Function at 0x4053f0
Capabilities:
Create process on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x475b14
mov eax, dword fs:[0]
push eax
mov eax, 0x1ee0
call fcn.004489c0
mov eax, dword [0x4a7534]
xor eax, esp
mov dword [esp + 0x1ed8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a7534]
xor eax, esp
push eax
lea eax, [esp + 0x1ef4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1f04]
mov eax, dword [esp + 0x1f08]
xor edi, edi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0xc8], edi
mov dword [esp + 0xcc], edi
mov dword [esp + 0xd0], edi
mov dword [esp + 0xd4], edi
mov dword [esp + 0xd8], edi
mov dword [esp + 0xdc], 0xa
mov dword [esp + 0xe0], fcn.004462ab
mov dword [esp + 0xe4], fcn.004464a4
mov dword [esp + 0xe8], fcn.004461ce
push 0x48272c
mov ecx, 0x4ad808
mov dword [esp + 0x1f00], edi
call fcn.0040c450
test byte [0x4b1790], 1
jne 0x4054d4
or dword [0x4b1790], 1
push 0x4797d0
mov byte [0x4b177c], 0
call fcn.00446492
add esp, 4
mov esi, 0x4b1778
call fcn.004105c0
mov bl, byte [esp + 0x1f0c]
test bl, bl
je 0x40552c
mov edx, dword [0x4afdf4]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x4ae684
mov dword [esp + 0x28], edi
mov dword [esp + 0x38], edx
call fcn.00429310
test al, al
jne 0x405516
mov eax, dword [0x4afe00]
jmp 0x405528
mov edx, dword [esp + 0x1c]
mov eax, dword [0x4ae68c]
mov eax, dword [eax + edx*8 + 4]
call fcn.00428280
test al, 4
jne 0x4055a1
mov ecx, 0x4af6c0
cmp ecx, 0x4af800
je 0x40557a
mov edx, ecx
cmp edx, 0x4af24c
je 0x40557a
mov eax, ecx
cmp eax, 0x4af530
je 0x40557a
cmp ecx, 0x4aef2c
jne 0x405567
push 0x4af224
mov ecx, 0x4ae670
call fcn.004284c0
test al, al
je 0x4055a1
mov edi, 0x4af6c0
mov esi, 0x4ae670
call fcn.004296a0
test al, al
je 0x40559f
mov esi, dword [esp + 0x20]
push esi
mov ebx, ebp
call fcn.00404bc0
add esp, 4
test al, al
jne 0x405598
mov ecx, ebp
call fcn.0046bdf0
mov byte [esi + 8], 0
mov bl, byte [esp + 0x1f0c]
xor edi, edi
test bl, bl
je 0x4055ec
mov edx, dword [0x4afdf4]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x4ae684
mov dword [esp + 0x28], edi
mov dword [esp + 0x38], edx
call fcn.00429310
test al, al
jne 0x4055d2
mov eax, dword [0x4afe00]
jmp 0x4055e4
mov edx, dword [esp + 0x1c]
mov eax, dword [0x4ae68c]
mov eax, dword [eax + edx*8 + 4]
call fcn.00428280
test al, 8
jne 0x405e6a
mov ecx, 0x4afd3c
cmp ecx, 0x4af800
je 0x40563c
mov edx, ecx
cmp edx, 0x4af24c
je 0x40563c
mov eax, ecx
cmp eax, 0x4af530
je 0x40563c
cmp ecx, 0x4aef2c
jne 0x405627
push 0x4af224
mov ecx, 0x4ae670
call fcn.004284c0
test al, al
je 0x40564f
mov edi, 0x4afd3c
mov esi, 0x4ae670
call fcn.004296a0
xor edi, edi
test al, al
je 0x40564f
push 0x4af788
mov ecx, 0x4ae670
call fcn.004284c0
test al, al
jne 0x405657
test bl, bl
jne 0x405e6a
mov edx, dword [0x4a93bc]
push ebp
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], edx
