Function at 0x4987f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578dac
mov eax, dword fs:[0]
push eax
sub esp, 0x2c0
mov eax, dword [0x5fc150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x268], eax
call fcn.00439ba0
mov ecx, eax
call fcn.0041b240
cmp eax, 0xffffffff
jne 0x49886a
mov eax, dword [edi]
lea ecx, [edi + 0x300]
push 0
push 0
push 0x30
push str.Save_failed
push str.Cannot_save:_Buffer_is_invalid.
push dword [eax + 0xc]
push str.BufferInvalidWarning
call fcn.004607b0
xor al, al
jmp 0x498c3f
mov ebx, dword [ebp + 0x10]
test bl, bl
jne 0x49889e
mov eax, dword [edi]
lea ecx, [edi + 0x68a08]
mov dword [ebp - 0x2c4], 0x3ef
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x2cc], eax
lea eax, [ebp - 0x2cc]
push eax
mov dword [ebp - 0x2c8], esi
call fcn.004c1430
xor eax, eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x230]
push eax
push ebx
push dword [ebp - 0x268]
push esi
call fcn.00439ba0
mov ecx, eax
call fcn.0041c6e0
mov byte [ebp - 0x261], al
test bl, bl
jne 0x498919
lea eax, [ebp - 0x2cc]
mov dword [ebp - 0x2c4], 0x3f0
push eax
lea ecx, [edi + 0x68a08]
call fcn.004c1430
mov al, byte [ebp - 0x261]
test al, al
jne 0x498bd0
cmp byte [edi + 0x68a81], al
jne 0x498b76
call fcn.0040baa0
cmp byte [eax + 0x6fd], 0
je 0x498a40
cmp byte [eax + 0x9a], 0
je 0x498a40
cmp byte [eax + 0x9b], 0
jne 0x498a40
mov eax, dword [edi]
lea ecx, [edi + 0x300]
push 0
push 0
push 4
push str.Save_failed
push str.The_file_cannot_be_saved_and_it_may_be_protected._rDo_you_want_to_launch_Notepad_in_Administrator_mode_
push dword [eax + 0xc]
push str.OpenInAdminMode
call fcn.004607b0
cmp eax, 6
jne 0x498bf7
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5b173c
lea ecx, [ebp - 0x248]
call fcn.004029a0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x234], 8
mov ecx, dword [ebp - 0x248]
jae 0x4989c4
lea ecx, [ebp - 0x248]
mov eax, dword [edi]
push 5
push 0x58823c
push ecx
lea ecx, [ebp - 0x218]
push ecx
push str.runas
push dword [eax + 0xc]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
cmp eax, 0x20
mov eax, dword [edi]
push 0
jae 0x498a21
push 0
push str.Open_in_Administrator_mode_failed
push str.Notepad_cannot_be_opened_in_Administrator_mode.
push dword [eax + 0xc]
lea ecx, [edi + 0x300]
push str.OpenInAdminModeFailed
call fcn.004607b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.004038c0
jmp 0x498bf7
push 0x10
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.004038c0
jmp 0x498bf7
mov eax, dword [edi]
lea ecx, [edi + 0x300]
push 0
push 0
push 4
push str.Save_failed
push str.The_file_cannot_be_saved_and_it_may_be_protected._rDo_you_want_to_launch_Notepad_in_Administrator_mode_
push dword [eax + 0xc]
push str.OpenInAdminModeWithoutCloseCurrent
call fcn.004607b0
cmp eax, 6
jne 0x498bf7
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [edi + 0x580]
mov esi, dword [eax + 0x1c]
call fcn.00439ba0
add esi, 0x74
cmp dword [esi + 0x14], 8
jb 0x498a9b
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x260]
call fcn.004029a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x248]
push str._multiInst__nosession
call fcn.004029a0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x248]
push 0x593ed8
call fcn.0040a2e0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x248]
call fcn.00406650
push 0x593ed8
lea ecx, [ebp - 0x248]
call fcn.0040a2e0
cmp dword [ebp - 0x234], 8
mov ecx, dword [ebp - 0x248]
jae 0x498b0a
lea ecx, [ebp - 0x248]
mov eax, dword [edi]
push 5
push 0x58823c
push ecx
lea ecx, [ebp - 0x218]
push ecx
push str.runas
push dword [eax + 0xc]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jae 0x498b53
mov eax, dword [edi]
lea ecx, [edi + 0x300]
push 0
push 0
push 0
push str.Open_in_Administrator_mode_failed
push str.Notepad_cannot_be_opened_in_Administrator_mode.
push dword [eax + 0xc]
push str.OpenInAdminModeFailed
call fcn.004607b0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x248]
call fcn.004038c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x260]
call fcn.004038c0
jmp 0x498bf7
cmp dword [ebp - 0x220], 0
jne 0x498ba6
mov eax, dword [edi]
lea ecx, [edi + 0x300]
push 0
push 0
push 0
push str.Save_failed
push str.Please_check_if_this_file_is_opened_in_another_program.
push dword [eax + 0xc]
push str.FileLockedWarning
call fcn.004607b0
jmp 0x498bf7
cmp dword [ebp - 0x21c], 8
mov ecx, dword [ebp - 0x230]
jae 0x498bbb
lea ecx, [ebp - 0x230]
mov eax, dword [edi]
push 0
push str.Save_failed
push ecx
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x498bf7
mov ecx, dword [edi + 0x68ff0]
test ecx, ecx
je 0x498bf7
mov al, byte [ecx + 0x60]
test al, al
jne 0x498bf7
mov eax, dword [ecx]
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x498bf7
mov ecx, dword [edi + 0x68ff0]
call fcn.00452f20
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x498c1c
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00407270
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov al, byte [ebp - 0x261]
mov dword [ebp - 0x220], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret 0xc