Function at 0x4a2eec
Capabilities:
Create process on windows
Delete directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x14
push 0
push 0
dec ecx
jne 0x4a2ef4
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404004
xor eax, eax
push ebp
push 0x4a3c62
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4a3c2a
lea eax, [ebp - 0x14]
push eax
mov cl, 0x24
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004a2b10
mov eax, dword [ebp - 0x14]
call fcn.00408c14
mov esi, eax
lea eax, [ebp - 8]
push eax
mov cl, 0x24
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004a2b8c
mov edi, dword [ebx + 0x5f8]
cmp esi, 0x63
jle 0x4a2f88
lea eax, [ebp - 0x18]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404058
mov eax, dword [ebp - 0x18]
call fcn.00408c14
mov esi, eax
mov eax, dword [ebp - 4]
cmp byte [eax + 2], 0x31
jne 0x4a2f88
mov edi, dword [ebx + 0x710]
mov eax, esi
cmp eax, 0x3d
ja case.0x4a2f93.0
jmp dword [eax*4 + 0x4a2f9a]
mov byte [ebx + 0x730], 1
mov edx, ebx
mov eax, ebx
call 0x4a18a8
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x638]
call fcn.004335ec
mov eax, ebx
call fcn.00498cb4
jmp 0x4a3c2a
mov edx, ebx
mov eax, ebx
call fcn.0049ca08
jmp 0x4a3c2a
mov edx, ebx
mov eax, ebx
call fcn.004a4018
jmp case.0x4a2f93.0
mov edx, ebx
mov eax, ebx
call fcn.004a70f4
jmp case.0x4a2f93.0
mov eax, ebx
call fcn.004a71d0
jmp case.0x4a2f93.0
xor eax, eax
mov al, byte [0x4bdbd9]
cmp eax, 0xc
ja case.0x4a2f93.0
jmp dword [eax*4 + 0x4a3109]
mov edx, 0x4a3c78
mov eax, ebx
call fcn.004a3f70
jmp case.0x4a2f93.0
mov edx, 0x4a3c98
mov eax, ebx
call fcn.004a3f70
jmp case.0x4a2f93.0
mov edx, 0x4a3cc0
mov eax, ebx
call fcn.004a3f70
jmp case.0x4a2f93.0
mov edx, 0x4a3ce0
mov eax, ebx
call fcn.004a3f70
jmp case.0x4a2f93.0
mov edx, 0x4a3d00
mov eax, ebx
call fcn.004a3f70
jmp case.0x4a2f93.0
mov edx, 0x4a3d20
mov eax, ebx
call fcn.004a3f70
jmp case.0x4a2f93.0
mov dl, 1
mov eax, ebx
call fcn.00498430
jmp case.0x4a2f93.0
cmp byte [0x4bdd7c], 0
jne 0x4a3c2a
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004aa2f0
jmp 0x4a3c2a
mov eax, dword [0x4bdbc4]
call fcn.0044e670
jmp case.0x4a2f93.0
mov edx, 0x4a3d38
mov eax, dword [ebx + 0x474]
call fcn.004335ec
jmp case.0x4a2f93.0
mov edx, 0x4a3d48
mov eax, dword [ebx + 0x474]
call fcn.004335ec
jmp case.0x4a2f93.0
mov edx, 0x4a3d58
mov eax, dword [ebx + 0x474]
call fcn.004335ec
jmp case.0x4a2f93.0
mov edx, ebx
mov eax, ebx
call fcn.004a57fc
jmp 0x4a3c2a
mov edx, dword [ebx + 0x5f8]
mov eax, ebx
call fcn.0044ce0c
mov edx, dword [ebp - 8]
mov eax, 0x4a3d68
call fcn.0040413c
test eax, eax
jle 0x4a329f
push 1
mov ecx, dword [ebp - 8]
mov edx, dword [ebx + 0x5f8]
mov eax, ebx
call fcn.004a2c24
mov eax, dword [ebx + 0x5f8]
call fcn.0046a36c
test eax, eax
jle 0x4a327e
or ecx, 0xffffffff
mov edx, 1
mov eax, ebx
call fcn.00495568
jmp 0x4a3c2a
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, 0x4a3d74
call fcn.00403e9c
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, ebx
call fcn.00497ff0
jmp case.0x4a2f93.0
mov eax, dword [ebx + 0x714]
mov eax, dword [eax + 0x20c]
call fcn.00468310
mov esi, eax
mov edx, dword [ebp - 8]
