Function at 0x48fa30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push eax
lea eax, [ebp - 8]
mov edi, ecx
push eax
mov ecx, ebx
call fcn.0048c250
mov eax, dword [edi + 0x15010]
test eax, eax
je 0x48fa81
mov al, byte [eax + 0x174]
test al, al
jne 0x48fa76
mov byte [edi + 0xbcf], 0xb
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp al, 2
jne 0x48fa81
mov ecx, edi
call fcn.0043b9e0
mov ecx, ebx
call fcn.0048d0f0
mov edx, eax
test edx, edx
je 0x48fad3
mov ecx, dword [edi + 0x15010]
test ecx, ecx
je 0x48fad3
cmp byte [edi + 0xbcf], 0x3d
jne 0x48fad3
cmp byte [edi + 0x15014], 0
jne 0x48fac5
movzx eax, word [ecx + 0x18c]
lea ecx, [edi + 0x301c8]
push 0
push eax
push 0x2b
lea eax, [edx - 0x1f]
push eax
call fcn.004131f0
mov ecx, edi
call fcn.0043b9e0
mov byte [edi + 0xbcf], 0
cmp byte [0x6e207c], 1
jne 0x490064
mov ecx, edi
call fcn.0048f480
movzx eax, byte [ebx + 0x971]
dec eax
mov byte [ebp - 0xc], 1
cmp eax, 0x3d
ja case.0x48fb03.8
movzx eax, byte [eax + 0x490114]
jmp dword [eax*4 + 0x4900c4]
mov byte [edi + 0xbcf], 0x45
jmp case.0x48fb03.5
mov byte [edi + 0xbcf], 0x46
jmp case.0x48fb03.5
mov byte [edi + 0xbcf], 0x47
jmp case.0x48fb03.5
mov byte [edi + 0xbcf], 0x48
jmp case.0x48fb03.5
mov byte [edi + 0xbcf], 0x4a
jmp case.0x48fb03.5
mov byte [edi + 0xbcf], 0x4b
jmp case.0x48fb03.5
sub esp, 0x18
mov ecx, esp
push 0x552a40
call fcn.00406c50
lea ecx, [edi + 0x301c8]
call fcn.00413100
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x14
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x10
push eax
movzx eax, byte [ebx + 0x971]
mov ecx, edi
push 0
push dword [ebx + eax*4 + 0xc18]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0048eeb0
mov al, byte [ebx + 0x96c]
mov ecx, edi
mov byte [ebp + 0xb], al
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0x10], 0x19
push eax
push dword [ebx + 0xc6c]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0048e620
mov ecx, dword [ebp - 0xc]
xor edx, edx
test al, al
movzx ecx, cl
cmovne ecx, edx
mov dword [ebp - 0xc], ecx
mov byte [0x6e207c], dl
mov byte [0x6e207d], dl
mov byte [0x6e207e], dl
jmp case.0x48fb03.8
lea eax, [ebp + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x10]
push eax
push 0x16
call fcn.0048c270
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x301c8]
cdq
and edx, 0xf
add eax, edx
sar eax, 4
push eax
call fcn.00413010
jmp case.0x48fb03.5
sub esp, 0x18
mov ecx, esp
push 0x552a40
call fcn.00406c50
lea ecx, [edi + 0x301c8]
call fcn.00412fa0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x15
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x10
push eax
movzx eax, byte [ebx + 0x971]
mov ecx, edi
push 0
push dword [ebx + eax*4 + 0xc18]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0048eeb0
mov al, byte [ebx + 0x96c]
mov ecx, edi
mov byte [ebp + 0xb], al
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0x10], 0x1a
push eax
push dword [ebx + 0xc74]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0048e620
mov edx, dword [ebp - 0xc]
movzx ecx, dl
xor edx, edx
test al, al
cmovne ecx, edx
mov byte [ebp - 0xc], cl
jmp 0x48fbde
lea eax, [ebp + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x10]
push eax
push 0x18
call fcn.0048c270
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x301c8]
cdq
and edx, 0xf
add eax, edx
sar eax, 4
push eax
call fcn.00412f20
jmp case.0x48fb03.5
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov dword [ebp + 8], 0x16
lea eax, [ebp + 8]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
movzx eax, byte [ebx + 0x971]
push 1
push dword [ebx + eax*4 + 0xc18]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0048eeb0
jmp case.0x48fb03.5
