Function at 0x4908dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x490ce6
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jl case.default.0x490999
cmp esi, 5
jge 0x49098e
mov dl, 1
mov eax, dword [ebx + 0x2fc]
call fcn.0043cb3c
mov dl, 1
mov eax, dword [ebx + 0x300]
call fcn.0043cb3c
mov dl, 1
mov eax, dword [ebx + 0x304]
call fcn.0043cb3c
mov dl, 1
mov eax, dword [ebx + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov dl, 1
mov eax, dword [ebx + 0x300]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov dl, 1
mov eax, dword [ebx + 0x304]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov edx, dword [ebx + 0x3dc]
mov eax, dword [ebx + 0x2fc]
call fcn.0043cc4c
mov edx, dword [ebx + 0x3e0]
mov eax, dword [ebx + 0x300]
call fcn.0043cc4c
mov edx, dword [ebx + 0x3e8]
mov eax, dword [ebx + 0x304]
call fcn.0043cc4c
mov eax, esi
cmp eax, 6
ja case.default.0x490999
jmp dword [eax*4 + 0x4909a0]
mov edx, dword [ebx + 0x3ac]
mov eax, dword [ebx + 0x314]
call fcn.0043cc4c
mov edx, dword [ebx + 0x3c4]
mov eax, dword [ebx + 0x318]
call fcn.0043cc4c
mov edx, esi
mov eax, dword [ebx + 0x31c]
call fcn.0042e030
xor edx, edx
mov eax, dword [ebx + 0x2fc]
call fcn.0043cb3c
mov edx, esi
mov eax, dword [ebx + 0x31c]
call fcn.0042e030
jmp case.default.0x490999
mov edx, dword [ebx + 0x3b0]
mov eax, dword [ebx + 0x314]
call fcn.0043cc4c
mov edx, dword [ebx + 0x3c8]
mov eax, dword [ebx + 0x318]
call fcn.0043cc4c
mov eax, dword [ebx + 0x384]
mov edx, dword [eax]
call dword [edx + 0xc8]
mov edx, eax
mov eax, dword [ebx + 0x300]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov edx, esi
mov eax, dword [ebx + 0x31c]
call fcn.0042e030
jmp case.default.0x490999
mov edx, dword [ebx + 0x3b4]
mov eax, dword [ebx + 0x314]
call fcn.0043cc4c
mov edx, dword [ebx + 0x3cc]
mov eax, dword [ebx + 0x318]
call fcn.0043cc4c
mov edx, esi
mov eax, dword [ebx + 0x31c]
call fcn.0042e030
mov eax, dword [0x494f1c]
mov eax, dword [eax]
call fcn.0045c2e4
jmp case.default.0x490999
mov eax, ebx
call fcn.0048ffd0
test al, al
je case.default.0x490999
mov edx, dword [ebx + 0x3b8]
mov eax, dword [ebx + 0x314]
call fcn.0043cc4c
mov edx, dword [ebx + 0x3d0]
mov eax, dword [ebx + 0x318]
call fcn.0043cc4c
xor edx, edx
mov eax, dword [ebx + 0x2fc]
call fcn.0043cb3c
xor edx, edx
mov eax, dword [ebx + 0x300]
call fcn.0043cb3c
mov edx, esi
mov eax, dword [ebx + 0x31c]
call fcn.0042e030
mov eax, dword [0x494f1c]
mov eax, dword [eax]
call fcn.0045c2e4
mov eax, ebx
call fcn.004912e0
lea edx, [esi + 1]
mov eax, ebx
call fcn.004908dc
jmp case.default.0x490999
mov edx, dword [ebx + 0x3c0]
mov eax, dword [ebx + 0x314]
call fcn.0043cc4c
mov edx, dword [ebx + 0x3d8]
mov eax, dword [ebx + 0x318]
call fcn.0043cc4c
xor edx, edx
mov eax, dword [ebx + 0x2fc]
call fcn.0043cb3c
mov dl, 1
mov eax, dword [ebx + 0x300]
call fcn.0043cb3c
xor edx, edx
mov eax, dword [ebx + 0x304]
call fcn.0043cb3c
mov edx, esi
mov eax, dword [ebx + 0x31c]
call fcn.0042e030
mov eax, dword [0x494f1c]
mov eax, dword [eax]
call fcn.0045c2e4
jmp case.default.0x490999
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x394]
call fcn.0043cc1c
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x398]
call fcn.0043cc1c
mov eax, dword [ebp - 8]
push eax
lea edx, [ebp - 0xc]
mov eax, dword [ebx + 0x39c]
call fcn.0043cc1c
mov eax, dword [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 0x3a0]
call fcn.0043cc1c
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0x3a4]
call fcn.0043cc1c
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0x390]
call fcn.0043cc1c
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebx + 0x38c]
call fcn.0043cc1c
mov edx, dword [ebp - 0x1c]
mov eax, ebx
pop ecx
call fcn.004900d4
test al, al
je case.default.0x490999
mov eax, dword [ebx + 0x384]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x490c2c
mov eax, dword [0x494f1c]
mov eax, dword [eax]
call fcn.0045c2e4
mov eax, ebx
call fcn.00491fa4
mov edx, dword [ebx + 0x3bc]
mov eax, dword [ebx + 0x314]
call fcn.0043cc4c
mov edx, dword [ebx + 0x3d4]
mov eax, dword [ebx + 0x318]
call fcn.0043cc4c
xor edx, edx
mov eax, dword [ebx + 0x2fc]
call fcn.0043cb3c
xor edx, edx
mov eax, dword [ebx + 0x304]
call fcn.0043cb3c
mov edx, dword [ebx + 0x3e4]
mov eax, dword [ebx + 0x300]
call fcn.0043cc4c
mov edx, esi
mov eax, dword [ebx + 0x31c]
call fcn.0042e030
jmp case.default.0x490999
mov eax, dword [ebx + 0x348]
mov edx, dword [eax]
call dword [edx + 0x120]
test al, al
je 0x490cc4
push 5
push 0x490cf4
push 0x490cf4
mov eax, dword [ebx + 0x3a8]
call fcn.0040438c
push eax
push 0x490cf8
mov eax, ebx
call fcn.00443404
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, ebx
call fcn.00458cc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490ced
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00403ef0
ret