mov eax, 0x4a3d98
call fcn.0040413c
test eax, eax
jle 0x4a32f0
lea eax, [ebp - 0xc]
push eax
mov cl, 0x3a
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a2b8c
lea eax, [ebp - 0x20]
push eax
mov cl, 0x3a
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a2b10
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 8]
call fcn.00403c68
jmp 0x4a32f8
lea eax, [ebp - 0xc]
call fcn.00403bd0
lea ecx, [ebp - 0x24]
mov edx, dword [0x4bdbd0]
mov eax, ebx
call fcn.00497b08
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 8]
call fcn.00403e58
mov edx, dword [ebp - 0x24]
mov eax, esi
call fcn.00467de4
mov eax, dword [esi + 8]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x34]
cmp dword [ebp - 0xc], 0
jne 0x4a3355
lea ecx, [ebp - 0x28]
mov edx, dword [0x4bdbcc]
mov eax, ebx
call fcn.00497b08
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
call fcn.00403e58
mov edx, dword [ebp - 0x28]
mov eax, dword [esi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
jmp 0x4a337b
lea ecx, [ebp - 0x2c]
mov edx, dword [0x4bdbcc]
mov eax, ebx
call fcn.00497b08
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0xc]
call fcn.00403e58
mov edx, dword [ebp - 0x2c]
mov eax, dword [esi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov ecx, 1
xor edx, edx
mov eax, esi
call fcn.00467f88
or ecx, 0xffffffff
xor edx, edx
mov eax, ebx
call fcn.00495568
jmp 0x4a3c2a
mov edx, dword [ebx + 0x710]
mov eax, ebx
call fcn.0044ce0c
mov edx, dword [ebp - 8]
mov eax, 0x4a3d68
call fcn.0040413c
test eax, eax
jle 0x4a3415
push 1
mov ecx, dword [ebp - 8]
mov edx, dword [ebx + 0x710]
mov eax, ebx
call fcn.004a2c24
mov eax, dword [ebx + 0x710]
call fcn.0046a36c
test eax, eax
jle 0x4a33f4
cmp esi, 0x1c
sete al
push eax
or ecx, 0xffffffff
mov edx, 1
mov eax, ebx
call fcn.00495f04
jmp 0x4a3c2a
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 8]
mov edx, 0x4a3d74
call fcn.00403e9c
mov edx, dword [ebp - 0x30]
xor ecx, ecx
mov eax, ebx
call fcn.00497ff0
jmp case.0x4a2f93.0
mov eax, dword [ebx + 0x714]
mov eax, dword [eax + 0x20c]
call fcn.00468310
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov eax, 0x4a3d98
call fcn.0040413c
test eax, eax
jle 0x4a3467
lea eax, [ebp - 0xc]
push eax
mov cl, 0x3a
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a2b8c
lea eax, [ebp - 0x34]
push eax
mov cl, 0x3a
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a2b10
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 8]
call fcn.00403c68
jmp 0x4a346f
lea eax, [ebp - 0xc]
call fcn.00403bd0
lea ecx, [ebp - 0x38]
mov edx, dword [0x4bdbcc]
mov eax, ebx
call fcn.00497b08
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 8]
call fcn.00403e58
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
call fcn.00467de4
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x24]
mov eax, dword [ebx + 0x724]
call fcn.0047947c
push edx
push eax
call fcn.00491008
fstp xword [ebp - 0x50]
wait
lea eax, [ebp - 0x50]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 3
lea edx, [ebp - 0x44]
xor ecx, ecx
mov eax, 0x4a3da4
call fcn.00409adc
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
