Function at 0x489644
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x48964c
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004045bc
xor eax, eax
push ebp
push 0x489940
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x489958
call fcn.00404518
jne 0x4896b0
cmp byte [ebx + 0x338], 0
je 0x48969a
call fcn.00489614
mov byte [ebx + 0x338], 0
jmp 0x489918
mov eax, dword [ebx + 0x2fc]
call fcn.00472bd8
mov eax, dword [ebx + 0x2fc]
call fcn.00472eb0
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00489524
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 8]
call fcn.0040823c
mov edx, dword [ebp - 8]
mov eax, 0x48996c
call fcn.00404710
mov esi, eax
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x314]
call fcn.00439098
test esi, esi
jle 0x489765
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.004043cc
mov ecx, eax
sub ecx, esi
sub ecx, 4
lea edx, [esi + 5]
mov eax, dword [ebp - 8]
call fcn.0040462c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x10]
call fcn.0040823c
mov eax, dword [ebp - 0x10]
call fcn.00408844
test al, al
je 0x489918
xor edx, edx
mov eax, dword [ebx + 0x2f8]
call fcn.00438f88
xor edx, edx
mov eax, dword [ebx + 0x324]
call fcn.00438f88
xor edx, edx
mov eax, dword [ebx + 0x320]
call fcn.00438f88
mov byte [ebx + 0x338], 1
push 1
mov eax, dword [ebp - 8]
call fcn.004045cc
push eax
call sub.kernel32.dll_WinExec
jmp 0x489918
call fcn.00489614
mov eax, dword [ebp - 8]
call fcn.00408844
test al, al
je 0x489918
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00408964
mov eax, dword [ebp - 0xc]
mov edx, 0x48997c
call fcn.00404518
jne 0x4897b7
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.0040892c
lea eax, [ebp - 0x1c]
mov edx, 0x48998c
call fcn.004043d4
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.00408854
mov eax, dword [ebp - 0xc]
mov edx, 0x48999c
call fcn.00404518
jne 0x489824
mov eax, dword [ebx + 0x2fc]
call fcn.00472eb0
xor edx, edx
mov eax, dword [ebx + 0x324]
call fcn.00438f88
xor edx, edx
mov eax, dword [ebx + 0x320]
call fcn.00438f88
mov dl, 1
mov eax, dword [ebx + 0x2f8]
call fcn.00438f88
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 8]
call fcn.00404938
mov ecx, dword [ebp - 0x20]
mov edx, 0x66
mov eax, dword [ebx + 0x2f8]
call fcn.0046b7b8
mov eax, dword [ebx + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0xc4]
mov eax, dword [ebp - 0xc]
mov edx, 0x48998c
call fcn.00404518
jne 0x489889
mov dl, 1
mov eax, dword [ebx + 0x324]
call fcn.00438f88
mov eax, dword [ebx + 0x2fc]
call fcn.00472eb0
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 8]
call fcn.00404938
mov edx, dword [ebp - 0x24]
mov eax, dword [ebx + 0x2fc]
call fcn.0047312c
mov eax, dword [ebx + 0x2fc]
call fcn.00472b44
xor edx, edx
mov eax, dword [ebx + 0x320]
call fcn.00438f88
xor edx, edx
mov eax, dword [ebx + 0x2f8]
call fcn.00438f88
mov eax, dword [ebp - 0xc]
mov edx, 0x4899ac
call fcn.00404518
je 0x4898a7
mov eax, dword [ebp - 0xc]
mov edx, 0x4899bc
call fcn.00404518
jne 0x489918
xor edx, edx
mov eax, dword [ebx + 0x324]
call fcn.00438f88
xor edx, edx
mov eax, dword [ebx + 0x2f8]
call fcn.00438f88
mov eax, dword [ebx + 0x2fc]
call fcn.00472eb0
mov dl, 1
mov eax, dword [ebx + 0x320]
call fcn.00438f88
mov dl, 1
mov eax, dword [ebx + 0x310]
call fcn.00438f88
mov eax, dword [ebx + 0x334]
mov edx, dword [ebp - 8]
call fcn.00404518
je 0x489918
lea eax, [ebx + 0x334]
mov edx, dword [ebp - 8]
call fcn.00404160
mov eax, dword [ebx + 0x310]
mov eax, dword [eax + 0x168]
mov edx, dword [ebp - 8]
call fcn.00424e6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489947
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404804
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404130
ret