Function at 0x4c5b00
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5b17f8
mov eax, dword fs:[0]
push eax
sub esp, 0x354
mov eax, dword [0x6336a0]
xor eax, esp
mov dword [esp + 0x350], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x368]
mov dword fs:[0], eax
mov edi, ecx
push 0x5f9e38
lea ecx, [esp + 0x24]
call fcn.004023b0
mov dword [esp + 0x370], 0
call fcn.00555692
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4c5b70
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x28], ebp
mov byte [esp + 0x370], 1
mov eax, dword [0x63c454]
test eax, eax
je 0x4c5caf
mov eax, dword [eax + 0x20]
test eax, eax
je 0x4c5caf
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0x113e
push eax
mov dword [esp + 0x3c], 0x14
mov dword [esp + 0x40], edi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4c5caf
mov esi, dword [esp + 0x50]
test esi, esi
je 0x4c5caf
mov edx, dword [esi + 0x14]
add esi, 0x14
cmp dword [edx - 0xc], 0
je 0x4c5caf
push 4
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.00401a60
mov eax, dword [eax]
push 0x5d8378
push eax
call fcn.00577334
add esp, 8
test eax, eax
mov eax, dword [esp + 0x18]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c5c26
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x4c5c3d
push 0
push 0
push 0x5f9e10
call fcn.0055e834
jmp 0x4c5df7
mov eax, dword [esi]
push 0x2e
push eax
call fcn.005773c5
add esp, 8
test eax, eax
je 0x4c5caf
sub eax, dword [esi]
sar eax, 1
js 0x4c5caf
add eax, 1
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.00414630
push 0x5f3b14
push eax
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x37c], 2
call fcn.00401ba0
add esp, 0xc
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x374], 3
call fcn.00402330
lea ecx, [esp + 0x18]
call fcn.00401f20
lea ecx, [esp + 0x1c]
mov byte [esp + 0x370], 1
call fcn.00401f20
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push 0
push 0
push eax
mov ebx, 6
push ebx
push ebp
push 0
push 0
lea ecx, [esp + 0x70]
call fcn.00561f56
lea ecx, [esp + 0x54]
mov byte [esp + 0x370], 4
call fcn.00561e27
cmp eax, 1
jne 0x4c5de6
lea ecx, [esp + 0x54]
call fcn.005582b3
call fcn.005644f1
mov ecx, dword [eax + 4]
call fcn.0055ce7d
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x58]
mov byte [esp + 0x374], 5
call fcn.00562107
mov byte [esp + 0x370], bl
mov edx, dword [esp + 0x1c]
push edx
push edi
call fcn.004c5260
test eax, eax
je 0x4c5dad
call fcn.00555692
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4c5d46
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x370], 7
mov ecx, dword [esp + 0x1c]
push 0
push ecx
xor ecx, ecx
xor edi, edi
lea esi, [esp + 0x20]
call fcn.0044b470
mov esi, dword [esp + 0x20]
add esp, 8
push 5
push edi
push edi
push esi
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esi - 0x10]
mov byte [esp + 0x370], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4c5dad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x370], 5
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c5dd5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x27]
mov byte [esp + 0x370], 4
call fcn.0041cb90
lea ecx, [esp + 0x54]
mov byte [esp + 0x370], 1
call fcn.00561f15
lea eax, [ebp - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x370], 0
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c5e1b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x370], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c5e46
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x368]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x350]
xor ecx, esp
call fcn.00577139
add esp, 0x360
ret