Function at 0x494e90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push eax
lea eax, [ebp - 8]
mov edi, ecx
push eax
mov ecx, esi
call fcn.0048c250
mov al, byte [0x6e207c]
cmp al, 1
jne 0x495613
mov ecx, edi
call fcn.0048f480
movzx eax, byte [esi + 0x971]
mov bl, 1
dec eax
mov byte [ebp + 0xb], bl
cmp eax, 0x32
ja case.0x494ede.8
movzx eax, byte [eax + 0x4956c0]
jmp dword [eax*4 + 0x49564c]
mov byte [edi + 0xbcf], 0x45
jmp case.0x494ede.2
mov byte [edi + 0xbcf], 0x47
jmp case.0x494ede.2
mov byte [edi + 0xbcf], 0x48
jmp case.0x494ede.2
mov byte [edi + 0xbcf], 0x49
jmp case.0x494ede.2
mov byte [edi + 0xbcf], 0x4a
jmp case.0x494ede.2
mov byte [edi + 0xbcf], 0x4b
jmp case.0x494ede.2
push 0xf
lea ebx, [edi + 0x301c8]
push 0
mov ecx, ebx
call fcn.0040c1b0
mov ecx, ebx
test al, al
je 0x494f56
push 0
push 0
push 0xf
push 0
call fcn.004131f0
jmp 0x495311
push 1
push 0
push 0xf
push 0
call fcn.004131f0
jmp 0x495311
push 0xf
lea ebx, [edi + 0x301c8]
push 1
mov ecx, ebx
call fcn.0040c1b0
mov ecx, ebx
test al, al
je 0x494f91
push 0
push 0
push 0xf
push 1
call fcn.004131f0
jmp 0x495311
push 1
push 0
push 0xf
push 1
call fcn.004131f0
jmp 0x495311
push 0xf
lea ebx, [edi + 0x301c8]
push 2
mov ecx, ebx
call fcn.0040c1b0
mov ecx, ebx
test al, al
je 0x494fcc
push 0
push 0
push 0xf
push 2
call fcn.004131f0
jmp 0x495311
push 1
push 0
push 0xf
push 2
call fcn.004131f0
jmp 0x495311
push 0xf
lea ebx, [edi + 0x301c8]
push 3
mov ecx, ebx
call fcn.0040c1b0
mov ecx, ebx
test al, al
je 0x495007
push 0
push 0
push 0xf
push 3
call fcn.004131f0
jmp 0x495311
push 1
push 0
push 0xf
push 3
call fcn.004131f0
jmp 0x495311
push 0xf
lea ebx, [edi + 0x301c8]
push 4
mov ecx, ebx
call fcn.0040c1b0
mov ecx, ebx
test al, al
je 0x495042
push 0
push 0
push 0xf
push 4
call fcn.004131f0
jmp 0x495311
push 1
push 0
push 0xf
push 4
call fcn.004131f0
jmp 0x495311
push 0xf
lea ebx, [edi + 0x301c8]
push 5
mov ecx, ebx
call fcn.0040c1b0
mov ecx, ebx
test al, al
je 0x49507d
push 0
push 0
push 0xf
push 5
call fcn.004131f0
jmp 0x495311
push 1
push 0
push 0xf
push 5
call fcn.004131f0
jmp 0x495311
push 0xf
lea ebx, [edi + 0x301c8]
push 6
mov ecx, ebx
call fcn.0040c1b0
mov ecx, ebx
test al, al
je 0x4950b8
push 0
push 0
push 0xf
push 6
call fcn.004131f0
jmp 0x495311
push 1
push 0
push 0xf
push 6
call fcn.004131f0
jmp 0x495311
push 0xf
lea ebx, [edi + 0x301c8]
push 7
mov ecx, ebx
call fcn.0040c1b0
mov ecx, ebx
test al, al
je 0x4950f3
push 0
push 0
push 0xf
push 7
call fcn.004131f0
jmp 0x495311
push 1
push 0
push 0xf
push 7
call fcn.004131f0
jmp 0x495311
push 0xf
lea ebx, [edi + 0x301c8]
push 8
mov ecx, ebx
call fcn.0040c1b0
mov ecx, ebx
test al, al
je 0x49512e
push 0
push 0
push 0xf
push 8
call fcn.004131f0
jmp 0x495311
push 1
push 0
push 0xf
push 8
call fcn.004131f0
jmp 0x495311
push 0xf
lea ebx, [edi + 0x301c8]
push 9
mov ecx, ebx
call fcn.0040c1b0
mov ecx, ebx
test al, al
je 0x495169
push 0
push 0
push 0xf
push 9
call fcn.004131f0
jmp 0x495311
push 1
push 0
push 0xf
push 9
call fcn.004131f0
jmp 0x495311
lea ebx, [edi + 0x301c8]
push 0x12
mov ecx, ebx
call fcn.0040c2e0
mov ecx, ebx
test al, al
je 0x495199
push 0
push 0x12
jmp 0x49530c
push 1
push 0x12
jmp 0x49530c
lea ebx, [edi + 0x301c8]
push 0x13
mov ecx, ebx
call fcn.0040c2e0
mov ecx, ebx
test al, al
je 0x4951c0
push 0
push 0x13
jmp 0x49530c
push 1
push 0x13
jmp 0x49530c
lea ebx, [edi + 0x301c8]
push 0x14
mov ecx, ebx
call fcn.0040c2e0
mov ecx, ebx
test al, al
je 0x4951e7
push 0
push 0x14
jmp 0x49530c
push 1
push 0x14
jmp 0x49530c
lea ebx, [edi + 0x301c8]
push 0x15
mov ecx, ebx
call fcn.0040c2e0
mov ecx, ebx
test al, al
je 0x49520e
push 0
push 0x15
jmp 0x49530c
push 1
push 0x15
jmp 0x49530c
lea ebx, [edi + 0x301c8]
push 0x16
mov ecx, ebx
call fcn.0040c2e0
mov ecx, ebx
test al, al
je 0x495235
push 0
push 0x16
jmp 0x49530c
push 1
push 0x16
jmp 0x49530c
lea ebx, [edi + 0x301c8]
push 0x17
mov ecx, ebx
call fcn.0040c2e0
mov ecx, ebx
test al, al
je 0x49525c
push 0
push 0x17
jmp 0x49530c
push 1
push 0x17
jmp 0x49530c
lea ebx, [edi + 0x301c8]
push 0x18
mov ecx, ebx
call fcn.0040c2e0
mov ecx, ebx
test al, al
je 0x495283
push 0
push 0x18
jmp 0x49530c
push 1
push 0x18
jmp 0x49530c
lea ebx, [edi + 0x301c8]
