Function at 0x496b90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x496e4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x254]
call fcn.0045bb84
test eax, eax
jle 0x496e32
mov eax, dword [ebx + 0x2fc]
call fcn.0045d630
call fcn.0045b3dc
mov esi, dword [ebx + 0x23814]
mov edx, esi
dec edx
cmp eax, edx
jle 0x496cc5
cmp dword [ebx + 0x23810], 0xb
jne 0x496cc5
push 0
push 0x496e64
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00408ca4
push dword [ebp - 0xc]
push 0x496e80
push 0x496e90
push 0x496e9c
lea eax, [ebp - 8]
mov edx, 5
call fcn.00403e30
mov eax, dword [ebp - 8]
call fcn.00403f34
mov edx, eax
mov ecx, 0x496ec8
mov eax, dword [0x4acb28]
mov eax, dword [eax]
call fcn.0044eb9c
push 9
lea edx, [ebp - 0x14]
mov eax, dword [0x4acb28]
mov eax, dword [eax]
call fcn.0044ef0c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00408ff8
mov eax, dword [ebp - 0x10]
call fcn.00403f34
push eax
mov eax, dword [0x4ada04]
mov edx, dword [eax + 0x237e8]
lea eax, [ebp - 0x18]
mov ecx, 0x496ed8
call fcn.00403dbc
mov eax, dword [ebp - 0x18]
call fcn.00403f34
push eax
lea edx, [ebp - 0x20]
mov eax, dword [0x4acb28]
mov eax, dword [eax]
call fcn.0044ef0c
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0040902c
mov eax, dword [ebp - 0x1c]
call fcn.00403f34
push eax
push 0x496ef4
mov eax, dword [0x4acb28]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x496e32
push 1
mov ecx, 0x496ec8
mov edx, 0x496efc
mov eax, dword [0x4acb28]
mov eax, dword [eax]
call fcn.0044eb9c
dec eax
jne 0x496e32
mov eax, dword [ebx + 0x2fc]
call fcn.0045d630
call fcn.0045b3dc
mov esi, eax
mov eax, ebx
call fcn.0049da38
mov dword [ebp - 4], eax
xor edi, edi
mov eax, dword [ebx + 0x2fc]
call fcn.0045d630
call fcn.0045b294
test eax, eax
je 0x496d28
mov eax, dword [ebx + 0x2fc]
call fcn.0045d630
call fcn.0045b294
mov edi, eax
mov eax, dword [ebx + 0x2fc]
call fcn.0045d630
call fcn.0045b8b4
test edi, edi
je 0x496d53
mov eax, edi
call fcn.0045b1e0
test al, al
jne 0x496d53
mov edx, 2
mov eax, edi
call fcn.0045ae24
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x254]
call fcn.0045bb84
dec eax
sub eax, esi
jl 0x496d90
inc eax
mov edx, dword [ebp - 4]
add edx, esi
lea edx, [edx + edx*4]
lea ecx, [esi + esi*4]
push esi
lea esi, [ebx + edx*4 + 0xad5c]
lea edi, [ebx + ecx*4 + 0xad48]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
pop esi
inc esi
dec eax
jne 0x496d6a
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x254]
call fcn.0045bb84
test eax, eax
jle 0x496e0e
mov esi, dword [ebx + 0xab94]
mov eax, dword [ebx + 0x2fc]
call fcn.0045d630
call fcn.0045b3dc
mov edi, eax
mov dword [ebx + 0xab94], edi
mov eax, esi
sub eax, edi
dec eax
jle 0x496dd1
dec esi
mov dword [ebx + 0xab94], esi
mov esi, dword [ebx + 0x2fc]
mov eax, dword [esi + 0x254]
mov edx, dword [ebx + 0xab94]
call fcn.0045bfec
mov edx, eax
mov eax, esi
call fcn.0045d678
mov edx, dword [ebx + 0xab94]
mov eax, ebx
call fcn.00493cd4
xor eax, eax
mov dword [ebx + 0xa268], eax
xor eax, eax
mov dword [ebx + 0xa264], eax
cmp dword [ebx + 0x237f0], 1
jne 0x496e21
mov dword [ebx + 0x237f0], 2
cmp dword [ebx + 0x237f0], 3
jne 0x496e32
xor eax, eax
mov dword [ebx + 0x237f0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496e54
lea eax, [ebp - 0x20]
mov edx, 7
call fcn.00403b14
ret