Function at 0x487ce0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x574
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x50c], 0x63
push 0x44
push 0
lea eax, [ebp - 0x574]
push eax
call fcn.004b6780
add esp, 0xc
mov dword [ebp - 0x574], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x530]
push ecx
call fcn.004b6780
add esp, 0xc
push str.updater_e_Lective.exe
mov edx, dword [ebp + 8]
push edx
call fcn.004b5ff0
add esp, 8
test eax, eax
jne 0x487d5b
push 0x4f062c
mov eax, dword [ebp + 8]
push eax
call fcn.004b5ff0
add esp, 8
test eax, eax
je 0x487e42
mov cl, byte [0x5507d6]
mov byte [ebp - 0x104], cl
push 0xfe
push 0
lea edx, [ebp - 0x103]
push edx
call fcn.004b6780
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x304]
push ecx
call fcn.004b5e60
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x404]
push eax
call fcn.004b5e60
add esp, 8
lea ecx, [ebp - 0x404]
push ecx
call fcn.0042e130
add esp, 4
push 0x4f063c
lea edx, [ebp - 0x304]
push edx
call fcn.004b5ff0
add esp, 8
mov dword [ebp - 0x510], eax
cmp dword [ebp - 0x510], 0
je 0x487e14
mov eax, dword [ebp - 0x510]
push eax
call fcn.004b5f60
add esp, 4
cmp eax, 5
jb 0x487e14
mov ecx, dword [ebp - 0x510]
add ecx, 5
push ecx
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e60
add esp, 8
mov eax, 1
shl eax, 2
mov ecx, dword [ebp - 0x510]
mov byte [ecx + eax], 0
push 1
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x304]
push ecx
push 0x4f0684
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, 1
jmp 0x487ff6
lea edx, [ebp - 0x530]
push edx
lea eax, [ebp - 0x574]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x508], eax
cmp dword [ebp + 0xc], 1
jne 0x487ff0
call fcn.0049f460
fstp dword [ebp - 0x518]
movss xmm0, dword [ebp - 0x518]
addss xmm0, dword [0x4cb9f0]
movss dword [ebp - 0x520], xmm0
lea edx, [ebp - 0x50c]
push edx
mov eax, dword [ebp - 0x530]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 0x508], eax
call fcn.00487320
cmp dword [ebp - 0x508], 0
jne 0x487efb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x51c], eax
mov ecx, dword [ebp - 0x51c]
push ecx
push str.GetExitCodeProcess_ld
lea edx, [ebp - 0x504]
push edx
call fcn.004b6e08
add esp, 0xc
lea eax, [ebp - 0x504]
push eax
push 0
call fcn.00440830
add esp, 8
cmp dword [ebp - 0x508], 0
je 0x487f30
cmp dword [ebp - 0x50c], 0x103
jne 0x487f30
call fcn.0049f460
fstp dword [ebp - 0x514]
movss xmm0, dword [ebp - 0x520]
comiss xmm0, dword [ebp - 0x514]
ja 0x487e9b
cmp dword [ebp - 0x50c], 0
jne 0x487f67
push str.e_Lective
mov ecx, dword [ebp + 8]
push ecx
call fcn.004b5ff0
add esp, 8
test eax, eax
jne 0x487f58
push 0x64
call fcn.00481890
add esp, 4
mov eax, 1
jmp 0x487ff6
mov edx, dword [ebp - 0x50c]
push edx
mov eax, dword [ebp - 0x508]
push eax
push str.GetExitCodeProcess_d__d
lea ecx, [ebp - 0x204]
push ecx
call fcn.004b6e08
add esp, 0x10
lea edx, [ebp - 0x204]
push edx
push 0
call fcn.00440830
add esp, 8
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x508], 0x20
jge 0x487fe3
mov ecx, dword [ebp - 0x508]
push ecx
push str.WinExec_d
lea edx, [ebp - 0x204]
push edx
call fcn.004b6e08
add esp, 0xc
lea eax, [ebp - 0x204]
push eax
push 0
call fcn.00440830
add esp, 8
jmp 0x487fea
mov eax, 1
jmp 0x487ff6
xor eax, eax
jmp 0x487ff6
mov eax, dword [ebp - 0x508]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret