Function at 0x492040
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push eax
lea eax, [ebp - 8]
mov edi, ecx
push eax
mov ecx, esi
call fcn.0048c250
mov al, byte [0x6e207c]
cmp al, 1
jne 0x492747
mov ecx, edi
call fcn.0048f480
movzx eax, byte [esi + 0x971]
mov bl, 1
dec eax
mov byte [ebp + 0xb], bl
cmp eax, 0x28
ja case.0x492087.8
jmp dword [eax*4 + 0x492780]
mov byte [edi + 0xbcf], 0x45
jmp case.0x492087.3
mov byte [edi + 0xbcf], 0x46
jmp case.0x492087.3
mov byte [edi + 0xbcf], 0x48
jmp case.0x492087.3
mov byte [edi + 0xbcf], 0x49
jmp case.0x492087.3
mov byte [edi + 0xbcf], 0x4a
jmp case.0x492087.3
mov byte [edi + 0xbcf], 0x4b
jmp case.0x492087.3
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov dword [ebp + 8], 7
lea eax, [ebp + 8]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
movzx eax, byte [esi + 0x971]
push 1
push dword [esi + eax*4 + 0xc18]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0048eeb0
jmp case.0x492087.3
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov dword [ebp + 8], 8
jmp 0x4920e9
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov dword [ebp + 8], 9
jmp 0x4920e9
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov dword [ebp + 8], 0xa
jmp 0x4920e9
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov dword [ebp + 8], 0xb
jmp 0x4920e9
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov dword [ebp + 8], 0xc
jmp 0x4920e9
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov dword [ebp + 8], 0xd
jmp 0x4920e9
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov dword [ebp + 8], 0xe
jmp 0x4920e9
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov dword [ebp + 8], 0xf
jmp 0x4920e9
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov dword [ebp + 8], 0x10
jmp 0x4920e9
push 0x1e
lea ebx, [edi + 0x301c8]
push 0
mov ecx, ebx
call fcn.0040c1b0
mov ecx, ebx
test al, al
je 0x492214
push 0
push 0
push 0x1e
push 0
call fcn.004131f0
jmp 0x49244f
push 1
push 0
push 0x1e
push 0
call fcn.004131f0
jmp 0x49244f
push 0x1e
lea ebx, [edi + 0x301c8]
push 1
mov ecx, ebx
call fcn.0040c1b0
mov ecx, ebx
test al, al
je 0x49224f
push 0
push 0
push 0x1e
push 1
call fcn.004131f0
jmp 0x49244f
push 1
push 0
push 0x1e
push 1
call fcn.004131f0
jmp 0x49244f
push 0x1e
lea ebx, [edi + 0x301c8]
push 2
mov ecx, ebx
call fcn.0040c1b0
mov ecx, ebx
test al, al
je 0x49228a
push 0
push 0
push 0x1e
push 2
call fcn.004131f0
jmp 0x49244f
push 1
push 0
push 0x1e
push 2
call fcn.004131f0
jmp 0x49244f
push 0x1e
lea ebx, [edi + 0x301c8]
push 3
mov ecx, ebx
call fcn.0040c1b0
mov ecx, ebx
test al, al
je 0x4922c5
push 0
push 0
push 0x1e
push 3
call fcn.004131f0
jmp 0x49244f
push 1
push 0
push 0x1e
push 3
call fcn.004131f0
jmp 0x49244f
push 0x1e
lea ebx, [edi + 0x301c8]
push 4
mov ecx, ebx
call fcn.0040c1b0
mov ecx, ebx
test al, al
je 0x492300
push 0
push 0
push 0x1e
push 4
call fcn.004131f0
jmp 0x49244f
push 1
push 0
push 0x1e
push 4
call fcn.004131f0
jmp 0x49244f
push 0x1e
lea ebx, [edi + 0x301c8]
push 5
mov ecx, ebx
call fcn.0040c1b0
mov ecx, ebx
test al, al
je 0x49233b
push 0
push 0
push 0x1e
push 5
call fcn.004131f0
jmp 0x49244f
push 1
push 0
push 0x1e
push 5
call fcn.004131f0
jmp 0x49244f
push 0x1e
lea ebx, [edi + 0x301c8]
push 6
mov ecx, ebx
call fcn.0040c1b0
mov ecx, ebx
test al, al
je 0x492376
push 0
push 0
push 0x1e
push 6
call fcn.004131f0
jmp 0x49244f
push 1
push 0
push 0x1e
push 6
call fcn.004131f0
jmp 0x49244f
push 0x1e
lea ebx, [edi + 0x301c8]
push 7
mov ecx, ebx
call fcn.0040c1b0
mov ecx, ebx
test al, al
je 0x4923b1
push 0
push 0
push 0x1e
push 7
call fcn.004131f0
jmp 0x49244f
push 1
push 0
push 0x1e
push 7
call fcn.004131f0
jmp 0x49244f
push 0x1e
lea ebx, [edi + 0x301c8]
push 8
mov ecx, ebx
call fcn.0040c1b0
mov ecx, ebx
test al, al
je 0x4923e9
push 0
push 0
push 0x1e
push 8
call fcn.004131f0
jmp 0x49244f
push 1
push 0
push 0x1e
push 8
call fcn.004131f0
jmp 0x49244f
push 0x1e
