Function at 0x4e2e50
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Get common file path
Read file via mapping
Resume thread
Terminate process

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x350
mov rbp, rsp
mov qword [rbp + 0x58], rcx
mov byte [rbp + 0x57], dl
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x288], 0
mov qword [rbp + 0x280], 0
nop
lea rcx, [rbp + 0x2a8]
mov edx, 0x68
call fcn.00421ad0
mov dword [rbp + 0x2a8], 0x68
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4e2f57
mov rax, qword [rbp + 0x58]
test rax, rax
jne 0x4e2ed7
call sub.kernel32.dll_GetCommandLineW
lea rcx, [rbp + 0x288]
mov rdx, rax
call fcn.00411eb0
jmp 0x4e2ee7
lea rcx, [rbp + 0x288]
mov rdx, qword [rbp + 0x58]
call fcn.00410750
mov ecx, 0x104
lea rdx, [rbp + 0x76]
call sub.kernel32.dll_GetCurrentDirectoryW
mov rcx, qword [rbp + 0x288]
call fcn.00411e10
xor rcx, rcx
mov rdx, rax
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x30], 0
lea rax, [rbp + 0x76]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x2a8]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x290]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessW
test eax, eax
setne al
jmp 0x4e2ff7
mov rax, qword [rbp + 0x58]
test rax, rax
jne 0x4e2f79
call sub.kernel32.dll_GetCommandLineA
lea rcx, [rbp + 0x280]
mov rdx, rax
xor r8, r8
call fcn.00410cf0
jmp 0x4e2f8c
lea rcx, [rbp + 0x280]
mov rdx, qword [rbp + 0x58]
xor r8, r8
call fcn.00411660
mov ecx, 0x104
lea rdx, [rbp + 0x76]
call sub.kernel32.dll_GetCurrentDirectoryA
mov rcx, qword [rbp + 0x280]
call fcn.00411320
xor rcx, rcx
mov rdx, rax
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x30], 0
lea rax, [rbp + 0x76]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x2a8]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x290]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessA
test eax, eax
setne al
test al, al
je 0x4e30f7
lea rcx, [rbp + 0x338]
lea rdx, [rbp + 0x310]
call fcn.004aab30
lea rcx, [rbp + 0x60]
mov edx, dword [rbp + 0x2a0]
mov r8d, 1
mov r9b, 0x30
call fcn.00425ad0
lea rcx, [rbp + 0x68]
lea rdx, [0x004e31c8]
mov r8, qword [rbp + 0x60]
call fcn.00410f60
mov rcx, qword [rbp + 0x68]
call fcn.00411320
or rcx, 0xffffffffffffffff
lea rdx, [rbp + 0x338]
mov r8d, 4
xor r9, r9
mov dword [rsp + 0x20], 0x60
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateFileMappingA
mov rbx, rax
mov rcx, rbx
mov edx, 0xf001f
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_MapViewOfFile
mov rsi, rax
test rsi, rsi
je 0x4e30eb
call sub.kernel32.dll_GetCurrentProcessId
mov eax, eax
mov qword [rsi], rax
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
mov rdx, rbx
mov r8, qword [rbp + 0x290]
lea r9, [rsi + 8]
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 2
call sub.kernel32.dll_DuplicateHandle
lea rcx, [0x00b2e350]
lea rdx, [rsi + 0x10]
mov r8d, 0x50
call fcn.00408cc0
mov rcx, qword [rbp + 0x298]
call sub.kernel32.dll_ResumeThread
movzx rax, byte [rbp + 0x57]
test al, al
je 0x4e3115
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 2
call sub.kernel32.dll_TerminateProcess
jmp 0x4e3120
mov ecx, 2
call fcn.0040fd10
nop
lea rcx, [rbp + 0x60]
mov edx, 2
call fcn.00410190
lea rcx, [rbp + 0x280]
call fcn.004100d0
lea rcx, [rbp + 0x288]
call fcn.00410080
lea rsp, [rbp + 0x350]
pop rbx
pop rsi
pop rbp
ret