Function at 0x489b94
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xf
push 0
push 0
dec ecx
jne 0x489b9c
push ebx
mov eax, 0x488610
call fcn.00406e34
xor eax, eax
push ebp
push 0x48a386
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, 3
call fcn.004860fc
mov edx, dword [ebp - 0x14]
mov eax, dword [0x48d734]
call fcn.00404d78
mov ecx, 0x495118
mov edx, 0x48a39c
mov eax, 0x80000002
call fcn.0046fa74
test al, al
je 0x489cf5
mov eax, dword [0x495118]
test eax, eax
je 0x489c00
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x20
jle 0x489ce4
mov ecx, 0x49511c
mov edx, 0x48a3dc
mov eax, 0x80000002
call fcn.0046fa74
lea eax, [ebp - 0x1c]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [0x495118]
call fcn.0040521c
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x48a420
call fcn.0040503c
mov eax, dword [ebp - 0x18]
call fcn.0040b6d8
mov ebx, eax
push 0x495124
mov ecx, ebx
mov edx, 0x23
mov eax, dword [0x495118]
call fcn.0040521c
push 0x495120
mov ecx, 0x20
mov edx, 3
mov eax, dword [0x495118]
call fcn.0040521c
push dword [0x49511c]
push dword [0x495124]
push 0x48a42c
lea eax, [ebp - 0x28]
call fcn.0046a07c
push dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.004050b8
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00469870
mov edx, dword [ebp - 0x20]
mov eax, dword [0x495120]
call fcn.0040514c
jne 0x489cd3
mov eax, dword [0x48da34]
mov edx, dword [0x495124]
call fcn.00404d78
jmp 0x489d0f
mov eax, dword [0x48da34]
mov edx, 0x48a438
call fcn.00404d78
jmp 0x489d0f
mov eax, dword [0x48da34]
mov edx, 0x48a438
call fcn.00404d78
jmp 0x489d0f
lea edx, [ebp - 0x2c]
mov eax, 0x48a444
call fcn.00487250
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x48da34]
call fcn.00404d78
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.004055ec
mov edx, dword [ebp - 0x30]
mov eax, 0x48a450
call fcn.00405754
test eax, eax
jle 0x489e41
mov ecx, dword [0x48d960]
mov edx, 0x48a474
mov eax, 0x80000002
call fcn.0046fa74
mov eax, 0x495128
xor ecx, ecx
mov edx, 0x10
call fcn.004037ec
mov eax, 0x495138
xor ecx, ecx
mov edx, 0x44
call fcn.004037ec
mov dword [0x495138], 0x44
mov word [0x495168], 0
push 0x495128
push 0x495138
mov eax, dword [0x48d960]
mov eax, dword [eax]
call fcn.004051b4
push eax
push 0
push 0x20
push 0
push 0
push 0
push 0x48a4b0
mov edx, dword [0x48d960]
mov edx, dword [edx]
lea eax, [ebp - 0x34]
mov ecx, 0x48a4d4
call fcn.0040503c
mov eax, dword [ebp - 0x34]
call fcn.004051b4
push eax
call sub.kernel32.dll_CreateProcessA
lea eax, [ebp - 0x38]
call fcn.004879d4
cmp dword [ebp - 0x38], 0
jne 0x48a302
push 0x1388
call sub.kernel32.dll_Sleep_1
push 0x495128
push 0x495138
mov edx, dword [0x48d960]
mov edx, dword [edx]
lea eax, [ebp - 0x3c]
mov ecx, 0x48a4e8
call fcn.0040503c
mov eax, dword [ebp - 0x3c]
call fcn.004051b4
push eax
push 0
push 0x20
push 0
push 0
push 0
push 0x48a4f4
mov edx, dword [0x48d960]
mov edx, dword [edx]
lea eax, [ebp - 0x40]
mov ecx, 0x48a500
call fcn.0040503c
mov eax, dword [ebp - 0x40]
call fcn.004051b4
push eax
call sub.kernel32.dll_CreateProcessA
jmp 0x48a302
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 0x44]