call fcn.00413780
test al, al
jne 0x40567e
mov ecx, ebp
call fcn.0046cb50
mov ecx, ebp
call fcn.0046bdf0
mov esi, dword [0x4ac79c]
cmp esi, dword [0x4ad80c]
je 0x405698
mov edi, 0x4ad808
call fcn.0040bd10
xor edi, edi
test bl, bl
je 0x4056eb
push 0x4afd3c
mov ecx, 0x4ae670
call fcn.004284c0
test al, al
je 0x4056c2
push 0x4af788
mov ecx, 0x4ae670
call fcn.004284c0
test al, al
jne 0x4056eb
mov eax, dword [esp + 0x20]
cmp byte [eax + 8], 0
je 0x4056d7
push eax
call fcn.0040b050
jmp 0x405e6a
push 0x482748
mov ecx, 0x4ad808
call fcn.0040c450
jmp 0x405e6a
lea ecx, [esp + 0x138]
push ecx
call fcn.00403a50
mov ecx, ebp
lea edx, [esp + 0x138]
mov byte [esp + 0x1efc], 1
call fcn.0041bd70
test al, al
jne 0x405763
push 0x482c68
mov ecx, ebp
call fcn.0046be50
mov ecx, eax
call fcn.0046bec0
push 0x48260c
mov ecx, eax
call fcn.0046bec0
lea ecx, [esp + 0x138]
mov byte [esp + 0x1efc], 0
call fcn.00411810
lea ecx, [esp + 0xc8]
mov dword [esp + 0x1efc], 0xffffffff
call fcn.0041c610
xor al, al
jmp 0x405e83
lea edx, [esp + 0x138]
push edx
push ebp
call fcn.00404620
add esp, 8
test al, al
je 0x405712
push 0x4a93bc
lea eax, [esp + 0x5c]
push eax
push str.UserManager
call fcn.00402f60
add esp, 4
mov ecx, eax
call fcn.0043f540
push edi
push edi
push edi
push edi
push 0x482620
push eax
lea ecx, [esp + 0xa4]
mov byte [esp + 0x1f14], 2
call fcn.0046e160
lea ecx, [esp + 0x58]
mov byte [esp + 0x1efc], 4
call fcn.0046cf20
lea ecx, [esp + 0x8c]
call fcn.0046d1f0
test al, al
jne 0x40582d
push edi
push ebp
lea ecx, [esp + 0x94]
call fcn.0046e450
test al, al
jne 0x40582d
push 0x482628
mov ecx, ebp
call fcn.0046be50
mov ecx, eax
call fcn.0046bec0
push 0x482634
lea ecx, [esp + 0x90]
mov esi, eax
call fcn.0046cf00
push eax
mov ecx, esi
call fcn.0046bec0
mov ecx, eax
call fcn.0046bec0
lea ecx, [esp + 0x8c]
call fcn.0046cf20
jmp 0x405731
lea ecx, [esp + 0x68]
call fcn.00468b50
push 0x4825ec
push 0x482c68
lea ecx, [esp + 0x70]
call fcn.00468d90
mov ecx, eax
call fcn.00468d90
lea ecx, [esp + 0x68]
call fcn.00468640
push eax
mov ecx, 0x4ad930
call fcn.0040f5c0
mov esi, dword [0x4ac79c]
cmp esi, dword [0x4ad934]
je 0x40587c
mov edi, 0x4ad930
call fcn.0040bd10
lea ecx, [esp + 0x48]
mov byte [esp + 0x1b], 1
call fcn.00468b50
lea eax, [esp + 0x138]
mov byte [esp + 0x1efc], 6
call fcn.0041ba00
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x138]
test eax, eax
mov edi, eax
je 0x405df2
mov ecx, dword [edi]
add edi, 8
mov dword [esp + 0x78], ecx
mov ecx, edi
mov esi, 0x485ff8
call fcn.00468670
jmp 0x4058d0
mov cx, word [eax]
cmp cx, word [esi]
jne 0x4058f6
test cx, cx
je 0x4058f2
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x4058f6
add eax, 4
add esi, 4
test cx, cx
jne 0x4058d0
xor eax, eax
jmp 0x4058fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x405de6
mov ecx, edi
mov esi, str.14108
call fcn.00468670
nop
mov cx, word [eax]
