Function at 0x48e280
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x1a0
lea ebp, [esp - 4]
mov eax, dword [0x60bd28]
xor eax, ebp
mov dword [ebp + 0x1a0], eax
push 0xc
mov eax, 0x583eec
call fcn.00544ba3
mov esi, dword [ebp + 0x1ac]
push 4
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 0x1b0]
mov dword [ebp - 4], 1
call fcn.0041e830
mov eax, dword [eax]
push 0x5a4870
push eax
call fcn.00541578
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov edi, eax
call fcn.00401040
xor ebx, ebx
cmp edi, ebx
mov edi, dword [ebp + 0x1b0]
je 0x48e3ba
call fcn.00512f10
push eax
lea ecx, [ebp - 0x14]
call fcn.00401270
mov eax, dword [edi - 0xc]
cmp eax, 7
mov byte [ebp - 4], 2
jl 0x48e2f6
push 3
add eax, 0xfffffff9
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 0x1b0]
call fcn.00420700
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.004025f0
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.00401040
push dword [ebp + 0x1bc]
push dword [ebp - 0x14]
call fcn.00541578
test eax, eax
pop ecx
pop ecx
je 0x48e2f6
push 0x5a486c
push dword [ebp - 0x14]
call fcn.00541578
test eax, eax
pop ecx
pop ecx
jne 0x48e2f6
push 3
push dword [ebp + 0x1c0]
lea ecx, [ebp]
push 2
push str.EnglishHelpFile
call fcn.004a0b95
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.00481e00
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.00481e00
push 0x5019
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.00481e8f
push 0x19
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push eax
call fcn.00481e33
add esp, 0xc
push ebx
push 0x40
push dword [ebp - 0x10]
lea ecx, [ebp]
call fcn.004a0cfb
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401040
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401040
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.0048e05e
push 5
push ebx
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov dword [ebp - 0x10], eax
jge 0x48e3ad
cmp eax, 0x1f
jne 0x48e337
push ebx
lea ecx, [ebp + 0x1c]
call fcn.004a036c
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 7
call fcn.00522872
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 2
call fcn.0048dfc9
jmp 0x48e3ad
mov esi, 0xff
push esi
lea eax, [ebp + 0xa1]
push ebx
push eax
mov byte [ebp + 0xa0], bl
call fcn.0053fd60
add esp, 0xc
push ebx
push esi
lea eax, [ebp + 0xa0]
push eax
push 0x400
push dword [ebp - 0x10]
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
call fcn.00512f10
push eax
lea ecx, [ebp - 0x10]
call fcn.00401270
lea eax, [ebp + 0xa0]
push eax
lea eax, [ebp - 0x10]
push 0x5014
push eax
mov byte [ebp - 4], 8
call fcn.0048e125
mov esi, dword [ebp - 0x10]
add esp, 0xc
push ebx
push ebx
push esi
call fcn.0051ee3c
lea ecx, [esi - 0x10]
call fcn.00401040
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401040
jmp 0x48e3da
call fcn.0048df9f
test eax, eax
je 0x48e3da
cmp esi, ebx
je 0x48e3da
push dword [ebp + 0x1b8]
mov ecx, esi
push dword [ebp + 0x1b4]
call fcn.00526a91
lea ecx, [edi - 0x10]
call fcn.00401040
mov ecx, dword [ebp + 0x1bc]
add ecx, 0xfffffff0
call fcn.00401040
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1a0]
xor ecx, ebp
call fcn.0053fab2
add ebp, 0x1a4
leave
ret