call fcn.004055ec
mov edx, dword [ebp - 0x44]
mov eax, 0x48a518
call fcn.00405754
test eax, eax
jle 0x489f07
lea edx, [ebp - 0x48]
mov eax, 0x48a52c
call fcn.00487250
mov edx, dword [ebp - 0x48]
mov eax, 0x4950f4
call fcn.00404d78
mov eax, dword [0x48d5e4]
cmp dword [eax], 0
jne 0x489e9e
lea eax, [ebp - 0x4c]
call fcn.0046a07c
mov edx, dword [ebp - 0x4c]
mov eax, dword [0x48d5e4]
call fcn.00404d78
mov eax, dword [0x48d5e4]
mov eax, dword [eax]
push eax
push 0x49510c
push 0x495110
push 0x495114
xor ecx, ecx
mov edx, 0x48a53c
mov eax, 0x48a548
call fcn.00485e2c
test al, al
je 0x489ee3
cmp dword [0x49510c], 0
je 0x489ee3
mov eax, 0x4950f4
mov edx, dword [0x49510c]
call fcn.00404d78
mov eax, dword [0x495114]
mov edx, 0x48a554
call fcn.0040514c
je 0x48a302
mov eax, dword [0x4950f4]
call fcn.00485b00
jmp 0x48a302
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.004055ec
mov edx, dword [ebp - 0x50]
mov eax, 0x48a560
call fcn.00405754
test eax, eax
jle 0x489fcd
lea edx, [ebp - 0x54]
mov eax, 0x48a574
call fcn.00487250
mov edx, dword [ebp - 0x54]
mov eax, 0x4950f4
call fcn.00404d78
mov eax, dword [0x48d5e4]
cmp dword [eax], 0
jne 0x489f64
lea eax, [ebp - 0x58]
call fcn.0046a07c
mov edx, dword [ebp - 0x58]
mov eax, dword [0x48d5e4]
call fcn.00404d78
mov eax, dword [0x48d5e4]
mov eax, dword [eax]
push eax
push 0x49510c
push 0x495110
push 0x495114
xor ecx, ecx
mov edx, 0x48a53c
mov eax, 0x48a584
call fcn.00485e2c
test al, al
je 0x489fa9
cmp dword [0x49510c], 0
je 0x489fa9
mov eax, 0x4950f4
mov edx, dword [0x49510c]
call fcn.00404d78
mov eax, dword [0x495114]
mov edx, 0x48a554
call fcn.0040514c
je 0x48a302
mov eax, dword [0x4950f4]
call fcn.00485b00
jmp 0x48a302
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 0x5c]
call fcn.004055ec
mov edx, dword [ebp - 0x5c]
mov eax, 0x48a590
call fcn.00405754
test eax, eax
jle 0x48a093
lea edx, [ebp - 0x60]
mov eax, 0x48a5a4
call fcn.00487250
mov edx, dword [ebp - 0x60]
mov eax, 0x4950f4
call fcn.00404d78
mov eax, dword [0x48d5e4]
cmp dword [eax], 0
jne 0x48a02a
lea eax, [ebp - 0x64]
call fcn.0046a07c
mov edx, dword [ebp - 0x64]
mov eax, dword [0x48d5e4]
call fcn.00404d78
mov eax, dword [0x48d5e4]
mov eax, dword [eax]
push eax
push 0x49510c
push 0x495110
push 0x495114
xor ecx, ecx
mov edx, 0x48a53c
mov eax, 0x48a5b4
call fcn.00485e2c
test al, al
je 0x48a06f
cmp dword [0x49510c], 0
je 0x48a06f
mov eax, 0x4950f4
mov edx, dword [0x49510c]
call fcn.00404d78
mov eax, dword [0x495114]
mov edx, 0x48a554
call fcn.0040514c
je 0x48a302
mov eax, dword [0x4950f4]
call fcn.00485b00
jmp 0x48a302
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 0x68]
call fcn.004055ec
mov edx, dword [ebp - 0x68]
mov eax, 0x48a5c0
call fcn.00405754
test eax, eax
jle 0x48a159
lea edx, [ebp - 0x6c]
mov eax, 0x48a5d4
call fcn.00487250
mov edx, dword [ebp - 0x6c]
mov eax, 0x4950f4
call fcn.00404d78
mov eax, dword [0x48d5e4]
cmp dword [eax], 0
jne 0x48a0f0
lea eax, [ebp - 0x70]
call fcn.0046a07c
mov edx, dword [ebp - 0x70]
mov eax, dword [0x48d5e4]
call fcn.00404d78
mov eax, dword [0x48d5e4]
mov eax, dword [eax]
push eax
push 0x49510c