lea ebx, [edi + 0x301c8]
push 9
mov ecx, ebx
call fcn.0040c1b0
mov ecx, ebx
test al, al
je 0x49241e
push 0
push 0
push 0x1e
push 9
call fcn.004131f0
jmp 0x49244f
push 1
push 0
push 0x1e
push 9
call fcn.004131f0
jmp 0x49244f
lea ebx, [edi + 0x301c8]
push 0x1d
mov ecx, ebx
call fcn.0040c2e0
mov ecx, ebx
test al, al
je 0x492446
push 0
jmp 0x492448
push 1
push 0x1d
call fcn.004133f0
mov bl, byte [ebp + 0xb]
mov byte [0x6e207e], 0
mov byte [0x6e207d], 0
mov byte [0x6e207c], 0
movzx eax, byte [esi + 0x972]
dec eax
cmp eax, 0x59
ja case.0x49247f.7
movzx eax, byte [eax + 0x49285c]
jmp dword [eax*4 + 0x492824]
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov byte [edi + 0xbcf], 0x44
mov byte [0x6e207c], 0
mov byte [0x6e207d], 0
mov byte [0x6e207e], 0
jmp case.0x49247f.7
push 0x1f7
mov ecx, edi
call fcn.00470c40
cmp dword [0x6db9a4], 0x10
mov eax, 0x6db990
push 3
cmovae eax, dword [0x6db990]
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x492499
push 0x1f7
mov ecx, edi
call fcn.00470c40
lea esi, [edi + 0x301c8]
push 0
mov ecx, esi
call fcn.004101c0
push 1
mov ecx, esi
call fcn.004101c0
push 2
mov ecx, esi
call fcn.004101c0
push 3
mov ecx, esi
call fcn.004101c0
push 4
mov ecx, esi
call fcn.004101c0
push 5
mov ecx, esi
call fcn.004101c0
push 6
mov ecx, esi
call fcn.004101c0
jmp 0x492499
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov al, byte [esi + 0x96c]
mov byte [ebp + 0xb], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 0xf
push eax
push dword [esi + 0xc44]
jmp 0x492709
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov al, byte [esi + 0x96c]
mov byte [ebp + 0xb], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 0x10
push eax
push dword [esi + 0xc48]
jmp 0x492709
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov al, byte [esi + 0x96c]
mov byte [ebp + 0xb], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 0x11
push eax
push dword [esi + 0xc4c]
jmp 0x492709
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov al, byte [esi + 0x96c]
mov byte [ebp + 0xb], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 0x12
push eax
push dword [esi + 0xc50]
jmp 0x492709
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov al, byte [esi + 0x96c]
mov byte [ebp + 0xb], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 0x13
push eax
push dword [esi + 0xc54]
jmp 0x492709
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov al, byte [esi + 0x96c]
mov byte [ebp + 0xb], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 0x14
push eax
push dword [esi + 0xc58]
jmp 0x492709
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov al, byte [esi + 0x96c]
mov byte [ebp + 0xb], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 0x15
push eax
push dword [esi + 0xc5c]
jmp 0x492709
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov al, byte [esi + 0x96c]
mov byte [ebp + 0xb], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 0x16
push eax
push dword [esi + 0xc60]
jmp 0x492709
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov al, byte [esi + 0x96c]
mov byte [ebp + 0xb], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 0x17
push eax
push dword [esi + 0xc64]
jmp 0x492709
push 0x1f7
mov ecx, edi
call fcn.00470c40
mov al, byte [esi + 0x96c]
mov byte [ebp + 0xb], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xb]
mov dword [ebp - 0xc], 0x18
push eax
push dword [esi + 0xc68]
lea eax, [ebp - 4]
mov ecx, edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.0048e920
xor edx, edx
movzx ecx, bl
test al, al
mov byte [0x6e207e], dl
mov byte [0x6e207d], dl
cmovne ecx, edx
mov byte [0x6e207c], dl
test cl, cl
je 0x492770
push 0x47
call fcn.004b0f30
mov al, byte [0x6e207c]
add esp, 4
cmp al, 2
jne 0x492770
cmp byte [0x6e207e], 0
jne 0x492770
mov ecx, edi
call fcn.0048f480
mov byte [0x6e207c], 0
mov byte [0x6e207d], 0
mov byte [0x6e207e], 0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4