Function at 0x489b30
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x60
lea ebp, [esp - 4]
mov eax, dword [0x50e7dc]
xor eax, ebp
mov dword [ebp + 0x60], eax
push 0x54
mov eax, 0x4bcd33
call fcn.0049f542
xor esi, esi
push esi
lea ecx, [ebp + 0x44]
mov dword [ebp + 0x5c], 7
call fcn.00405ece
push str.AvgAvg8
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], esi
call fcn.00404bd0
xor ebx, ebx
inc ebx
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp]
mov byte [ebp - 4], bl
call fcn.004069e3
push esi
push ebx
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 3
call fcn.004058b3
mov edi, str.AvgDir
push edi
lea ecx, [ebp - 0x28]
call fcn.00404bd0
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 4
call fcn.00406d31
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp + 0x44]
mov byte [ebp - 4], 5
call fcn.00405301
push esi
push ebx
lea ecx, [ebp - 0x44]
call fcn.004058b3
push esi
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.004058b3
push str.AvgAvg9
lea ecx, [ebp - 0x28]
call fcn.00404bd0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 6
call fcn.004077e6
push esi
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.004058b3
push edi
lea ecx, [ebp - 0x28]
call fcn.00404bd0
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 7
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp]
call fcn.00406d31
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp + 0x44]
mov byte [ebp - 4], 8
call fcn.00405301
push esi
push ebx
lea ecx, [ebp - 0x44]
call fcn.004058b3
push esi
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.004058b3
push str.AvgAvg10
lea ecx, [ebp - 0x28]
call fcn.00404bd0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 9
call fcn.004077e6
push esi
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.004058b3
push edi
lea ecx, [ebp - 0x28]
call fcn.00404bd0
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 0xa
call fcn.00406d31
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp + 0x44]
mov byte [ebp - 4], 0xb
call fcn.00405301
push esi
push ebx
lea ecx, [ebp - 0x44]
call fcn.004058b3
push esi
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.004058b3
push str.AvgAvg2012
lea ecx, [ebp - 0x28]
call fcn.00404bd0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 0xc
call fcn.004077e6
push esi
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.004058b3
push edi
lea ecx, [ebp - 0x28]
call fcn.00404bd0
mov byte [ebp - 4], 0xd
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp]
call fcn.00406d31
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp + 0x44]
mov byte [ebp - 4], 0xe
call fcn.00405301
push esi
push ebx
lea ecx, [ebp - 0x44]
call fcn.004058b3
push esi
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.004058b3
push 0x4d51f0
lea ecx, [ebp + 0x44]
call fcn.00404d1c
test eax, eax
je 0x489da9
push str._avgui.exe
lea ecx, [ebp + 0x44]
call fcn.004052dd
cmp dword [ebp + 0x5c], 8
mov eax, dword [ebp + 0x48]
jae 0x489d6a
lea eax, [ebp + 0x48]
push ebx
push esi
push esi
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
lea ecx, [ebp]
call fcn.004017b6
push esi
push ebx
lea ecx, [ebp + 0x44]
call fcn.004058b3
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x60]
xor ecx, ebp
call fcn.0049f533
add ebp, 0x64
leave
ret
xor edi, edi
jmp 0x489d78