]
mov eax, dword [eax + 0x370]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0xcc]
jmp 0x4c608b
mov eax, dword [esi]
mov eax, dword [eax + 0x370]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xcc]
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x4c6408
mov edx, 0x4c6384
mov eax, dword [ebp - 0x24]
call fcn.004b8b08
lea eax, [ebp - 0x28]
call fcn.004ba398
mov ebx, eax
test bl, bl
jne 0x4c60fe
mov eax, dword [esi]
mov eax, dword [eax + 0x39c]
mov dword [eax + 0xc], 1
mov edx, 0x4c6418
call fcn.004484b4
mov eax, dword [esi]
mov eax, dword [eax + 0x39c]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [esi]
mov eax, dword [eax + 0x398]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [edi]
mov eax, dword [eax + 0x414]
mov edx, 0x4c642c
call fcn.004484b4
jmp 0x4c6217
lea ecx, [ebp - 4]
mov edx, dword [ebp - 0x28]
mov eax, 0x4c63f0
call fcn.004b91b8
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.00409148
mov eax, dword [ebp - 0x38]
call fcn.00404b3c
dec eax
jge 0x4c6173
mov eax, dword [esi]
mov eax, dword [eax + 0x39c]
mov dword [eax + 0xc], 1
mov edx, 0x4c6418
call fcn.004484b4
mov eax, dword [esi]
mov eax, dword [eax + 0x39c]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [esi]
mov eax, dword [eax + 0x398]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [edi]
mov eax, dword [eax + 0x414]
mov edx, 0x4c642c
call fcn.004484b4
jmp 0x4c6217
lea ecx, [ebp - 8]
mov edx, dword [ebp - 0x28]
mov eax, 0x4c6438
call fcn.004b91b8
mov eax, dword [ebp - 8]
mov edx, 0x4c63fc
call fcn.00404c88
jne 0x4c6196
mov bl, 1
jmp 0x4c6198
xor ebx, ebx
mov eax, dword [esi]
mov eax, dword [eax + 0x398]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0xcc]
cmp bl, 1
jne 0x4c61d5
mov eax, dword [esi]
mov eax, dword [eax + 0x39c]
mov dword [eax + 0xc], 1
mov edx, dword [ebp - 4]
call fcn.004484b4
mov eax, dword [esi]
mov eax, dword [eax + 0x39c]
xor edx, edx
mov dword [eax + 0xc], edx
jmp 0x4c61fb
mov eax, dword [esi]
mov eax, dword [eax + 0x39c]
mov dword [eax + 0xc], 1
mov edx, 0x4c6418
call fcn.004484b4
mov eax, dword [esi]
mov eax, dword [eax + 0x39c]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [0x4ca638]
mov eax, dword [eax]
call fcn.00467d54
mov eax, dword [edi]
mov eax, dword [eax + 0x414]
mov edx, dword [ebp - 4]
call fcn.004484b4
call fcn.004bc804
call fcn.004bf2ac
call fcn.004bcaac
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x4c6444
mov edx, 0x4c6384
mov eax, dword [ebp - 0x24]
call fcn.004b8b08
lea eax, [ebp - 0x28]
call fcn.004ba398
mov ebx, eax
test bl, bl
jne 0x4c625e
mov eax, dword [esi]
mov eax, dword [eax + 0x354]
mov edx, 0x4c6454
call fcn.004484b4
jmp 0x4c626e
mov eax, dword [esi]
mov eax, dword [eax + 0x354]
mov edx, dword [ebp - 0x28]
call fcn.004484b4
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x4c6460
mov edx, 0x4c6384
mov eax, dword [ebp - 0x24]
call fcn.004b8b08
lea eax, [ebp - 0x28]
call fcn.004ba398
mov ebx, eax
test bl, bl
jne 0x4c62a6
mov eax, dword [esi]
mov eax, dword [eax + 0x35c]
mov edx, 0x4c63e4
call fcn.004484b4
jmp 0x4c62b6
mov eax, dword [esi]
mov eax, dword [eax + 0x35c]
mov edx, dword [ebp - 0x28]
call fcn.004484b4
push 0x4c6470
push 0xa
mov ecx, dword [0x4cb668]
mov dl, 1
mov eax, dword [0x41c310]
call fcn.00421108
mov ebx, eax
mov edx, 0x4c6480
mov eax, ebx
call fcn.00420dd4
mov eax, ebx
call fcn.0040398c
lea eax, [ebp - 0x28]
mov edx, 0x4c6480
call fcn.00404914
mov eax, dword [0x4ca638]
mov eax, dword [eax]
call fcn.00467d54
push 0
mov eax, dword [ebp - 0x28]
call fcn.00404d3c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c633c
lea eax, [ebp - 0x38]
mov edx, 6
call fcn.004048a0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004048a0
ret