Function at 0x48e656
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x330
mov eax, dword [0x52efc0]
mov edi, ecx
lea ebx, [esp + 0x120]
xor esi, esi
xor eax, ebp
mov dword [esp + 0x328], eax
push 0x104
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [esp + 0x114], esi
mov dword [esp + 0x110], esi
mov dword [esp + 0x118], esi
push ebx
call fcn.004cf81e
add esp, 4
cmp eax, 0x7ffffff0
jae 0x48ea34
mov ebx, eax
cmp eax, 5
mov dword [esp + 4], edi
jae 0x48e6d3
lea edx, [esp + 0x110]
test ebx, ebx
mov esi, edx
mov edi, edx
mov byte [edx + 0xb], bl
jne 0x48e702
jmp 0x48e71c
lea edi, [ebx + 8]
and edi, 0xfffffff8
js 0x48ea40
lea eax, [edi + edi]
push eax
call fcn.004aea96
add esp, 4
lea edx, [esp + 0x110]
or edi, 0x80000000
mov esi, eax
mov dword [edx], eax
mov dword [edx + 8], edi
mov dword [edx + 4], ebx
mov eax, ebx
add eax, ebx
push eax
lea eax, [esp + 0x124]
push eax
push esi
mov edi, edx
call fcn.004b76d0
mov edx, edi
add esp, 0xc
mov word [esi + ebx*2], 0
mov ecx, edx
movzx eax, byte [edi + 0xb]
test al, al
mov esi, eax
jns 0x48e73c
mov ecx, dword [esp + 0x110]
mov esi, dword [esp + 0x114]
test esi, esi
je 0x48e75a
mov dword [esp + 8], edx
lea edx, [ecx + esi*2 - 2]
add esi, esi
neg esi
cmp word [edx], 0x5c
je 0x48e789
add edx, 0xfffffffe
add esi, 2
jne 0x48e74c
xor ebx, ebx
test al, al
jns 0x48e76f
push dword [esp + 0x110]
call fcn.004aeac6
add esp, 4
mov ecx, dword [esp + 0x328]
xor ecx, ebp
call fcn.004aeb01
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
sub edx, ecx
xor ebx, ebx
cmp edx, 0xfffffffe
je 0x48e75c
sar edx, 1
lea ecx, [esp + 0x110]
inc edx
push ebx
push edx
call fcn.0042845a
lea eax, [esp + 0x80]
mov ecx, 8
lea esi, [esp + 0x8c]
add ecx, eax
mov dword [eax], 0x4f0b40
mov dword [eax + 8], 0x4e87c4
mov dword [esi + 0x34], vtable.std::__1::basic_istream_wchar_t__struct_std::__1::char_traits_wchar_t__.0
mov dword [esi - 8], ebx
mov dword [esp], ecx
lea ecx, [esp + 0xc0]
push esi
call fcn.00412e50
lea eax, [esp + 0xc0]
mov dword [esi + 0x7c], ebx
mov ecx, esi
mov word [eax + 0x4c], 0xffff
mov eax, dword [esi - 4]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x88], vtable.std::__1::basic_ostream_wchar_t__struct_std::__1::char_traits_wchar_t__.0
mov eax, dword [esi - 0xc]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x80], 0x4f0b4c
mov eax, dword [esi - 0xc]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x80], 0x4f0b48
call fcn.00411ab8
mov dword [esi], 0x4eeb50
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], 0x18
mov edx, 8
mov eax, dword [esi - 4]
mov eax, dword [eax + 4]
mov ecx, dword [esp + eax + 0x8c]
and ecx, 0xffffffb5
or ecx, edx
mov dword [esp + eax + 0x8c], ecx
mov eax, dword [esi - 4]
mov eax, dword [eax + 4]
or dword [esp + eax + 0x8c], 0x200
push 1
push 0x4e2c6c
push dword [esp + 8]
call fcn.0047f115
add esp, 0xc
movzx ecx, byte [edi + 0xb]
mov edx, dword [esp + 8]
mov dword [esp], edi
test cl, cl
jns 0x48e8a1
mov ecx, dword [esp + 0x114]
mov edx, dword [esp + 0x110]
push ecx
push edx
push eax
call fcn.0047f115
add esp, 0xc
push 0x10
push str.wow_helper.exe_
push eax
call fcn.0047f115
add esp, 0xc
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov ecx, eax
push dword [edx + 8]
call fcn.00412b50
push 0x4e8781
push eax
call fcn.0048eb13
add esp, 8
mov ecx, eax
push dword [ebp + 8]
call fcn.00412b50
lea edi, [esp + 0x3c]
mov ecx, esi
push edi
call fcn.0047f210
cmp byte [edi + 0xb], bl
jns 0x48e8f9
mov edi, dword [esp + 0x3c]
push edi
call fcn.004cb8b6
add esp, 4
cmp byte [esp + 0x47], bl
mov esi, eax
jns 0x48e916
push dword [esp + 0x3c]
call fcn.004aeac6
add esp, 4
xor ebx, ebx
lea eax, [esp + 0x3c]
lea edi, [esp + 0x20]
xorps xmm0, xmm0
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x20], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x28], ebx
mov dword [eax + 0x24], ebx
mov dword [eax + 0x30], ebx
mov dword [eax + 0x2c], ebx
mov dword [eax + 0x38], ebx
mov dword [eax + 0x34], ebx
mov dword [eax + 0x40], ebx
mov dword [eax + 0x3c], ebx
mov dword [eax], 0x44
movaps xmmword [edi], xmm0
push edi
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x48e9be
mov dword [esp + 4], esi
lea esi, [esp + 0x10]
mov ecx, esi
push edi
call fcn.00457d90
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
lea eax, [esp + 0xc]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor ebx, ebx
cmp edi, 0x102
je 0x48e9b1
test eax, eax
setne al
cmp dword [esp + 0xc], ebx
sete bl
and bl, al
lea ecx, [esp + 0x10]
call fcn.00457e30
mov esi, dword [esp + 4]
test esi, esi
je 0x48e9cb
push esi
call fcn.00459fc0
add esp, 4
lea esi, [esp + 0xc0]
lea edi, [esp + 0x8c]
mov eax, dword [esi - 0x40]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x80], 0x4f0b48
mov dword [edi], 0x4eeb50
cmp byte [edi + 0x2b], 0
jns 0x48ea05
push dword [esp + 0xac]
call fcn.004aeac6
add esp, 4
mov ecx, edi
call fcn.00411aa6
mov ecx, edi
call fcn.00410e70
lea ecx, [esp + 0x80]
add ecx, 8
call fcn.00410e70
mov ecx, esi
call fcn.0041189a
mov eax, dword [esp]
mov al, byte [eax + 0xb]
jmp 0x48e75c
lea ecx, [esp + 0x110]
call fcn.0042752c
call fcn.004c8e4e
int3