cmp cx, word [esi]
jne 0x405936
test cx, cx
je 0x405932
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x405936
add eax, 4
add esi, 4
test cx, cx
jne 0x405910
xor eax, eax
jmp 0x40593b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x405de6
mov edx, dword [edi + 0x28]
cmp edx, dword [edi + 0x20]
jle 0x405de6
lea ecx, [esp + 0x58]
call fcn.00468b50
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx]
push 0x482768
push eax
push 0x482764
add edx, 1
push edx
lea ecx, [esp + 0x68]
call fcn.00468dc0
mov ecx, eax
call fcn.00468d90
mov ecx, eax
call fcn.00468dc0
mov ecx, eax
call fcn.00468d90
lea ecx, [esp + 0x58]
call fcn.00468640
mov esi, eax
mov eax, dword [0x4ad934]
push 0x79
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x4059b7
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [edi + 0x2c]
push ecx
lea ecx, [esp + 0xf0]
call fcn.00469110
mov edx, dword [edi + 0x28]
mov eax, dword [edi + 0x20]
push edx
push str.ev
push eax
push str._av
lea ecx, [esp + 0xfc]
call fcn.00468d90
mov ecx, eax
call fcn.00468dc0
mov ecx, eax
call fcn.00468d90
mov ecx, eax
call fcn.00468dc0
lea ebp, [edi + 0x10]
mov ecx, ebp
call fcn.0046cee0
push eax
lea ecx, [esp + 0x100]
call fcn.004690c0
push 0x482654
lea ecx, [esp + 0x100]
mov byte [esp + 0x1f00], 9
call fcn.00468d90
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x110]
call fcn.00468670
push eax
lea ecx, [esp + 0x50]
call fcn.0046d470
push ebx
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1f00], 0xa
call fcn.0046ece0
lea ecx, [esp + 0xec]
call fcn.00468640
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
push esi
lea ecx, [esp + 0x40]
call fcn.0041d9a0
add esp, 8
test al, al
jne 0x405ab9
push 0x482658
mov ecx, esi
call fcn.0046be50
mov ecx, eax
call fcn.0046bec0
push 0x482664
mov ecx, edi
mov esi, eax
call fcn.00468670
push eax
mov ecx, esi
call fcn.0046bec0
mov ecx, eax
call fcn.0046bec0
mov byte [esp + 0x1b], 0
jmp 0x405db0
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x1a8]
push edx
mov byte [esp + 0x16f0], 0
call fcn.00425c20
test al, al
jne 0x405b4b
push 0x482674
mov ecx, esi
call fcn.0046be50
mov ecx, eax
call fcn.0046bec0
push ebx
push ebx
push esi
lea ecx, [esp + 0x44]
call fcn.0046de60
test al, al
jne 0x405b0d
push 0x482690
mov ecx, esi
call fcn.0046be50
mov ecx, eax
call fcn.0046bec0
lea ecx, [esp + 0x38]
mov byte [esp + 0x1b], 0
call fcn.0046cf20
lea ecx, [esp + 0xfc]
call fcn.00468790
lea ecx, [esp + 0xec]
call fcn.00468790
lea ecx, [esp + 0x58]
mov byte [esp + 0x1efc], 6
call fcn.00468790
mov ebp, esi
jmp 0x405de6
push ebx
push ebp
push esi
lea ecx, [esp + 0x44]
call fcn.0046e900
test al, al
jne 0x405ba1
push 0x4826ac
mov ecx, esi
call fcn.0046be50
mov ecx, eax
call fcn.0046bec0
push 0x4826b4
mov ecx, ebp
mov esi, eax
call fcn.0046cf00
push eax
push 0x4826b0
lea ecx, [esp + 0x44]
