Function at 0x496290
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x128
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x118], rbp
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x108], rdi
mov qword [rsp + 0x100], r12
xor ebp, ebp
mov qword [rsp + 0xf8], r13
mov qword [rsp + 0xf0], r14
xor sil, sil
test ecx, ecx
mov qword [rsp + 0xe8], r15
mov r14, r9
mov edi, ecx
mov r12d, ebp
mov r15, rdx
je 0x496307
cmp ecx, 1
je 0x496307
jle 0x4963cc
cmp ecx, 3
jle 0x496307
cmp ecx, 4
jne 0x4963cc
mov sil, 1
cmp byte [r8], bpl
mov r13, r8
je 0x49632a
nop
inc r8
cmp byte [r8], bpl
jne 0x496310
cmp byte [r8 + 1], bpl
je 0x496325
mov byte [r8], 0x20
inc r8
cmp byte [r8], bpl
jne 0x496310
lea rcx, [rsp + 0x70]
mov r8d, 0x68
xor edx, edx
call fcn.00499630
mov ebx, dword [0x004e5d1c]
mov dword [rsp + 0x70], 0x68
test ebx, ebx
lea r9, [0x004e5d20]
je 0x496385
lea r8d, [rbx - 1]
nop
nop
movsxd rax, r8d
mov cl, al
mov rdx, rax
sar rdx, 5
and ecx, 0x1f
mov rax, qword [r9 + rdx*8]
imul rcx, rcx, 0x38
cmp byte [rax + rcx + 8], bpl
jne 0x496385
dec r8d
dec ebx
jne 0x496360
movzx eax, bx
mov edx, 1
shl ax, 3
lea ecx, [rax + rbx]
add cx, 4
mov word [rsp + 0xb2], cx
movzx ecx, cx
call fcn.00492d10
test rax, rax
mov qword [rsp + 0xb8], rax
jne 0x4963ea
call fcn.00489440
mov dword [rax], InitCommonControls
mov rax, 0xffffffffffffffff
jmp 0x49656c
call fcn.00489440
mov dword [rax], 0x16
call fcn.00489470
mov dword [rax], ebp
mov rax, 0xffffffffffffffff
jmp 0x49657c
test ebx, ebx
mov dword [rax], ebx
mov r8, qword [rsp + 0xb8]
movsxd r11, ebx
lea rcx, [r8 + 4]
lea rdx, [r11 + r8 + 4]
jle 0x49645e
mov r8, rbp
mov r10d, ebx
lea r11, [0x004e5d20]
mov r9b, r8b
mov rax, r8
and r9d, 0x1f
sar rax, 5
imul r9, r9, 0x38
add r9, qword [r11 + rax*8]
movzx eax, byte [r9 + 8]
test al, 0x10
jne 0x49643a
mov byte [rcx], al
mov rax, qword [r9]
mov qword [rdx], rax
jmp 0x496444
mov byte [rcx], bpl
mov qword [rdx], 0xffffffffffffffff
inc r8
inc rcx
add rdx, 8
dec r10
jne 0x496411
mov r8, qword [rsp + 0xb8]
movsxd r11, ebx
test sil, sil
je 0x49649c
mov edx, 3
lea rax, [r8 + 4]
lea rcx, [r11 + r8 + 4]
cmp ebx, edx
cmovl edx, ebx
test edx, edx
jle 0x496496
nop
nop
mov byte [rax], bpl
mov qword [rcx], 0xffffffffffffffff
add rcx, 8
inc rax
dec rdx
jne 0x496480
mov r12d, 8
call fcn.00489440
mov dword [rax], ebp
call fcn.00489470
xor r9d, r9d
mov dword [rax], ebp
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rdx, r13
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r14
mov rcx, r15
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xb8]
mov esi, eax
call fcn.00487200
test ebx, ebx
jne 0x496512
mov ecx, esi
call fcn.004894a0
mov rax, 0xffffffffffffffff
jmp 0x49656c
cmp edi, 2
jne 0x49651e
xor ecx, ecx
call fcn.0048aca0
test edi, edi
jne 0x496554
mov rcx, qword [rsp + 0x58]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
movsxd rbp, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x49655e
cmp edi, 4
je 0x496547
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
mov r13, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0x120]
mov r15, qword [rsp + 0xe8]
mov r14, qword [rsp + 0xf0]
mov r12, qword [rsp + 0x100]
mov rdi, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x110]
mov rbp, qword [rsp + 0x118]
add rsp, 0x128
ret