Function at 0x496bc4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x496bcc
push ebx
mov eax, 0x494e14
call fcn.00406d4c
xor eax, eax
push ebp
push 0x496ef4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x4a0ce4], 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4945ac]
call fcn.004946f8
mov dword [0x4a0d00], eax
xor eax, eax
push ebp
push 0x496ea2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [0x49ac70]
mov eax, dword [eax]
call fcn.0046319c
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
mov edx, 0x496f0c
call fcn.00409ad8
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x423c14]
call fcn.00423ccc
mov dword [0x4a0ce8], eax
xor eax, eax
push ebp
push 0x496e83
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x496f1c
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x496f38
mov edx, 0x496f4c
mov eax, dword [0x4a0ce8]
mov ebx, dword [eax]
call dword [ebx]
mov edx, dword [ebp - 0x1c]
mov eax, 0x4a0cec
call fcn.00404bc0
push 0x496f60
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x496f78
mov edx, 0x496f8c
mov eax, dword [0x4a0ce8]
mov ebx, dword [eax]
call dword [ebx]
mov edx, dword [ebp - 0x20]
mov eax, 0x4a0cfc
call fcn.00404bc0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x496fa0
mov edx, 0x496fb0
mov eax, dword [0x4a0ce8]
mov ebx, dword [eax]
call dword [ebx]
mov edx, dword [ebp - 0x24]
mov eax, 0x4a0cf0
call fcn.00404bc0
lea eax, [ebp - 0x28]
mov ecx, 0x496fc4
mov edx, dword [0x4a0cec]
call fcn.00404e84
mov edx, dword [ebp - 0x28]
mov eax, dword [0x4a0d00]
call fcn.00494918
lea edx, [ebp - 0x2c]
mov eax, dword [0x4a0d00]
call fcn.00494894
mov edx, dword [ebp - 0x2c]
mov eax, 0x4a0cf8
call fcn.00404bc0
lea eax, [ebp - 0x30]
mov ecx, 0x496fec
mov edx, dword [0x4a0cec]
call fcn.00404e84
mov edx, dword [ebp - 0x30]
mov eax, dword [0x4a0d00]
call fcn.004948f0
mov eax, 0x4a0cf4
mov edx, 0x497014
call fcn.00404bc0
mov eax, dword [0x4a0cf8]
mov edx, dword [0x4a0cfc]
call fcn.00404f94
jbe 0x496e6b
mov eax, dword [0x4a0cf0]
call fcn.00494c70
test al, al
je 0x496d84
lea eax, [ebp - 0x34]
mov ecx, 0x497028
mov edx, dword [0x4a0cf0]
call fcn.00404e84
mov eax, dword [ebp - 0x34]
call fcn.00435bf4
call fcn.0040458c
call fcn.0040458c
jmp 0x496ed9
mov eax, dword [0x49abe4]
mov edx, dword [0x4a0cf4]
call fcn.00404bc0
lea eax, [ebp - 0x38]
mov ecx, 0x497064
mov edx, dword [0x4a0cec]
call fcn.00404e84
mov edx, dword [ebp - 0x38]
mov eax, dword [0x4a0d00]
call fcn.00494748
lea edx, [ebp - 0x40]
mov eax, dword [0x49ac70]
mov eax, dword [eax]
call fcn.0046319c
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.00409b6c
mov edx, dword [ebp - 0x3c]
mov eax, 0x4a0cf4
mov ecx, dword [0x4a0cf4]
call fcn.00404e84
mov eax, dword [0x4a0cf4]
call fcn.004099e4
test al, al
je 0x496e4f
mov byte [0x4a0ce4], 1
push 5
mov eax, dword [0x4a0cf4]
call fcn.00404ffc
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x4a0cf8]
mov edx, 0x497084
call fcn.00404f94
jne 0x496e29
mov eax, 0x4a0cf8
mov edx, dword [0x4a0cfc]
call fcn.00404bc0
mov eax, dword [0x4a0cf8]
push eax
mov ecx, 0x496f78
mov edx, 0x496f8c
mov eax, dword [0x4a0ce8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [0x4a0ce8]
mov edx, dword [eax]
call dword [edx + 0x58]
jmp 0x496e6b
push 0x40
push 0x497088
push 0x497090
mov eax, dword [0x49ac70]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496e8a
mov eax, dword [0x4a0ce8]
call fcn.00403c6c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496efb
lea eax, [ebp - 0x40]
mov edx, 0xc
call fcn.00404b90
ret