call fcn.0046cf00
push eax
mov ecx, esi
call fcn.0046bec0
mov ecx, eax
call fcn.0046bec0
mov ecx, eax
jmp 0x405aa3
push ebx
push ebx
push esi
lea ecx, [esp + 0x44]
call fcn.0046de60
test al, al
jne 0x405be3
push 0x4826c4
mov ecx, esi
call fcn.0046be50
mov ecx, eax
call fcn.0046bec0
push 0x482634
lea ecx, [esp + 0x3c]
mov esi, eax
call fcn.0046cf00
push eax
mov ecx, esi
call fcn.0046bec0
mov ecx, eax
call fcn.0046bec0
mov esi, dword [esp + 0x28]
cmp dword [esi], 3
jge 0x405da7
mov eax, dword [edi + 0x20]
cdq
mov dword [esp + 0x10c], eax
mov eax, dword [edi + 0x28]
mov dword [esp + 0x110], edx
cdq
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], eax
lea eax, [esp + 0x10c]
push eax
lea ecx, [esp + 0x118]
push ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x11c], ebx
mov dword [esp + 0xa8], ebx
call fcn.004476bd
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0xac]
push eax
call fcn.004476bd
add esp, 0x10
push 0x482204
lea ecx, [esp + 0x2d8]
push ecx
lea ecx, [esp + 0x50]
call fcn.00468d90
mov ecx, eax
call fcn.00468d90
cmp dword [edi + 0x20], 0x64
jge 0x405ceb
push 0x482774
lea ecx, [esp + 0x4c]
call fcn.00468d90
jmp 0x405d3b
mov edx, dword [esp + 0x120]
mov eax, dword [esp + 0x124]
mov ecx, dword [esp + 0x128]
push edx
push 0x48277c
add eax, 1
push eax
add ecx, 0x76c
push 0x48277c
push ecx
lea ecx, [esp + 0x5c]
call fcn.00468dc0
mov ecx, eax
call fcn.00468d90
mov ecx, eax
call fcn.00468dc0
mov ecx, eax
call fcn.00468d90
mov ecx, eax
call fcn.00468dc0
push 0x482780
lea ecx, [esp + 0x4c]
call fcn.00468d90
mov edx, dword [esp + 0xac]
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0xb4]
push edx
push 0x48277c
add eax, 1
push eax
add ecx, 0x76c
push 0x48277c
push ecx
lea ecx, [esp + 0x5c]
call fcn.00468dc0
mov ecx, eax
call fcn.00468d90
mov ecx, eax
call fcn.00468dc0
mov ecx, eax
call fcn.00468d90
mov ecx, eax
call fcn.00468dc0
push 0x493634
lea ecx, [esp + 0x4c]
call fcn.00468d90
mov edx, dword [edi + 0x28]
mov dword [edi + 0x24], edx
add dword [esi], 1
lea ecx, [esp + 0x38]
call fcn.0046cf20
lea ecx, [esp + 0xfc]
call fcn.00468790
lea ecx, [esp + 0xec]
call fcn.00468790
lea ecx, [esp + 0x58]
mov byte [esp + 0x1efc], 6
call fcn.00468790
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x78]
test edi, edi
jne 0x4058b6
push 0x482788
mov ecx, 0x4ad808
call fcn.0040c450
mov esi, dword [0x4ac79c]
cmp esi, dword [0x4ad80c]
je 0x405e19
mov edi, 0x4ad808
call fcn.0040bd10
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
xor ebx, ebx
cmp eax, ebx
jne 0x405ebf
mov eax, dword [esp + 0x20]
cmp byte [eax + 8], bl
je 0x405eab
push eax
call fcn.0040b050
lea ecx, [esp + 0x48]
call fcn.00468790
lea ecx, [esp + 0x68]
call fcn.00468790
lea ecx, [esp + 0x8c]
call fcn.0046cf20
lea ecx, [esp + 0x138]
mov byte [esp + 0x1efc], 0
call fcn.00411810
lea ecx, [esp + 0xc8]
mov dword [esp + 0x1efc], 0xffffffff
