Function at 0x48df90
Capabilities:
Create process on windows
Create process suspended
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x4df798]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x284], ecx
mov byte [ebp - 0x279], 0
lea eax, [ebp - 0x279]
push eax
movzx ecx, byte [0x535744]
push ecx
mov ecx, 0x52e1e4
call fcn.0047c280
test eax, eax
jne 0x48dff8
movzx edx, byte [0x535744]
and edx, 0xffff
movzx eax, dx
push eax
push 0xcaca0001
push 0x111
mov ecx, dword [ebp - 0x284]
call fcn.00403b10
jmp 0x48e248
push 0
push 0
movzx ecx, byte [0x535744]
push ecx
mov ecx, dword [ebp - 0x284]
call fcn.0048b510
xor edx, edx
mov word [ebp - 0x218], dx
push 0x1fe
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.00451f70
add esp, 0xc
mov dword [ebp - 0x278], 0
push 0x40
push 0
lea ecx, [ebp - 0x274]
push ecx
call fcn.00451f70
add esp, 0xc
mov dword [ebp - 0x230], 0
xor edx, edx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x278], 0x44
xor eax, eax
mov word [ebp - 0x248], ax
push 0x535544
movzx ecx, byte [0x535744]
push ecx
push str.NvFlash.exe
push str._s___index_d__4__5__6___s
lea edx, [ebp - 0x218]
push edx
call fcn.00452ec3
add esp, 0x14
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x14], 2
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov cx, word [ebp - 6]
mov word [ebp - 0x220], cx
lea edx, [ebp - 0x230]
push edx
lea eax, [ebp - 0x278]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x48e10b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x280], eax
jmp 0x48e1e0
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
call fcn.004745a0
add esp, 8
cmp dword [ebp - 0x21c], 0
jne 0x48e14c
jmp 0x48e1e0
push 0
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x535748
call fcn.00404930
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x230]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x48e1e0
push 0x320
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0x59
push pe_nt_image_headers32
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 6]
movzx edx, word [ebp - 0x220]
cmp ecx, edx
jge 0x48e1bf
movzx eax, word [ebp - 6]
add eax, 0x3c
mov word [ebp - 6], ax
movzx ecx, word [ebp - 6]
movzx edx, word [ebp - 0x220]
sub ecx, edx
cmp ecx, 3
jle 0x48e1d3
jmp 0x48e1e0
cmp dword [ebp - 0x14], 0x103
je 0x48e1de
jmp 0x48e1e0
jmp 0x48e165
mov eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push 0
movzx ecx, byte [0x535744]
push ecx
mov ecx, dword [ebp - 0x284]
call fcn.0048b510
push 0
push 0
push 2
mov ecx, 0x535748
call fcn.00403b10
movzx edx, byte [0x535744]
and edx, 0xffff
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x14]
and ecx, 0xffff
movzx edx, cx
or edx, 0xcaca0000
push edx
push 0x111
mov ecx, dword [ebp - 0x284]
call fcn.00403b10
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00451600
mov esp, ebp
pop ebp
ret