Function at 0x490018
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x330
mov edi, ecx
mov eax, dword [0x530f98]
xor eax, ebp
mov dword [esp + 0x328], eax
lea ebx, [esp + 0x120]
xor esi, esi
push 0x104
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [esp + 0x114], esi
mov dword [esp + 0x110], esi
mov dword [esp + 0x118], esi
push ebx
call fcn.004d03ae
add esp, 4
cmp eax, 0x7ffffff0
jae 0x4903e0
mov ebx, eax
cmp eax, 5
mov dword [esp], edi
jae 0x490094
lea edx, [esp + 0x110]
mov byte [edx + 0xb], bl
mov edi, edx
mov esi, edx
test ebx, ebx
jne 0x4900c3
jmp 0x4900dd
lea esi, [ebx + 8]
and esi, 0xfffffff8
js 0x4903ec
lea eax, [esi + esi]
push eax
call fcn.004af396
add esp, 4
mov edi, eax
lea edx, [esp + 0x110]
mov dword [edx], eax
or esi, 0x80000000
mov dword [edx + 8], esi
mov dword [edx + 4], ebx
mov eax, ebx
add eax, ebx
push eax
lea eax, [esp + 0x124]
push eax
push edi
mov esi, edx
call fcn.004b80c0
mov edx, esi
add esp, 0xc
mov word [edi + ebx*2], 0
movzx eax, byte [esi + 0xb]
mov ecx, edx
mov edi, eax
test al, al
jns 0x4900fd
mov ecx, dword [esp + 0x110]
mov edi, dword [esp + 0x114]
test edi, edi
je 0x49011d
mov dword [esp + 8], edx
lea edx, [ecx + edi*2]
add edx, 0xfffffffe
add edi, edi
neg edi
cmp word [edx], 0x5c
je 0x49014c
add edx, 0xfffffffe
add edi, 2
jne 0x49010f
xor ebx, ebx
test al, al
jns 0x490132
push dword [esp + 0x110]
call fcn.004af3c6
add esp, 4
mov ecx, dword [esp + 0x328]
xor ecx, ebp
call fcn.004af401
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
sub edx, ecx
xor ebx, ebx
cmp edx, 0xfffffffe
je 0x49011f
sar edx, 1
inc edx
lea ecx, [esp + 0x110]
push ebx
push edx
call fcn.00429a4e
lea eax, [esp + 0x88]
mov dword [eax - 8], 0x4f28e4
mov dword [eax], 0x4e44b4
lea ecx, [esp + 0xc0]
lea edi, [esp + 0x8c]
mov dword [edi + 0x34], vtable.std::__1::basic_istream_wchar_t__struct_std::__1::char_traits_wchar_t__.0
mov dword [edi - 8], ebx
push edi
call fcn.00414710
mov dword [edi + 0x7c], ebx
lea eax, [esp + 0xc0]
mov word [eax + 0x4c], 0xffff
mov eax, dword [edi - 4]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x88], vtable.std::__1::basic_ostream_wchar_t__struct_std::__1::char_traits_wchar_t__.0
mov eax, dword [edi - 0xc]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x80], 0x4f28f0
mov eax, dword [edi - 0xc]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x80], 0x4f28ec
mov ecx, edi
call fcn.0041335a
mov dword [edi], 0x4ecf90
xorps xmm0, xmm0
movups xmmword [edi + 0x20], xmm0
mov dword [edi + 0x30], 0x18
mov eax, dword [edi - 4]
mov eax, dword [eax + 4]
mov ecx, dword [esp + eax + 0x8c]
and ecx, 0xffffffb5
or ecx, 8
mov dword [esp + eax + 0x8c], ecx
mov eax, dword [edi - 4]
mov eax, dword [eax + 4]
or dword [esp + eax + 0x8c], 0x200
push 1
push 0x4e3d0a
lea eax, [esp + 0x90]
push eax
call fcn.0047cd05
add esp, 0xc
mov dword [esp + 4], esi
movzx ecx, byte [esi + 0xb]
test cl, cl
mov edx, dword [esp + 8]
jns 0x490256
mov ecx, dword [esp + 0x114]
mov edx, dword [esp + 0x110]
push ecx
push edx
push eax
call fcn.0047cd05
add esp, 0xc
push 0x10
push 0x4f57a0
push eax
call fcn.0047cd05
add esp, 0xc
mov ecx, dword [esp]
mov edx, dword [ecx]
mov ecx, eax
push dword [edx + 8]
call fcn.00414400
push 0x4e4583
push eax
call fcn.004904bf
add esp, 8
mov ecx, eax
push dword [ebp + 8]
call fcn.00414400
lea esi, [esp + 0x3c]
mov ecx, edi
push esi
call fcn.0047cdfe
cmp byte [esi + 0xb], 0
jns 0x4902ae
mov esi, dword [esp + 0x3c]
push esi
call fcn.004cc59d
add esp, 4
mov edi, eax
cmp byte [esp + 0x47], 0
jns 0x4902cc
push dword [esp + 0x3c]
call fcn.004af3c6
add esp, 4
xorps xmm0, xmm0
lea eax, [esp + 0x3c]
movups xmmword [eax + 0x34], xmm0
movups xmmword [eax + 0x24], xmm0
movups xmmword [eax + 0x14], xmm0
movups xmmword [eax + 4], xmm0
mov dword [eax], 0x44
lea esi, [esp + 0x20]
movaps xmmword [esi], xmm0
sub esp, 0x28
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], eax
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x49036a
mov dword [esp], edi
lea edi, [esp + 0x10]
mov ecx, edi
push esi
call fcn.00458530
push 0xffffffffffffffff
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
lea eax, [esp + 0xc]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp ebx, 0x102
jne 0x49034f
xor ebx, ebx
jmp 0x49035e
test eax, eax
setne al
cmp dword [esp + 0xc], 0
sete bl
and bl, al
lea ecx, [esp + 0x10]
call fcn.00458690
mov edi, dword [esp]
test edi, edi
je 0x490377
push edi
call fcn.00443fc0
add esp, 4
lea edi, [esp + 0x80]
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x80], 0x4f28ec
lea esi, [esp + 0x8c]
mov dword [esi], 0x4ecf90
cmp byte [esi + 0x2b], 0
jns 0x4903b0
push dword [esp + 0xac]
call fcn.004af3c6
add esp, 4
mov ecx, esi
call fcn.00413348
mov ecx, esi
call fcn.00410600
add edi, 8
mov ecx, edi
call fcn.00410600
lea ecx, [esp + 0xc0]
call fcn.0041315a
mov eax, dword [esp + 4]
mov al, byte [eax + 0xb]
jmp 0x49011f
lea ecx, [esp + 0x110]
call fcn.00428aec
call fcn.004c9a66
int3