push 0x19
mov ecx, ebx
call fcn.0040c2e0
mov ecx, ebx
test al, al
je 0x4952a7
push 0
push 0x19
jmp 0x49530c
push 1
push 0x19
jmp 0x49530c
lea ebx, [edi + 0x301c8]
push 0x1a
mov ecx, ebx
call fcn.0040c2e0
mov ecx, ebx
test al, al
je 0x4952c8
push 0
push 0x1a
jmp 0x49530c
push 1
push 0x1a
jmp 0x49530c
lea ebx, [edi + 0x301c8]
push 0x1b
mov ecx, ebx
call fcn.0040c2e0
mov ecx, ebx
test al, al
je 0x4952e9
push 0
push 0x1b
jmp 0x49530c
push 1
push 0x1b
jmp 0x49530c
lea ebx, [edi + 0x301c8]
push 0x1c
mov ecx, ebx
call fcn.0040c2e0
mov ecx, ebx
test al, al
je 0x495308
push 0
jmp 0x49530a
push 1
push 0x1c
call fcn.004133f0
mov bl, byte [ebp + 0xb]
mov byte [0x6e207e], 0
mov byte [0x6e207d], 0
mov byte [0x6e207c], 0
movzx eax, byte [esi + 0x972]
dec eax
cmp eax, 0x59
ja case.0x495341.7
movzx eax, byte [eax + 0x49572c]
jmp dword [eax*4 + 0x4956f4]
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov byte [edi + 0xbcf], 0x44
jmp 0x4955ef
push 0x1f7
mov ecx, edi
call fcn.00470c40
cmp dword [0x6db9a4], 0x10
mov eax, 0x6db990
push 3
cmovae eax, dword [0x6db990]
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4955ef
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov al, byte [esi + 0x96c]
mov byte [ebp + 0xb], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 5
push eax
push dword [esi + 0xc44]
jmp 0x495563
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov al, byte [esi + 0x96c]
mov byte [ebp + 0xb], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 6
push eax
push dword [esi + 0xc48]
jmp 0x495563
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov al, byte [esi + 0x96c]
mov byte [ebp + 0xb], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 7
push eax
push dword [esi + 0xc4c]
jmp 0x495563
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov al, byte [esi + 0x96c]
mov byte [ebp + 0xb], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 8
push eax
push dword [esi + 0xc50]
jmp 0x495563
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov al, byte [esi + 0x96c]
mov byte [ebp + 0xb], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 9
push eax
push dword [esi + 0xc54]
jmp 0x495563
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov al, byte [esi + 0x96c]
mov byte [ebp + 0xb], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 0xa
push eax
push dword [esi + 0xc58]
jmp 0x495563
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov al, byte [esi + 0x96c]
mov byte [ebp + 0xb], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 0xb
push eax
push dword [esi + 0xc5c]
jmp 0x495563
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov al, byte [esi + 0x96c]
mov byte [ebp + 0xb], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 0xc
push eax
push dword [esi + 0xc60]
jmp 0x495563
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov al, byte [esi + 0x96c]
mov byte [ebp + 0xb], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 0xd
push eax
push dword [esi + 0xc64]
jmp 0x495563
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov al, byte [esi + 0x96c]
mov byte [ebp + 0xb], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 0xe
push eax
push dword [esi + 0xc68]
lea eax, [ebp - 4]
mov ecx, edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.0048ef90
xor edx, edx
movzx ecx, bl
test al, al
mov byte [0x6e207e], dl
mov byte [0x6e207d], dl
cmovne ecx, edx
mov byte [0x6e207c], dl
test cl, cl
jne case.0x495341.7
pop edi
pop esi
lea eax, [edx + 1]
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x1f7
mov ecx, edi
call fcn.00470c40
lea esi, [edi + 0x301c8]
push 0
mov ecx, esi
call fcn.004101c0
push 1
mov ecx, esi
call fcn.004101c0
push 2
mov ecx, esi
call fcn.004101c0
push 3
mov ecx, esi
call fcn.004101c0
push 4
mov ecx, esi
call fcn.004101c0
push 5
mov ecx, esi
call fcn.004101c0
push 6
mov ecx, esi
call fcn.004101c0
mov byte [0x6e207c], 0
mov byte [0x6e207d], 0
mov byte [0x6e207e], 0
push 0x47
call fcn.004b0f30
mov al, byte [0x6e207c]
add esp, 4
cmp al, 2
jne 0x49563c
cmp byte [0x6e207e], 0
jne 0x49563c
mov ecx, edi
call fcn.0048f480
mov byte [0x6e207c], 0
mov byte [0x6e207d], 0
mov byte [0x6e207e], 0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4