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov dword [ebp + 8], 0x17
jmp 0x48fcf5
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov dword [ebp + 8], 0x18
jmp 0x48fcf5
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov dword [ebp + 8], 0x19
jmp 0x48fcf5
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov dword [ebp + 8], 0x12
jmp 0x48fcf5
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov dword [ebp + 8], 0x13
jmp 0x48fcf5
push 0x27
lea ecx, [edi + 0x301c8]
call fcn.0040c2e0
lea ecx, [edi + 0x301c8]
test al, al
je 0x48fdb4
push 0
push 0x27
jmp 0x48fdd9
push 1
push 0x27
jmp 0x48fdd9
push 0x29
lea ecx, [edi + 0x301c8]
call fcn.0040c2e0
lea ecx, [edi + 0x301c8]
test al, al
je 0x48fdd5
push 0
jmp 0x48fdd7
push 1
push 0x29
call fcn.004133f0
mov byte [0x6e207c], 0
mov byte [0x6e207d], 0
mov byte [0x6e207e], 0
movzx eax, byte [ebx + 0x972]
dec eax
cmp eax, 0x3a
ja case.0x48fe0b.7
movzx eax, byte [eax + 0x490180]
jmp dword [eax*4 + 0x490154]
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov byte [edi + 0xbcf], 0x44
jmp 0x49003e
push 0x1f7
mov ecx, edi
call fcn.00470c40
cmp dword [0x6db9a4], 0x10
mov eax, 0x6db990
push 3
cmovae eax, dword [0x6db990]
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x49003e
push 0x1f7
mov ecx, edi
call fcn.00470c40
lea ecx, [edi + 0x301c8]
call fcn.0040c170
cmp dword [eax + 0x10], 0
je 0x49003e
lea ecx, [edi + 0x301c8]
call fcn.0040c170
push eax
lea ecx, [edi + 0x301c8]
call fcn.00408f90
sub esp, 0x18
mov ecx, esp
push 0x552a40
call fcn.00406c50
lea ecx, [edi + 0x301c8]
call fcn.00413100
jmp 0x49003e
push 0x1f7
mov ecx, edi
call fcn.00470c40
lea ecx, [edi + 0x301c8]
call fcn.0040c150
cmp dword [eax + 0x10], 0
je 0x49003e
lea ecx, [edi + 0x301c8]
call fcn.0040c150
push eax
lea ecx, [edi + 0x301c8]
call fcn.0040b8d0
jmp 0x49003e
push 0x1f7
mov ecx, edi
call fcn.00470c40
lea ecx, [edi + 0x301c8]
call fcn.0040b640
jmp 0x49003e
push 0x1f7
mov ecx, edi
call fcn.00470c40
lea ecx, [edi + 0x301c8]
call fcn.0040c1a0
cmp dword [eax + 0x10], 0
je 0x49003e
lea ecx, [edi + 0x301c8]
call fcn.0040c1a0
push eax
lea ecx, [edi + 0x301c8]
call fcn.00408d90
sub esp, 0x18
mov ecx, esp
push 0x552a40
call fcn.00406c50
lea ecx, [edi + 0x301c8]
call fcn.00412fa0
jmp 0x49003e
push 0x1f7
mov ecx, edi
call fcn.00470c40
lea ecx, [edi + 0x301c8]
call fcn.0040c130
cmp dword [eax + 0x10], 0
je 0x49003e
lea ecx, [edi + 0x301c8]
call fcn.0040c130
push eax
lea ecx, [edi + 0x301c8]
call fcn.0040b710
jmp 0x49003e
push 0x1f7
mov ecx, edi
call fcn.00470c40
lea ecx, [edi + 0x301c8]
call fcn.0040b610
jmp 0x49003e
push 0x1f7
mov ecx, edi
call fcn.00470c40
lea esi, [edi + 0x301c8]
push 0
mov ecx, esi
call fcn.004101c0
push 1
mov ecx, esi
call fcn.004101c0
push 2
mov ecx, esi
call fcn.004101c0
push 3
mov ecx, esi
call fcn.004101c0
push 4
mov ecx, esi
call fcn.004101c0
push 5
mov ecx, esi
call fcn.004101c0
push 6
mov ecx, esi
call fcn.004101c0
jmp 0x49003e
push 0x1f7
mov ecx, edi
call fcn.00470c40
lea ecx, [edi + 0x301c8]
call fcn.00404510
lea ecx, [edi + 0x301c8]
test al, al
je 0x490037
push 0
jmp 0x490039
push 1
call fcn.00412da0
mov byte [0x6e207e], 0
mov byte [0x6e207d], 0
mov byte [0x6e207c], 0
mov edx, dword [ebp - 0xc]
test dl, dl
je 0x490064
push 0x47
call fcn.004b0f30
add esp, 4
cmp byte [0x6e207c], 2
jne 0x4900b3
cmp byte [0x6e207e], 0
jne 0x4900b3
mov ecx, edi
call fcn.0048f480
mov ecx, ebx
call fcn.0048d0f0
add eax, 0xffffffe1
cmp eax, 3
ja 0x49009e
push 0
push 0
push 0x2b
push eax
lea ecx, [edi + 0x301c8]
call fcn.004131f0
mov byte [0x6e207c], 0
mov byte [0x6e207d], 0
mov byte [0x6e207e], 0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4