Function at 0x495d10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x495d18
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x495fd5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x416e4c]
call fcn.00403710
mov esi, eax
mov dl, 1
mov eax, dword [0x433d5c]
call fcn.00433ec8
mov dword [ebp - 4], eax
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.00433fa4
mov cl, 1
mov edx, 0x495fec
mov eax, dword [ebp - 4]
call fcn.0043400c
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00434330
mov eax, dword [ebp - 4]
call fcn.00433f74
mov edx, 0x80000000
mov eax, dword [ebp - 4]
call fcn.00433fa4
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x495e6a
lea ecx, [ebp - 0xc]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xc]
mov edx, 0x496040
call fcn.0040495c
je 0x495e60
push 0x496070
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x14]
push 0x496080
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004048d0
mov edx, dword [ebp - 0x10]
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.0043400c
lea ecx, [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00434564
mov eax, dword [ebp - 8]
call fcn.004093e0
test al, al
je 0x495e31
push 0x496098
push dword [ebp - 8]
push 0x4960ac
lea eax, [ebp - 8]
mov edx, 3
call fcn.004048d0
push 0
mov eax, dword [ebp - 8]
call fcn.00404a10
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [ebp - 4]
call fcn.00433f74
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x4960bc
call fcn.0040485c
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00434130
dec ebx
cmp ebx, 0xffffffff
jne 0x495d9c
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.00433fa4
mov cl, 1
mov edx, 0x496110
mov eax, dword [ebp - 4]
call fcn.0043400c
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004343f8
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x495ed7
lea ecx, [ebp - 0x20]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x20]
mov edx, 0x496040
call fcn.0040495c
je 0x495ed1
lea ecx, [ebp - 0x24]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004342a8
dec ebx
cmp ebx, 0xffffffff
jne 0x495e9f
mov eax, dword [ebp - 4]
call fcn.00433f74
mov eax, esi
call fcn.00403740
push 0
push 0x496148
call sub.kernel32.dll_WinExec
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.00433fa4
mov cl, 1
mov edx, 0x496164
mov eax, dword [ebp - 4]
call fcn.0043400c
xor eax, eax
push ebp
push 0x495f38
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x49617c
mov edx, 0x49618c
mov eax, dword [ebp - 4]
call fcn.00434538
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x495f4a
mov eax, dword [ebp - 4]
call fcn.00433f74
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.00433fa4
mov cl, 1
mov edx, 0x496164
mov eax, dword [ebp - 4]
call fcn.0043400c
xor eax, eax
push ebp
push 0x495f98
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x49617c
mov edx, 0x49618c
mov eax, dword [ebp - 4]
call fcn.00434538
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x495faa
mov eax, dword [ebp - 4]
call fcn.00433f74
mov eax, dword [ebp - 4]
call fcn.00403740
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495fdc
lea eax, [ebp - 0x24]
mov edx, 8
call fcn.00404574
ret