Function at 0x494fc4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x495281
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x254]
call fcn.0045c16c
test eax, eax
jle 0x495266
mov eax, dword [ebx + 0x2fc]
call fcn.0045dd0c
call fcn.0045b9c4
mov esi, dword [ebx + 0x237a4]
mov edx, esi
dec edx
cmp eax, edx
jle 0x4950f9
cmp dword [ebx + 0x237a0], 0xb
jne 0x4950f9
push 0
push 0x495298
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00408ccc
push dword [ebp - 0xc]
push 0x4952b4
push 0x4952c4
push 0x4952d0
lea eax, [ebp - 8]
mov edx, 5
call fcn.00403e40
mov eax, dword [ebp - 8]
call fcn.00403f44
mov edx, eax
mov ecx, 0x4952fc
mov eax, dword [0x4a8b24]
mov eax, dword [eax]
call fcn.0044f194
push 9
lea edx, [ebp - 0x14]
mov eax, dword [0x4a8b24]
mov eax, dword [eax]
call fcn.0044f504
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004090a0
mov eax, dword [ebp - 0x10]
call fcn.00403f44
push eax
mov eax, dword [0x4a9a0c]
mov edx, dword [eax + 0x23780]
lea eax, [ebp - 0x18]
mov ecx, 0x49530c
call fcn.00403dcc
mov eax, dword [ebp - 0x18]
call fcn.00403f44
push eax
lea edx, [ebp - 0x20]
mov eax, dword [0x4a8b24]
mov eax, dword [eax]
call fcn.0044f504
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.004090d4
mov eax, dword [ebp - 0x1c]
call fcn.00403f44
push eax
push 0x495328
mov eax, dword [0x4a8b24]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x495266
push 1
mov ecx, 0x4952fc
mov edx, 0x495330
mov eax, dword [0x4a8b24]
mov eax, dword [eax]
call fcn.0044f194
dec eax
jne 0x495266
mov eax, dword [ebx + 0x2fc]
call fcn.0045dd0c
call fcn.0045b9c4
mov esi, eax
mov eax, ebx
call fcn.0049bd98
mov dword [ebp - 4], eax
xor edi, edi
mov eax, dword [ebx + 0x2fc]
call fcn.0045dd0c
call fcn.0045b87c
test eax, eax
je 0x49515c
mov eax, dword [ebx + 0x2fc]
call fcn.0045dd0c
call fcn.0045b87c
mov edi, eax
mov eax, dword [ebx + 0x2fc]
call fcn.0045dd0c
call fcn.0045be9c
test edi, edi
je 0x495187
mov eax, edi
call fcn.0045b7c8
test al, al
jne 0x495187
mov edx, 2
mov eax, edi
call fcn.0045b40c
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x254]
call fcn.0045c16c
dec eax
sub eax, esi
jl 0x4951c4
inc eax
mov edx, dword [ebp - 4]
add edx, esi
lea edx, [edx + edx*4]
lea ecx, [esi + esi*4]
push esi
lea esi, [ebx + edx*4 + 0xacf4]
lea edi, [ebx + ecx*4 + 0xace0]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
pop esi
inc esi
dec eax
jne 0x49519e
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x254]
call fcn.0045c16c
test eax, eax
jle 0x495242
mov esi, dword [ebx + 0xab2c]
mov eax, dword [ebx + 0x2fc]
call fcn.0045dd0c
call fcn.0045b9c4
mov edi, eax
mov dword [ebx + 0xab2c], edi
mov eax, esi
sub eax, edi
dec eax
jle 0x495205
dec esi
mov dword [ebx + 0xab2c], esi
mov esi, dword [ebx + 0x2fc]
mov eax, dword [esi + 0x254]
mov edx, dword [ebx + 0xab2c]
call fcn.0045c5d4
mov edx, eax
mov eax, esi
call fcn.0045dd54
mov edx, dword [ebx + 0xab2c]
mov eax, ebx
call fcn.00492c08
xor eax, eax
mov dword [ebx + 0xa21c], eax
xor eax, eax
mov dword [ebx + 0xa218], eax
cmp dword [ebx + 0x23788], 1
jne 0x495255
mov dword [ebx + 0x23788], 2
cmp dword [ebx + 0x23788], 3
jne 0x495266
xor eax, eax
mov dword [ebx + 0x23788], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495288
lea eax, [ebp - 0x20]
mov edx, 7
call fcn.00403b24
ret