Function at 0x4917b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push eax
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
call fcn.0048c250
mov dl, byte [0x6e207c]
cmp dl, 1
jne case.0x4919ba.7
mov ecx, esi
call fcn.0048f480
movzx eax, byte [edi + 0x971]
dec eax
cmp eax, 0x1e
ja case.0x4917fb.8
movzx eax, byte [eax + 0x491b68]
jmp dword [eax*4 + 0x491b3c]
mov byte [esi + 0xbcf], 0x45
xor dl, dl
mov byte [0x6e207c], dl
mov byte [0x6e207d], dl
mov byte [0x6e207e], dl
jmp 0x4919a2
xor dl, dl
mov byte [esi + 0xbcf], 0x46
mov byte [0x6e207c], dl
mov byte [0x6e207d], dl
mov byte [0x6e207e], dl
jmp 0x4919a2
xor dl, dl
mov byte [esi + 0xbcf], 0x47
mov byte [0x6e207c], dl
mov byte [0x6e207d], dl
mov byte [0x6e207e], dl
jmp 0x4919a2
xor dl, dl
mov byte [esi + 0xbcf], 0x48
mov byte [0x6e207c], dl
mov byte [0x6e207d], dl
mov byte [0x6e207e], dl
jmp 0x4919a2
xor dl, dl
mov byte [esi + 0xbcf], 0x49
mov byte [0x6e207c], dl
mov byte [0x6e207d], dl
mov byte [0x6e207e], dl
jmp 0x4919a2
xor dl, dl
mov byte [esi + 0xbcf], 0x4b
mov byte [0x6e207c], dl
mov byte [0x6e207d], dl
mov byte [0x6e207e], dl
jmp 0x4919a2
sub esp, 0x18
mov ecx, esp
push 0x552a40
call fcn.00406c50
lea ecx, [esi + 0x301c8]
call fcn.00413090
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x1a
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x18
push eax
movzx eax, byte [edi + 0x971]
mov ecx, esi
push 0
push dword [edi + eax*4 + 0xc18]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0048eeb0
xor dl, dl
mov byte [0x6e207c], dl
mov byte [0x6e207d], dl
mov byte [0x6e207e], dl
jmp 0x4919a2
lea eax, [ebp + 8]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
push 0x16
call fcn.0048c270
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x301c8]
cdq
and edx, 0xf
add eax, edx
sar eax, 4
push eax
call fcn.00413170
xor dl, dl
mov byte [0x6e207c], dl
mov byte [0x6e207d], dl
mov byte [0x6e207e], dl
jmp 0x4919a2
lea ecx, [esi + 0x301c8]
call fcn.0048e5f0
lea ecx, [esi + 0x301c8]
test al, al
je 0x49197f
push 0
jmp 0x491981
push 1
call fcn.00412d90
xor dl, dl
mov byte [0x6e207c], dl
mov byte [0x6e207d], dl
mov byte [0x6e207e], dl
jmp 0x4919a2
mov dl, byte [0x6e207c]
movzx eax, byte [edi + 0x972]
dec eax
cmp eax, 0x34
ja case.0x4919ba.7
movzx eax, byte [eax + 0x491ba4]
jmp dword [eax*4 + 0x491b88]
push 0x1f7
mov ecx, esi
call fcn.00470c40
mov byte [esi + 0xbcf], 0x44
jmp 0x491b16
push 0x1f7
mov ecx, esi
call fcn.00470c40
cmp dword [0x6db9a4], 0x10
mov eax, 0x6db990
push 3
cmovae eax, dword [0x6db990]
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x491b16
push 0x1f7
mov ecx, esi
call fcn.00470c40
add esi, 0x301c8
mov ecx, esi
call fcn.0040c160
cmp dword [eax + 0x10], 0
je 0x491b16
mov ecx, esi
call fcn.0040c160
push eax
mov ecx, esi
call fcn.00409220
sub esp, 0x18
mov ecx, esp
push 0x552a40
call fcn.00406c50
mov ecx, esi
call fcn.00413090
jmp 0x491b16
push 0x1f7
mov ecx, esi
call fcn.00470c40
add esi, 0x301c8
mov ecx, esi
call fcn.0040c190
cmp dword [eax + 0x10], 0
je 0x491b16
mov ecx, esi
call fcn.0040c190
push eax
mov ecx, esi
call fcn.0040ba90
jmp 0x491b16
push 0x1f7
mov ecx, esi
call fcn.00470c40
lea ecx, [esi + 0x301c8]
call fcn.0040b670
jmp 0x491b16
push 0x1f7
mov ecx, esi
call fcn.00470c40
add esi, 0x301c8
push 0
mov ecx, esi
call fcn.004101c0
push 1
mov ecx, esi
call fcn.004101c0
push 2
mov ecx, esi
call fcn.004101c0
push 3
mov ecx, esi
call fcn.004101c0
push 4
mov ecx, esi
call fcn.004101c0
push 5
mov ecx, esi
call fcn.004101c0
push 6
mov ecx, esi
call fcn.004101c0
jmp 0x491b16
cmp dl, 2
jne 0x491b2b
cmp byte [0x6e207e], 0
jne 0x491b2b
mov ecx, esi
call fcn.0048f480
mov byte [0x6e207c], 0
mov byte [0x6e207d], 0
mov byte [0x6e207e], 0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4