Function at 0x1004aec
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xc4
mov eax, dword [ebp + 0x7c]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x1004b17
mov cl, byte [eax]
cmp cl, 0x20
je 0x1004b0d
cmp cl, 9
jne 0x1004b10
inc eax
jmp 0x1004b01
cmp byte [eax], bl
mov dword [ebp + 0x7c], eax
jne 0x1004b27
push 0x1001a80
call fcn.01003aec
pop ecx
jmp 0x1004e57
cmp dword [0x1008280], ebx
je 0x1004b5a
push 0x1001a48
call fcn.01003aec
mov dword [esp], 0x1001a14
call fcn.01003aec
mov dword [esp], 0x10019e0
call fcn.01003aec
mov dword [esp], 0x10019ac
jmp 0x1004b1c
cmp dword [0x10092d0], ebx
je 0x1004b69
push 0x100198c
jmp 0x1004b1c
cmp dword [0x1009384], ebx
je 0x1004b78
push 0x1001940
jmp 0x1004b1c
push esi
push edi
push eax
push 0x1001918
call fcn.01003aec
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
pop ecx
pop ecx
push 2
push 1
push ebx
lea eax, [ebp + 0x70]
push eax
call esi
push eax
call esi
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call edi
test eax, eax
jne 0x1004bbb
push 0x10018e8
call fcn.01003aec
pop ecx
jmp 0x1004e55
mov eax, dword [0x1009298]
mov dword [ebp + 0x58], eax
mov eax, dword [0x1009294]
push 0xfffffffffffffff4
mov dword [ebp + 0x54], eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0x40000000
push ebx
mov dword [ebp + 0x50], eax
push ebx
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x6c]
push eax
mov dword [ebp + 0x44], 0xc
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], 1
call fcn.01004a10
test eax, eax
jne 0x1004c1c
push 0x10018c0
call fcn.01003aec
pop ecx
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1004e55
push 3
push ebx
push ebx
lea eax, [ebp + 0x6c]
push eax
call esi
push eax
push dword [ebp + 0x6c]
call esi
push eax
call edi
test eax, eax
jne 0x1004c53
push 0x1001890
call fcn.01003aec
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
push dword [ebp + 0x70]
call esi
push dword [ebp + 0x68]
call esi
jmp 0x1004e55
push ebx
push 0x40000000
push ebx
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.01004a10
test eax, eax
jne 0x1004c8f
push 0x1001868
call fcn.01003aec
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
push dword [ebp + 0x70]
call esi
push dword [ebp + 0x68]
call esi
push dword [ebp + 0x6c]
jmp 0x1004c4c
push 3
push ebx
push ebx
lea eax, [ebp + 0x64]
push eax
call esi
push eax
push dword [ebp + 0x64]
call esi
push eax
call edi
test eax, eax
jne 0x1004ccb
push 0x1001890
call fcn.01003aec
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
push dword [ebp + 0x70]
call esi
push dword [ebp + 0x68]
call esi
push dword [ebp + 0x6c]
call esi
push dword [ebp + 0x60]
jmp 0x1004c4c
push 2
push ebx
push ebx
lea eax, [ebp + 0x5c]
push eax
call esi
push eax
push dword [ebp + 0x64]
call esi
push eax
call edi
test eax, eax
jne 0x1004d0f
push 0x1001890
call fcn.01003aec
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
push dword [ebp + 0x70]
call esi
push dword [ebp + 0x68]
call esi
push dword [ebp + 0x6c]
call esi
push dword [ebp + 0x60]
call esi
push dword [ebp + 0x64]
jmp 0x1004c4c
push dword [ebp + 0x7c]
lea eax, [ebp - 0x50]
push dword [0x1008088]
push dword [ebp + 0x60]
push dword [ebp + 0x68]
push dword [ebp + 0x70]
push 0x1001848
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x1c
push 0x11
xor eax, eax
pop ecx
lea edi, [ebp - 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x58]
mov dword [ebp + 0x28], eax
mov eax, dword [ebp + 0x54]
mov dword [ebp + 0x2c], eax
mov eax, dword [ebp + 0x50]
mov dword [ebp + 0x30], eax
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
mov dword [ebp - 0x10], 0x44
mov dword [ebp + 0x1c], 0x100
mov word [ebp + 0x20], 5
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push eax
xor edi, edi
inc edi
push edi
push ebx
push ebx
lea eax, [ebp - 0x50]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1004de1
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
jne 0x1004da6
push 0x1001830
call fcn.01003aec
pop ecx
jmp 0x1004dba
call esi
push eax
lea eax, [ebp - 0x50]
push eax
push 0x1001808
call fcn.01003aec
add esp, 0xc
push dword [ebp + 0x70]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp + 0x68]
call esi
push dword [ebp + 0x6c]
call esi
push dword [ebp + 0x60]
call esi
push dword [ebp + 0x64]
call esi
push dword [ebp + 0x5c]
jmp 0x1004c4c
push dword [ebp + 0x70]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp + 0x68]
call esi
push dword [ebp + 0x60]
call esi
push dword [ebp + 0x38]
call esi
push dword [ebp + 0x34]
call esi
mov eax, dword [0x1009290]
cmp eax, dword [0x1009298]
mov eax, dword [ebp + 0x6c]
jne 0x1004e15
mov dword [0x1009290], eax
mov esi, dword [sym.imp.KERNEL32.dll_SetStdHandle]
push eax
push 0xfffffffffffffff6
mov dword [0x1009298], eax
call esi
mov eax, dword [ebp + 0x64]
push eax
push 0xfffffffffffffff5
mov dword [0x1009294], eax
call esi
push dword [ebp + 0x5c]
push 0xfffffffffffffff4
call esi
push dword [ebp + 0x7c]
mov dword [0x10092d0], edi
push dword [0x1008088]
push 0x10017d8
call fcn.01003aec
add esp, 0xc
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4