Function at 0x490d90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push ebx
mov ebx, dword [ebp + 8]
push edi
push eax
lea eax, [ebp - 0xc]
mov edi, ecx
push eax
mov ecx, ebx
call fcn.0048c250
mov cl, byte [0x6e207c]
cmp cl, 1
jne case.0x490fc2.8
push esi
mov ecx, edi
call fcn.0048f480
movzx eax, byte [ebx + 0x972]
dec eax
cmp eax, 0x3a
ja case.0x490ddb.7
movzx eax, byte [eax + 0x491194]
jmp dword [eax*4 + 0x49117c]
push 0x1f7
mov ecx, edi
call fcn.00470c40
xor cl, cl
mov byte [edi + 0xbcf], 0x44
mov byte [0x6e207c], cl
mov byte [0x6e207d], cl
mov byte [0x6e207e], cl
jmp 0x490fa9
push 0x1f7
mov ecx, edi
call fcn.00470c40
cmp dword [0x6db9a4], 0x10
mov eax, 0x6db990
push 3
cmovae eax, dword [0x6db990]
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor cl, cl
mov byte [0x6e207c], cl
mov byte [0x6e207d], cl
mov byte [0x6e207e], cl
jmp 0x490fa9
push 0x1f7
mov ecx, edi
call fcn.00470c40
cmp byte [edi + 0x301c9], 0
je 0x490ea1
cmp byte [edi + 0x305a1], 0
je 0x490ea1
lea ecx, [edi + 0x301c8]
call fcn.00420470
test al, al
je 0x490ec8
push 0
lea ecx, [edi + 0x301c8]
call fcn.00412e30
mov ecx, dword [0x589d90]
call fcn.00422af0
jmp 0x490ec8
cmp dword [edi + 0x16a40], 0x404
jne 0x490ebb
push 0x55b41c
mov ecx, edi
call fcn.00437f70
jmp 0x490ec8
push 1
lea ecx, [edi + 0x301c8]
call fcn.00412e30
xor cl, cl
mov byte [0x6e207c], cl
mov byte [0x6e207d], cl
mov byte [0x6e207e], cl
jmp 0x490fa9
push 0x1f7
mov ecx, edi
call fcn.00470c40
lea esi, [edi + 0x301c8]
push 0
mov ecx, esi
call fcn.004101c0
push 1
mov ecx, esi
call fcn.004101c0
push 2
mov ecx, esi
call fcn.004101c0
push 3
mov ecx, esi
call fcn.004101c0
push 4
mov ecx, esi
call fcn.004101c0
push 5
mov ecx, esi
call fcn.004101c0
push 6
mov ecx, esi
call fcn.004101c0
xor cl, cl
mov byte [0x6e207c], cl
mov byte [0x6e207d], cl
mov byte [0x6e207e], cl
jmp 0x490fa9
push 0x1f7
mov ecx, edi
call fcn.00470c40
lea ecx, [edi + 0x301c8]
call fcn.0040c9a0
test al, al
je 0x490f75
push 0
lea ecx, [edi + 0x301c8]
call fcn.00412d10
jmp 0x490ec8
cmp byte [edi + 0xb23], 0
je 0x490f91
push str._pkmode_peace
mov ecx, edi
mov byte [edi + 0xb23], 0
call fcn.0042e8b0
push 1
lea ecx, [edi + 0x301c8]
call fcn.00412d10
jmp 0x490ec8
mov cl, byte [0x6e207c]
movzx eax, byte [ebx + 0x971]
dec eax
pop esi
cmp eax, 0x27
ja case.0x490fc2.8
movzx eax, byte [eax + 0x49121c]
jmp dword [eax*4 + 0x4911d0]
mov byte [edi + 0xbcf], 0x45
jmp case.0x490fc2.4
mov byte [edi + 0xbcf], 0x46
jmp case.0x490fc2.4
mov byte [edi + 0xbcf], 0x47
jmp case.0x490fc2.4
mov byte [edi + 0xbcf], 0x49
jmp case.0x490fc2.4
mov byte [edi + 0xbcf], 0x4a
jmp case.0x490fc2.4
mov byte [edi + 0xbcf], 0x4b
jmp case.0x490fc2.4
push 0x1f7
mov ecx, edi
call fcn.00470c40
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x11
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
movzx eax, byte [ebx + 0x971]
mov ecx, edi
push 1
push dword [ebx + eax*4 + 0xc18]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0048eeb0
jmp case.0x490fc2.4
add edi, 0x301c8
push 0x24
mov ecx, edi
call fcn.0040c2e0
mov ecx, edi
test al, al
je 0x49107a
push 0
push 0x24
call fcn.004133f0
jmp case.0x490fc2.4
push 1
push 0x24
call fcn.004133f0
jmp case.0x490fc2.4
add edi, 0x301c8
push 0x26
mov ecx, edi
call fcn.0040c2e0
mov ecx, edi
test al, al
je 0x4910ab
push 0
push 0x26
call fcn.004133f0
jmp case.0x490fc2.4
push 1
push 0x26
call fcn.004133f0
jmp case.0x490fc2.4
push 0
push 0x21
lea ecx, [edi + 0x301c8]
call fcn.004135a0
jmp case.0x490fc2.4
push 1
push 0x21
lea ecx, [edi + 0x301c8]
call fcn.004135a0
jmp case.0x490fc2.4
push 2
push 0x21
lea ecx, [edi + 0x301c8]
call fcn.004135a0
jmp case.0x490fc2.4
push 3
push 0x21
lea ecx, [edi + 0x301c8]
call fcn.004135a0
jmp case.0x490fc2.4
push 4
push 0x21
lea ecx, [edi + 0x301c8]
call fcn.004135a0
jmp case.0x490fc2.4
push 5
push 0x21
lea ecx, [edi + 0x301c8]
call fcn.004135a0
jmp case.0x490fc2.4
push 6
push 0x21
lea ecx, [edi + 0x301c8]
call fcn.004135a0
jmp case.0x490fc2.4
push 7
push 0x21
lea ecx, [edi + 0x301c8]
call fcn.004135a0
jmp case.0x490fc2.4
cmp cl, 2
jne 0x49116e
cmp byte [0x6e207e], 0
jne 0x49116e
mov ecx, edi
call fcn.0048f480
mov byte [0x6e207c], 0
mov byte [0x6e207d], 0
mov byte [0x6e207e], 0
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4