push 0x495110
push 0x495114
xor ecx, ecx
mov edx, 0x48a53c
mov eax, 0x48a5e4
call fcn.00485e2c
test al, al
je 0x48a135
cmp dword [0x49510c], 0
je 0x48a135
mov eax, 0x4950f4
mov edx, dword [0x49510c]
call fcn.00404d78
mov eax, dword [0x495114]
mov edx, 0x48a554
call fcn.0040514c
je 0x48a302
mov eax, dword [0x4950f4]
call fcn.00485b00
jmp 0x48a302
mov eax, dword [0x48db14]
mov byte [eax], 0
mov edx, 0x4950f8
mov eax, 0x4950fc
call fcn.004862b0
mov edx, dword [0x48d800]
mov dword [edx], eax
mov eax, dword [0x48d800]
cmp dword [eax], 0
jle 0x48a2d7
mov eax, dword [0x48da04]
mov byte [eax + 1], 0x32
mov eax, dword [0x48da04]
mov byte [eax], 0x56
mov eax, dword [0x48da04]
mov byte [eax + 7], 0x36
mov eax, dword [0x48da04]
mov byte [eax + 2], 0x4e
mov eax, dword [0x48da04]
movzx eax, byte [eax + 1]
mov edx, dword [0x48da04]
mov byte [edx + 3], al
mov eax, dword [0x48da04]
mov byte [eax + 4], 0x25
mov eax, dword [0x48da04]
mov byte [eax + 5], 0x40
mov eax, dword [0x48da04]
mov byte [eax + 6], 0x23
call fcn.0047edb0
mov eax, dword [0x48d948]
mov eax, dword [eax]
call fcn.00465d6c
mov eax, dword [0x48d948]
mov eax, dword [eax]
mov dl, 1
call fcn.00467c44
mov edx, dword [0x48d7d0]
mov edx, dword [edx]
mov eax, dword [0x48d948]
mov eax, dword [eax]
call fcn.00465824
mov ecx, dword [0x48d99c]
mov eax, dword [0x48d948]
mov eax, dword [eax]
mov edx, dword [0x48837c]
call fcn.00465d84
mov ecx, dword [0x48d970]
mov eax, dword [0x48d948]
mov eax, dword [eax]
mov edx, dword [0x487c60]
call fcn.00465d84
mov ecx, dword [0x48d9e0]
mov eax, dword [0x48d948]
mov eax, dword [eax]
mov edx, dword [0x4833dc]
call fcn.00465d84
mov ecx, dword [0x48da0c]
mov eax, dword [0x48d948]
mov eax, dword [eax]
mov edx, dword [0x481fbc]
call fcn.00465d84
mov ecx, dword [0x48d7cc]
mov eax, dword [0x48d948]
mov eax, dword [eax]
mov edx, dword [0x481c10]
call fcn.00465d84
mov ecx, dword [0x48d8e0]
mov eax, dword [0x48d948]
mov eax, dword [eax]
mov edx, dword [0x48436c]
call fcn.00465d84
mov ecx, dword [0x48d654]
mov eax, dword [0x48d948]
mov eax, dword [eax]
mov edx, dword [0x480568]
call fcn.00465d84
mov ecx, dword [0x48d67c]
mov eax, dword [0x48d948]
mov eax, dword [eax]
mov edx, dword [0x4808f0]
call fcn.00465d84
mov eax, dword [0x48d948]
mov eax, dword [eax]
call fcn.00465ebc
jmp 0x48a302
lea edx, [ebp - 0x74]
mov eax, 0x48a5f0
call fcn.00487250
mov eax, dword [ebp - 0x74]
push eax
lea edx, [ebp - 0x78]
mov eax, 0x48a604
call fcn.00487250
mov eax, dword [ebp - 0x78]
mov dx, 0x30
pop ecx
call fcn.0048740c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a38d
lea eax, [ebp - 0x78]
mov edx, 4
call fcn.00404d48
lea eax, [ebp - 0x68]
call fcn.004054d8
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.00404d48
lea eax, [ebp - 0x5c]
call fcn.004054d8
lea eax, [ebp - 0x58]
mov edx, 2
call fcn.00404d48
lea eax, [ebp - 0x50]
call fcn.004054d8
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.00404d48
lea eax, [ebp - 0x44]
call fcn.004054d8
lea eax, [ebp - 0x40]
mov edx, 4
call fcn.00404d48
lea eax, [ebp - 0x30]
call fcn.004054d8
lea eax, [ebp - 0x2c]
mov edx, 7
call fcn.00404d48
ret