Function at 0x49ffd4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd88
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4a02d7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4c5a28], 0
jle 0x4a02a9
cmp dword [0x4c5980], 0
jge 0x4a018b
mov bl, 1
mov edx, 0x4a02f4
mov eax, 0x80000001
call fcn.0049ff64
test al, al
jne 0x4a005c
mov edx, 0x4a0320
mov eax, 0x80000001
call fcn.0049ff64
test al, al
je 0x4a00a6
xor ebx, ebx
call fcn.00403414
mov edi, eax
test edi, edi
jle 0x4a00a6
mov esi, 1
lea edx, [ebp - 0x268]
mov eax, esi
call fcn.00403474
mov eax, dword [ebp - 0x268]
lea edx, [ebp - 0x264]
call fcn.0040bb80
mov eax, dword [ebp - 0x264]
mov edx, 0x4a0350
call fcn.0040694c
jne 0x4a00a2
mov bl, 1
jmp 0x4a00a6
inc esi
dec edi
jne 0x4a006e
test bl, bl
je 0x4a02a9
push 0x124f80
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x26c]
call fcn.004a0e1c
push dword [ebp - 0x26c]
push 0x4a0368
lea eax, [ebp - 0x270]
call fcn.0049fec8
push dword [ebp - 0x270]
push 0x4a0378
lea eax, [ebp - 8]
mov edx, 4
call fcn.004067a4
xor eax, eax
push ebp
push 0x4a017c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x260]
call fcn.00403834
mov edx, 1
lea eax, [ebp - 0x260]
call fcn.00403c7c
call fcn.004031fc
push 0
mov edx, dword [0x4c5a24]
mov ecx, dword [0x4c5a28]
lea eax, [ebp - 0x260]
call fcn.00403984
call fcn.004031fc
lea eax, [ebp - 0x260]
call fcn.004039a4
call fcn.004031fc
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004063bc
push eax
push 0x4a0384
mov eax, dword [0x4c5964]
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a02a9
lea eax, [ebp - 4]
mov edx, 0x4a039c
call fcn.00405594
call fcn.00403414
mov edi, eax
test edi, edi
jle 0x4a01eb
mov esi, 1
lea edx, [ebp - 0x278]
mov eax, esi
call fcn.00403474
mov eax, dword [ebp - 0x278]
lea edx, [ebp - 0x274]
call fcn.0040bb80
mov eax, dword [ebp - 0x274]
mov edx, 0x4a0350
call fcn.0040694c
jne 0x4a01e7
lea eax, [ebp - 4]
mov edx, 0x4a03b0
call fcn.00405594
jmp 0x4a01eb
inc esi
dec edi
jne 0x4a01a8
mov eax, dword [0x4c5a28]
call fcn.00403094
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a02a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [0x4c5a24]
mov ecx, dword [0x4c5a28]
call fcn.00403258
mov eax, dword [0x4c5a28]
cdq
push edx
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0048de0c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4a028c
mov eax, dword [ebp - 4]
call fcn.00405b70
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0048e1b0
mov ebx, eax
test ebx, ebx
je 0x4a0283
lea eax, [ebp - 8]
mov edx, dword [0x4c5958]
call fcn.00406384
mov eax, dword [ebp - 8]
call fcn.004063bc
push eax
mov eax, dword [0x4c5980]
push eax
xor edx, edx
mov eax, dword [0x4c594c]
call fcn.0040c790
push eax
mov eax, dword [0x4c5a28]
push eax
mov eax, dword [0x4c5a24]
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
call fcn.0048e3c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a02a9
mov eax, dword [ebp - 0xc]
call fcn.004030b0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a02de
lea eax, [ebp - 0x278]
mov edx, 6
call fcn.00406328
lea eax, [ebp - 8]
call fcn.00406320
lea eax, [ebp - 4]
call fcn.004054e4
ret