call fcn.0041c610
mov al, 1
mov ecx, dword [esp + 0x1ef4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1ed8]
xor ecx, esp
call fcn.00445c6a
add esp, 0x1eec
ret
push 0x4827a0
mov ecx, 0x4ad808
call fcn.0040c450
jmp 0x405e38
cmp eax, 3
jle 0x405ed2
push 0x4827bc
lea ecx, [esp + 0x4c]
call fcn.00468d90
call fcn.00410290
mov edi, 0x482788
mov ecx, eax
call fcn.004104e0
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x4ac784
call esi
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x4ac784
call edi
push 0x7fe
lea ecx, [esp + 0x16f2]
push ebx
push ecx
mov word [esp + 0x16f8], bx
call fcn.00449450
add esp, 0xc
push str.UserManager
call fcn.00402f60
add esp, 4
add eax, 0x5d8
push eax
push 0x4826dc
lea edx, [esp + 0x16f4]
push 0x104
push edx
call fcn.00446193
push 0x40
lea eax, [esp + 0x174]
push ebx
push eax
call fcn.00449450
xor eax, eax
add esp, 0x1c
push 0x4ac76c
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x160], 0x44
call esi
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x160]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x170c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 0x7c]
push 0x1388
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x7c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x80]
push eax
call esi
push 0x4ac76c
call edi
mov eax, dword [esp + 0x20]
cmp byte [eax + 8], 0
je 0x405fed
push eax
call fcn.0040b050
jmp 0x406105
lea ecx, [esp + 0x68]
call fcn.00468b20
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx]
push 0x493634
push 0x4827d4
push edx
push 0x4827c4
lea ecx, [esp + 0x78]
call fcn.00468d90
mov ecx, eax
call fcn.00468dc0
mov ecx, eax
call fcn.00468d90
mov ecx, eax
call fcn.00468d90
lea ecx, [esp + 0x48]
call fcn.00468670
push eax
lea ecx, [esp + 0x6c]
call fcn.00468d90
mov esi, dword [0x4ad934]
mov edi, 0x4ad808
call fcn.0040bd10
lea ecx, [esp + 0x68]
call fcn.00468670
push eax
mov ecx, edi
call fcn.0040c450
lea ecx, [esp + 0x58]
call fcn.00468b50
push 0x4827dc
mov bl, 0xb
push 0x482c68
lea ecx, [esp + 0x60]
mov byte [esp + 0x1f04], bl
call fcn.00468d90
mov ecx, eax
call fcn.00468d90
push 1
lea eax, [esp + 0xa4]
push eax
call fcn.0042bc10
mov dword [esp + 0xa0], vtable.t_bbWebHalf.0
lea ecx, [esp + 0x68]
mov byte [esp + 0x1efc], 0xc
call fcn.00468640
push eax
lea ecx, [esp + 0xa4]
push ecx
call fcn.00424ea0
push 0
lea edx, [esp + 0xa4]
push edx
call fcn.004252b0
push 5
lea eax, [esp + 0xa4]
push eax
call fcn.004254c0
lea ecx, [esp + 0xa0]
mov byte [esp + 0x1efc], bl
call fcn.00425730
lea ecx, [esp + 0x58]
mov byte [esp + 0x1efc], 6
call fcn.00468790
cmp byte [esp + 0x1b], 0
jne 0x405e38
push 0x48270c
mov ecx, ebp
call fcn.0046be50
mov ecx, eax
call fcn.0046bec0
lea ecx, [esp + 0x48]
call fcn.00468790
lea ecx, [esp + 0x68]
call fcn.00468790
lea ecx, [esp + 0x8c]
call fcn.0046cf20
jmp 0x405731