cmp dword [ebp - 0xc], 0
jne 0x4a350d
lea ecx, [ebp - 0x54]
mov edx, dword [0x4bdbd0]
mov eax, ebx
call fcn.00497b08
lea eax, [ebp - 0x54]
mov edx, dword [ebp - 8]
call fcn.00403e58
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
jmp 0x4a3536
lea ecx, [ebp - 0x58]
mov edx, dword [0x4bdbd0]
mov eax, ebx
call fcn.00497b08
lea eax, [ebp - 0x58]
mov edx, dword [ebp - 0xc]
call fcn.00403e58
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.00467f88
cmp esi, 0x1c
sete al
push eax
or ecx, 0xffffffff
xor edx, edx
mov eax, ebx
call fcn.00495f04
jmp 0x4a3c2a
mov edx, edi
mov eax, ebx
call fcn.0044ce0c
cmp edi, dword [ebx + 0x710]
jne 0x4a35ae
mov edx, dword [ebp - 8]
mov eax, 0x4a3d68
call fcn.0040413c
dec eax
jge 0x4a35ae
lea eax, [ebp - 0x5c]
mov ecx, dword [ebp - 8]
mov edx, 0x4a3db4
call fcn.00403e9c
mov edx, dword [ebp - 0x5c]
xor ecx, ecx
mov eax, ebx
call fcn.00497ff0
mov eax, dword [ebp - 8]
call fcn.00408f74
mov eax, ebx
call fcn.00496758
jmp case.0x4a2f93.0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, ebx
call fcn.004a2c24
cmp edi, dword [ebx + 0x5f8]
sete dl
mov eax, ebx
call fcn.0049d4fc
jmp 0x4a3c2a
lea eax, [ebp - 0xc]
push eax
mov cl, 0x3a
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a2b10
lea eax, [ebp - 0x60]
push eax
mov cl, 0x3a
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a2b8c
mov edx, dword [ebp - 0x60]
lea eax, [ebp - 8]
call fcn.00403c68
mov edx, edi
mov eax, ebx
call fcn.0044ce0c
mov eax, dword [ebx + 0x208]
cmp eax, dword [ebx + 0x710]
jne 0x4a362a
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00408f8c
mov eax, ebx
call fcn.00496758
jmp case.0x4a2f93.0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x724]
call fcn.004798ac
jmp 0x4a3c2a
lea eax, [ebp - 0xc]
push eax
mov cl, 0x3a
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a2b10
lea eax, [ebp - 0x64]
push eax
mov cl, 0x3a
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a2b8c
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 8]
call fcn.00403c68
mov edx, dword [ebx + 0x5f8]
mov eax, ebx
call fcn.0044ce0c
push 1
mov ecx, dword [ebp - 8]
mov edx, dword [ebx + 0x5f8]
mov eax, ebx
call fcn.004a2c24
mov eax, 0x4bdccc
mov edx, dword [ebp - 0xc]
call fcn.00403c24
mov eax, ebx
call fcn.004a72a4
jmp 0x4a3c2a
mov edx, edi
mov eax, ebx
call fcn.0044ce0c
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, ebx
call fcn.004a2c24
xor ecx, ecx
mov edx, edi
mov eax, ebx
call fcn.004a5344
jmp case.0x4a2f93.0
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x724]
call fcn.00479180
jmp 0x4a3c2a
cmp edi, dword [ebx + 0x710]
jne 0x4a370b
lea ecx, [ebp - 0x68]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00497b08
mov edx, dword [ebp - 0x68]
mov eax, 0x4bdbcc
call fcn.00403c24
mov eax, ebx
call fcn.00496758
jmp case.0x4a2f93.0
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x724]
call fcn.00479b04
jmp 0x4a3c2a
cmp edi, dword [ebx + 0x710]
jne 0x4a3740
lea ecx, [ebp - 0x6c]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00497b08
mov eax, dword [ebp - 0x6c]
call fcn.004750f4
jmp case.0x4a2f93.0
