Function at 0x498580
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x498588
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x498a58
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00403384
lea eax, [ebp - 8]
mov edx, 0x498a70
call fcn.004052d8
mov eax, 0x18
call fcn.004033ac
mov edx, eax
inc edx
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004368ec
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov edx, 1
call fcn.00436924
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.004052d8
mov eax, 0x270f
call fcn.004033ac
lea edx, [ebp - 0x2c]
call fcn.00409a88
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00491924
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x18]
call fcn.0049199c
mov eax, dword [ebp - 0x18]
push eax
mov eax, 5
call fcn.004033ac
mov edx, eax
inc edx
lea ecx, [ebp - 0x14]
pop eax
call fcn.004368ec
mov edx, dword [ebp - 0x14]
mov eax, 0x52b120
call fcn.00405294
push dword [ebp - 8]
push 0x498a94
push dword [0x52b120]
push 0x498aa0
mov eax, 0x52b120
mov edx, 4
call fcn.004055d4
mov eax, 0x270f
call fcn.004033ac
lea edx, [ebp - 0x38]
call fcn.00409a88
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x28]
call fcn.00491924
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x34]
call fcn.0049199c
mov eax, dword [ebp - 0x34]
push eax
mov eax, 0x14
call fcn.004033ac
mov edx, eax
add edx, 0xa
lea ecx, [ebp - 0x30]
pop eax
call fcn.004368ec
mov edx, dword [ebp - 0x30]
mov eax, 0x52b124
call fcn.00405294
push dword [0x52b120]
push dword [0x52b124]
lea edx, [ebp - 0x3c]
mov eax, dword [0x52b058]
call fcn.00497c30
push dword [ebp - 0x3c]
lea eax, [ebp - 4]
mov edx, 3
call fcn.004055d4
mov eax, dword [0x52b054]
mov edx, 0x498aac
call fcn.00405668
jne 0x498a20
mov eax, dword [0x52b0c0]
mov edx, 0x498ab8
call fcn.00405668
jne 0x4986fb
call fcn.00496d38
lea edx, [ebp - 0x40]
mov eax, dword [0x5240f0]
mov eax, dword [eax]
call fcn.00468fb8
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 4]
call fcn.00498208
lea eax, [ebp - 0x44]
mov edx, dword [ebp - 4]
call fcn.00405b98
mov ecx, dword [ebp - 0x44]
mov eax, dword [0x52b050]
mov eax, dword [eax + 0x378]
mov edx, 0x66
call fcn.0046f474
mov eax, dword [0x52b050]
mov eax, dword [eax + 0x378]
call fcn.00490dd8
cmp dword [0x52b0b4], 0
je 0x4987a8
cmp dword [0x52b0b8], 0
je 0x4987a8
xor eax, eax
push ebp
push 0x49879e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x52b0b8]
call fcn.00409bc4
mov edx, eax
mov eax, dword [0x52b050]
call fcn.0044a344
mov eax, dword [0x52b0b4]
call fcn.00409bc4
mov edx, eax
mov eax, dword [0x52b050]
call fcn.0044a378
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4987a8
mov eax, dword [0x52b100]
mov edx, 0x498ac4
call fcn.00405668
jne 0x4987c5
mov dl, 3
mov eax, dword [0x52b050]
call fcn.004612fc
mov eax, dword [0x524258]
cmp dword [eax], 0
je 0x498867
xor eax, eax
push ebp
push 0x49885d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x52b050]
call fcn.0045ffe0
mov ebx, eax
mov eax, dword [0x52b09c]
call fcn.00409bc4
add ebx, eax
mov edx, ebx
mov eax, dword [0x5240a4]
mov eax, dword [eax]
call fcn.00465610
mov eax, dword [0x52b050]
call fcn.00460000
mov ebx, eax
mov eax, dword [0x52b0a0]
call fcn.00409bc4
add ebx, eax
mov edx, ebx
mov eax, dword [0x5240a4]
mov eax, dword [eax]
call fcn.0046564c
mov edx, dword [0x524258]
mov edx, dword [edx]
mov eax, dword [0x5240a4]
mov eax, dword [eax]
mov eax, dword [eax + 0x360]
call fcn.0044ac8c
mov eax, dword [0x5240a4]
mov eax, dword [eax]
call fcn.00464c0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x498867
mov eax, dword [0x52b050]
mov eax, dword [eax + 0x368]
mov dl, 1
call fcn.0043a56c
mov eax, dword [0x52b050]
mov eax, dword [eax + 0x364]
mov dl, 1
call fcn.0043a56c
cmp dword [0x52b0d4], 0
je 0x4988bf
mov eax, dword [0x52b0d4]
mov edx, 0x498ad0
call fcn.00405668
je 0x4988bf
push 1
push 0
push 0
mov eax, dword [0x52b0d4]
call fcn.004056d0
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
lea edx, [ebp - 0x48]
mov eax, dword [0x52b050]
mov eax, dword [eax + 0x370]
call fcn.0044ac5c
mov edx, dword [ebp - 0x48]
mov eax, 0x498ae0
call fcn.0040581c
test eax, eax
jg 0x4988ef
mov eax, dword [0x5240f0]
mov eax, dword [eax]
call fcn.00468950
mov eax, dword [0x52b050]
mov eax, dword [eax + 0x370]
mov edx, 0xc0
call fcn.0044a344
mov eax, dword [0x52b050]
mov eax, dword [eax + 0x370]
mov edx, 0x11
call fcn.0044a378
mov eax, dword [0x52b050]
mov eax, dword [eax + 0x370]
mov dl, 1
call fcn.0044ab7c
mov eax, dword [0x52b0bc]
mov edx, 0x498aec
call fcn.00405668
jne 0x4989c2
mov eax, dword [0x52b050]
mov eax, dword [eax + 0x378]
xor ecx, ecx
mov edx, 0x78
call fcn.0046efd8
xor edx, edx
mov eax, dword [0x52b050]
call fcn.00461958
xor edx, edx
mov eax, dword [0x52b050]
call fcn.004612fc
mov eax, dword [0x52b050]
mov eax, dword [eax + 0x37c]
xor edx, edx
call fcn.0044a378
mov dl, 2
mov eax, dword [0x52b050]
call fcn.00461df8
mov eax, dword [0x52b050]
mov eax, dword [eax + 0x378]
call fcn.0044b248
mov eax, dword [0x52b050]
mov eax, dword [eax + 0x378]
call fcn.0044b250
mov eax, dword [0x52b050]
mov eax, dword [eax + 0x378]
mov edx, dword [eax]
call dword [edx + 0xd4]
jmp 0x4989e3
mov eax, dword [0x52b0bc]
call fcn.00409bc4
mov ecx, eax
mov eax, dword [0x52b050]
mov eax, dword [eax + 0x378]
mov edx, 0x78
call fcn.0046efd8
mov eax, dword [0x52b090]
mov edx, 0x498ab8
call fcn.00405668
jne 0x498a20
xor eax, eax
push ebp
push 0x498a16
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0043d0d0
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x498a20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498a5f
lea eax, [ebp - 0x48]
call fcn.00405240
lea eax, [ebp - 0x44]
call fcn.00405a48
lea eax, [ebp - 0x40]
mov edx, 6
call fcn.00405264
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00405264
ret