Function at 0x481d6c
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
mov edi, edx
lea esi, [ebp - 0x1d0]
xor eax, eax
push ebp
push 0x4820fd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x228]
call fcn.004810fc
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 4]
mov ecx, 0x482118
call fcn.00404e28
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00403298
mov eax, esi
call fcn.00403034
call fcn.00402c98
mov edx, 0x482134
mov eax, esi
call fcn.004051cc
call fcn.004036d0
call fcn.00402c98
push 0x482144
push ebx
push 0x482154
lea eax, [ebp - 0x22c]
mov edx, 3
call fcn.00404e9c
mov edx, dword [ebp - 0x22c]
mov eax, esi
call fcn.004051cc
call fcn.004036d0
call fcn.00402c98
push 0x482160
push ebx
push 0x482154
push 0x482174
lea eax, [ebp - 0x230]
mov edx, 4
call fcn.00404e9c
mov edx, dword [ebp - 0x230]
mov eax, esi
call fcn.004051cc
call fcn.004036d0
call fcn.00402c98
push 0x482188
push edi
push 0x482198
push ebx
push 0x482154
lea eax, [ebp - 0x234]
mov edx, 5
call fcn.00404e9c
mov edx, dword [ebp - 0x234]
mov eax, esi
call fcn.004051cc
call fcn.004036d0
call fcn.00402c98
push 0x482144
push edi
push 0x482154
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.00404e9c
mov edx, dword [ebp - 0x238]
mov eax, esi
call fcn.004051cc
call fcn.004036d0
call fcn.00402c98
mov edx, 0x4821a4
mov eax, esi
call fcn.004051cc
call fcn.004036d0
call fcn.00402c98
mov edx, 0x4821b8
mov eax, esi
call fcn.004051cc
call fcn.004036d0
call fcn.00402c98
mov edx, 0x482208
mov eax, esi
call fcn.004051cc
call fcn.004036d0
call fcn.00402c98
mov edx, 0x482248
mov eax, esi
call fcn.004051cc
call fcn.004036d0
call fcn.00402c98
push 0x482280
push ebx
push 0x482294
lea eax, [ebp - 0x23c]
mov edx, 3
call fcn.00404e9c
mov edx, dword [ebp - 0x23c]
mov eax, esi
call fcn.004051cc
call fcn.004036d0
call fcn.00402c98
mov edx, 0x4822bc
mov eax, esi
call fcn.004051cc
call fcn.004036d0
call fcn.00402c98
mov edx, 0x482318
mov eax, esi
call fcn.004051cc
call fcn.004036d0
call fcn.00402c98
push 0x482374
push dword [ebp + 8]
push 0x4823bc
lea eax, [ebp - 0x240]
mov edx, 3
call fcn.00404e9c
mov edx, dword [ebp - 0x240]
mov eax, esi
call fcn.004051cc
call fcn.004036d0
call fcn.00402c98
mov edx, 0x4823e8
mov eax, esi
call fcn.004051cc
call fcn.004036d0
call fcn.00402c98
mov edx, 0x48242c
mov eax, esi
call fcn.004051cc
call fcn.004036d0
call fcn.00402c98
mov edx, 0x482464
mov eax, esi
call fcn.004051cc
call fcn.004036d0
call fcn.00402c98
mov edx, 0x4824ac
mov eax, esi
call fcn.004051cc
call fcn.004036d0
call fcn.00402c98
mov edx, 0x4824d8
mov eax, esi
call fcn.004051cc
call fcn.004036d0
call fcn.00402c98
mov edx, 0x4824e8
mov eax, esi
call fcn.004051cc
call fcn.004036d0
call fcn.00402c98
mov edx, 0x4824f4
mov eax, esi
call fcn.004051cc
call fcn.004036d0
call fcn.00402c98
mov eax, esi
call fcn.00403360
call fcn.00402c98
lea eax, [ebp - 0x224]
xor ecx, ecx
mov edx, 0x44
call fcn.004034c8
mov dword [ebp - 0x1f8], 1
mov word [ebp - 0x1f4], 0
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404fdc
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4820d7
mov eax, dword [ebp - 0x1dc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x1e0]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482104
lea eax, [ebp - 0x240]
mov edx, 7
call fcn.00404b40
lea eax, [ebp - 4]
call fcn.00404b1c
ret