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x724]
call fcn.004799dc
jmp 0x4a3c2a
cmp edi, dword [ebx + 0x710]
jne 0x4a376e
mov eax, dword [ebp - 8]
call fcn.00404014
push eax
call sub.kernel32.dll_RemoveDirectoryA
jmp case.0x4a2f93.0
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x724]
call fcn.00479950
jmp 0x4a3c2a
cmp edi, dword [ebx + 0x710]
jne 0x4a3795
mov eax, ebx
call fcn.00496758
jmp 0x4a3c2a
cmp byte [0x4bdbd9], 4
je 0x4a37af
mov edx, 0x4a3dcc
mov eax, ebx
call fcn.004a3f70
jmp 0x4a3c2a
lea ecx, [ebp - 0x70]
mov eax, dword [ebx + 0x724]
mov edx, dword [eax + 0x510]
mov eax, ebx
call fcn.00497b08
mov edx, dword [ebp - 0x70]
mov eax, ebx
call fcn.0049b4dc
mov esi, eax
cmp esi, 0xffffffff
je 0x4a37df
mov edx, esi
mov eax, ebx
call fcn.0049b3c0
mov eax, ebx
call fcn.0049abbc
jmp 0x4a3c2a
cmp edi, dword [ebx + 0x710]
jne 0x4a3815
lea eax, [ebp - 0x74]
mov ecx, dword [0x4bdbcc]
mov edx, 0x4a3dfc
call fcn.00403e9c
mov edx, dword [ebp - 0x74]
mov eax, ebx
call fcn.004a3f70
jmp case.0x4a2f93.0
lea eax, [ebp - 0x78]
mov ecx, dword [0x4bdbd0]
mov edx, 0x4a3e14
call fcn.00403e9c
mov edx, dword [ebp - 0x78]
mov eax, ebx
call fcn.004a3f70
jmp case.0x4a2f93.0
cmp edi, dword [ebx + 0x710]
jne 0x4a3851
mov eax, 0x4bdd64
mov edx, dword [ebp - 8]
call fcn.00403c24
jmp case.0x4a2f93.0
mov eax, 0x4bdd68
mov edx, dword [ebp - 8]
call fcn.00403c24
jmp case.0x4a2f93.0
mov edx, dword [0x4bdbd0]
mov eax, ebx
call fcn.0049b4dc
mov edx, eax
mov eax, ebx
call fcn.0049b3c0
mov eax, ebx
call fcn.0049abbc
jmp case.0x4a2f93.0
mov eax, dword [ebx + 0x538]
call fcn.0048164c
test al, al
jne 0x4a38ab
mov ecx, dword [0x4bdc38]
mov edx, dword [0x4bdc34]
mov eax, dword [ebx + 0x538]
call fcn.00481b04
mov eax, dword [ebx + 0x538]
call fcn.0048164c
test al, al
je 0x4a38cc
mov dl, 1
mov eax, dword [ebx + 0x53c]
call fcn.00443c98
jmp case.0x4a2f93.0
xor edx, edx
mov eax, dword [ebx + 0x53c]
call fcn.00443c98
jmp case.0x4a2f93.0
mov eax, dword [ebx + 0x538]
call fcn.00481840
jmp case.0x4a2f93.0
mov eax, dword [ebx + 0x53c]
cmp byte [eax + 0x2c], 1
jne 0x4a3905
mov eax, dword [ebx + 0x538]
call fcn.00481840
lea eax, [ebp - 0x7c]
push eax
mov cl, 0x3a
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a2b10
mov edx, dword [ebp - 0x7c]
mov eax, 0x4bdc34
call fcn.00403c24
lea eax, [ebp - 0xc]
push eax
mov cl, 0x3a
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a2b8c
lea eax, [ebp - 0x80]
push eax
mov cl, 0x3a
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004a2b10
mov edx, dword [ebp - 0x80]
mov eax, 0x4bdc38
call fcn.00403c24
lea eax, [ebp - 0x84]
push eax
mov cl, 0x3a
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004a2b8c
mov edx, dword [ebp - 0x84]
mov eax, 0x4bdc3c
call fcn.00403c24
mov ecx, dword [0x4bdc38]
mov edx, dword [0x4bdc34]
mov eax, dword [ebx + 0x538]
call fcn.00481b04
mov eax, dword [ebx + 0x538]
call fcn.0048164c
test al, al
je 0x4a39aa
mov dl, 1
mov eax, dword [ebx + 0x53c]
call fcn.00443c98
jmp case.0x4a2f93.0
xor edx, edx
mov eax, dword [ebx + 0x53c]
call fcn.00443c98
jmp case.0x4a2f93.0
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a6394
jmp case.0x4a2f93.0
