Function at 0x4cf0e7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x36c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x264], eax
push 0x104
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push ebx
mov dword [ebp - 0x250], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
push eax
lea esi, [ebp - 0x22c]
call fcn.0040beca
push 1
push 0x6403a4
mov edi, esi
call fcn.00414a1c
cmp eax, 0xffffffff
jne 0x4cf171
push 1
xor edi, edi
lea esi, [ebp - 0x22c]
call fcn.0040bad4
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret 8
lea ecx, [eax + 1]
lea eax, [ebp - 0x22c]
call fcn.00410ae7
lea eax, [ebp - 0x308]
push eax
lea edi, [ebp - 0x320]
mov dword [ebp - 0x320], 0x667630
mov dword [ebp - 0x310], 0x664404
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], 0x6675a4
call fcn.004cff91
mov eax, dword [ebp - 0x320]
mov eax, dword [eax + 4]
lea esi, [ebp - 0x308]
mov dword [ebp + eax - 0x320], 0x66762c
call fcn.004d002b
mov eax, dword [ebp - 0x24c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x310]
mov eax, dword [eax + 4]
push dword [ebp - 0x264]
lea eax, [ebp + eax - 0x310]
mov edx, dword [eax + 0x14]
push ecx
and edx, 0xfffff9ff
push ecx
or edx, 0x800
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x310]
mov eax, dword [eax + 4]
push ecx
lea eax, [ebp + eax - 0x310]
or dword [eax + 0x14], 8
push str.wow_helper.exe_
push ecx
lea eax, [ebp - 0x22c]
push eax
push ecx
push 0x665400
lea esi, [ebp - 0x310]
call fcn.004d1245
pop ecx
pop ecx
mov esi, eax
call fcn.004d1397
pop ecx
pop ecx
mov esi, eax
call fcn.004d1245
pop ecx
pop ecx
mov esi, eax
call fcn.004cf51b
mov esi, eax
call fcn.004d14ba
pop ecx
mov esi, eax
call fcn.004cf51b
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x308]
push eax
call fcn.004d00a5
cmp dword [ebp - 0x234], 8
mov eax, dword [ebp - 0x248]
jae 0x4cf288
lea eax, [ebp - 0x248]
push eax
call fcn.004427fb
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x248]
mov dword [ebp - 0x24c], eax
call fcn.0040bad4
push 0x40
lea eax, [ebp - 0x364]
push ebx
push eax
call fcn.00402394
xor eax, eax
lea edi, [ebp - 0x278]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
lea eax, [ebp - 0x260]
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x368]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x24c]
mov dword [ebp - 0x368], 0x44
push ebx
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x25c], ebx
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x254], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x268]
neg ebx
sbb bl, bl
call fcn.00442850
inc bl
je 0x4cf374
lea edi, [ebp - 0x260]
call fcn.004362d8
cmp dword [ebp - 0x24c], 0
je 0x4cf34d
push dword [ebp - 0x24c]
call fcn.00404e46
pop ecx
lea ecx, [ebp - 0x2c0]
call fcn.004cf852
lea eax, [ebp - 0x2c0]
push eax
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::ios_base.0
call fcn.005f42f1
pop ecx
jmp 0x4cf14f
push 0xffffffffffffffff
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
lea eax, [ebp - 0x250]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
setne al
cmp esi, 0x102
jne 0x4cf3fe
lea edi, [ebp - 0x260]
call fcn.004362d8
cmp dword [ebp - 0x24c], 0
je 0x4cf3c4
push dword [ebp - 0x24c]
call fcn.00404e46
pop ecx
xor bl, bl
lea ecx, [ebp - 0x2c0]
call fcn.004cf852
lea eax, [ebp - 0x2c0]
push eax
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::ios_base.0
call fcn.005f42f1
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x22c]
call fcn.0040bad4
mov al, bl
jmp 0x4cf160
test al, al
je 0x4cf40f
cmp dword [ebp - 0x250], 0
jne 0x4cf40f
mov bl, 1
jmp 0x4cf411
xor bl, bl
lea edi, [ebp - 0x260]
call fcn.004362d8
cmp dword [ebp - 0x24c], 0
je 0x4cf3c6
push dword [ebp - 0x24c]
call fcn.00404e46
pop ecx
jmp 0x4cf3c6