Function at 0x48dd0c
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdbc
push ebx
xor edx, edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x230], edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a9c
lea ebx, [ebp - 0x1d8]
xor eax, eax
push ebp
push 0x48dfe6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x493fe4]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x48dffc
call fcn.004048f8
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404684
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00402e70
mov eax, ebx
call fcn.00402c0c
call fcn.0040290c
mov edx, 0x48e014
mov eax, ebx
call fcn.00404c9c
call fcn.004032a8
call fcn.0040290c
mov edx, 0x48e028
mov eax, ebx
call fcn.00404c9c
call fcn.004032a8
call fcn.0040290c
mov edx, 0x48e038
mov eax, ebx
call fcn.00404c9c
call fcn.004032a8
call fcn.0040290c
mov edx, 0x48e064
mov eax, ebx
call fcn.00404c9c
call fcn.004032a8
call fcn.0040290c
mov edx, 0x48e084
mov eax, ebx
call fcn.00404c9c
call fcn.004032a8
call fcn.0040290c
mov edx, 0x48e0a8
mov eax, ebx
call fcn.00404c9c
call fcn.004032a8
call fcn.0040290c
mov edx, 0x48e0c0
mov eax, ebx
call fcn.00404c9c
call fcn.004032a8
call fcn.0040290c
push 0x48e0d0
push dword [ebp - 0xc]
push 0x48e0e0
lea edx, [ebp - 0x234]
xor eax, eax
call fcn.00402acc
push dword [ebp - 0x234]
push 0x48e0ec
lea eax, [ebp - 0x230]
mov edx, 5
call fcn.0040496c
mov edx, dword [ebp - 0x230]
mov eax, ebx
call fcn.00404c9c
call fcn.004032a8
call fcn.0040290c
push 0x48e0f8
lea edx, [ebp - 0x23c]
xor eax, eax
call fcn.00402acc
push dword [ebp - 0x23c]
push 0x48e0ec
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.0040496c
mov edx, dword [ebp - 0x238]
mov eax, ebx
call fcn.00404c9c
call fcn.004032a8
call fcn.0040290c
push 0x48e10c
push dword [ebp - 0xc]
push 0x48e0ec
lea eax, [ebp - 0x240]
mov edx, 3
call fcn.0040496c
mov edx, dword [ebp - 0x240]
mov eax, ebx
call fcn.00404c9c
call fcn.004032a8
call fcn.0040290c
push 0x48e11c
push dword [ebp - 0xc]
push 0x48e0ec
push 0x48e130
lea eax, [ebp - 0x244]
mov edx, 4
call fcn.0040496c
mov edx, dword [ebp - 0x244]
mov eax, ebx
call fcn.00404c9c
call fcn.004032a8
call fcn.0040290c
mov edx, 0x48e144
mov eax, ebx
call fcn.00404c9c
call fcn.004032a8
call fcn.0040290c
mov eax, ebx
call fcn.00402f38
call fcn.0040290c
lea eax, [ebp - 0x22c]
xor ecx, ecx
mov edx, 0x44
call fcn.004030a0
mov dword [ebp - 0x200], 1
mov word [ebp - 0x1fc], 0
lea eax, [ebp - 0x1e8]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404aac
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x48dfbb
mov eax, dword [ebp - 0x1e4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x1e8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48dfed
lea eax, [ebp - 0x244]
mov edx, 6
call fcn.00404610
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404610
ret