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a66bc
jmp case.0x4a2f93.0
mov eax, dword [ebx + 0x714]
mov eax, dword [eax + 0x20c]
call fcn.00468480
jmp case.0x4a2f93.0
mov dword [0x4bdd80], 1
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0048ff8c
dec eax
lea edx, [ebp - 0x88]
call fcn.00408b74
mov ecx, dword [ebp - 0x88]
xor edx, edx
mov eax, dword [0x4bdd88]
mov esi, dword [eax]
call dword [esi + 0x54]
jmp case.0x4a2f93.0
lea ecx, [ebp - 0x8c]
xor edx, edx
mov eax, dword [0x4bdd88]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x8c]
call fcn.00408c14
mov esi, eax
test esi, esi
jle 0x4a3a79
dec esi
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.00408b74
mov ecx, dword [ebp - 0x90]
xor edx, edx
mov eax, dword [0x4bdd88]
mov esi, dword [eax]
call dword [esi + 0x20]
mov dword [0x4bdd80], 1
jmp case.0x4a2f93.0
inc esi
jne 0x4a3a8b
mov dword [0x4bdd80], 1
jmp case.0x4a2f93.0
mov esi, dword [0x4bdd80]
dec esi
test esi, esi
jl 0x4a3aa6
inc esi
xor edx, edx
mov eax, dword [0x4bdd88]
mov ecx, dword [eax]
call dword [ecx + 0x44]
dec esi
jne 0x4a3a97
xor eax, eax
mov dword [0x4bdd80], eax
jmp case.0x4a2f93.0
mov eax, dword [ebx + 0x728]
mov eax, dword [eax + 0x1f0]
mov edx, 1
call fcn.00464334
push eax
push 0x4a3e2c
push dword [ebp - 8]
push 0x4a3e44
lea eax, [ebp - 0x94]
mov edx, 3
call fcn.00403f10
mov edx, dword [ebp - 0x94]
pop eax
call fcn.004642ac
mov eax, dword [ebp - 8]
call fcn.00408c14
imul edx, eax, 0x3e8
mov eax, dword [ebx + 0x5c0]
call fcn.004557c0
mov dl, 1
mov eax, dword [ebx + 0x5c0]
call fcn.004557b0
jmp 0x4a3c2a
mov edx, edi
mov eax, ebx
call fcn.0044ce0c
push 0
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, ebx
call fcn.004a2c24
test al, al
jne case.0x4a2f93.0
mov eax, dword [0x4bdd88]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle case.0x4a2f93.0
cmp dword [0x4bdd80], 0
jne 0x4a3ba0
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x9c]
xor edx, edx
mov eax, dword [0x4bdd88]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x9c]
mov ecx, 2
mov edx, 1
call fcn.00404058
mov eax, dword [ebp - 0x98]
call fcn.00408c14
mov esi, eax
xor edx, edx
mov eax, dword [0x4bdd88]
mov ecx, dword [eax]
call dword [ecx + 0x44]
jmp 0x4a3be5
inc dword [0x4bdd80]
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0xa4]
mov edx, dword [0x4bdd80]
mov eax, dword [0x4bdd88]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xa4]
mov ecx, 2
mov edx, 1
call fcn.00404058
mov eax, dword [ebp - 0xa0]
call fcn.00408c14
mov esi, eax
mov eax, dword [0x4bdd88]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je case.0x4a2f93.0
cmp esi, 0x36
jne 0x4a3b4e
jmp case.0x4a2f93.0
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a2d60
jmp 0x4a3c2a
push 1
mov eax, dword [ebp - 8]
call fcn.00404014
push eax
call sub.kernel32.dll_WinExec
cmp byte [0x4bdd7c], 0
je 0x4a3c2a
mov eax, ebx
call fcn.004a2ddc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3c69
lea eax, [ebp - 0xa4]
mov edx, 0x15
call fcn.00403bf4
lea eax, [ebp - 0x3c]
mov edx, 0xb
call fcn.00403bf4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403bf4
ret