Function at 0x49e768
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x49e770
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x49eabc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x23824], 0
je 0x49e7a4
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x23824]
call fcn.00408af0
jmp 0x49e7fb
call fcn.0042b68c
lea edx, [ebp - 0x1c]
call fcn.0042b2ac
mov eax, dword [ebx + 0x44c]
call fcn.004272fc
call fcn.0042b68c
lea edx, [ebp - 0x20]
call fcn.0042b2ac
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 4]
call fcn.00408af0
call fcn.0042b68c
mov edx, dword [ebp - 0x1c]
call fcn.0042b32c
mov eax, dword [ebx + 0x44c]
mov edx, dword [eax]
call dword [edx + 0xb8]
test eax, eax
jne 0x49e7fb
lea eax, [ebp - 4]
call fcn.00403af0
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00408af0
cmp dword [ebp - 0x24], 0
jne 0x49e819
lea eax, [ebp - 4]
mov edx, 0x49ead4
call fcn.00403b88
lea eax, [ebp - 8]
push eax
mov ecx, 7
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00403f78
lea eax, [ebp - 0xc]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00403f78
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 8]
call fcn.00408954
mov eax, dword [ebp - 0x28]
mov edx, 0x49eafc
call fcn.00403e80
jne 0x49e885
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403f34
push eax
push 0
mov eax, dword [0x4ada04]
call fcn.004366f4
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x49ea96
mov eax, dword [ebx + 0x408]
cmp byte [eax + 0x2c], 0
jne 0x49e8eb
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 8]
call fcn.00408954
mov eax, dword [ebp - 0x2c]
mov edx, 0x49eb0c
call fcn.00403e80
je 0x49e8c5
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0xc]
call fcn.00408954
mov eax, dword [ebp - 0x30]
mov edx, 0x49eb1c
call fcn.00403e80
jne 0x49e8eb
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403f34
push eax
push 0
mov eax, dword [0x4ada04]
call fcn.004366f4
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x49ea96
lea eax, [ebp - 0x18]
call fcn.00403af0
lea eax, [ebp - 0x18]
call fcn.00403af0
mov dl, 1
mov eax, dword [0x45f708]
call fcn.0045f808
mov esi, eax
mov edx, 0x80000000
mov eax, esi
call fcn.0045f8a8
xor ecx, ecx
mov edx, 0x49eb2c
mov eax, esi
call fcn.0045f90c
test al, al
je 0x49e977
lea ecx, [ebp - 0x10]
xor edx, edx
mov eax, esi
call fcn.0045fad4
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x10]
call fcn.00408954
mov edx, dword [ebp - 0x34]
mov eax, 0x49eb54
call fcn.0040405c
mov edi, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [edi + 2]
mov edx, 2
mov eax, dword [ebp - 0x10]
call fcn.00403f78
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.0040902c
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00408ff8
mov eax, esi
call fcn.0045f878
mov eax, esi
call fcn.00402e68
cmp dword [ebp - 0x18], 0
je 0x49ea4b
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 8]
call fcn.00408954
mov eax, dword [ebp - 0x38]
mov edx, 0x49eb0c
call fcn.00403e80
je 0x49e9c3
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00408954
mov eax, dword [ebp - 0x3c]
mov edx, 0x49eb1c
call fcn.00403e80
jne 0x49e9fa
push 3
mov eax, dword [ebp - 0x14]
call fcn.00403f34
push eax
mov eax, dword [ebp - 4]
call fcn.00403f34
push eax
mov eax, dword [ebp - 0x18]
call fcn.00403f34
push eax
push 0x49eb5c
mov eax, dword [0x4ada04]
call fcn.004366f4
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x49ea96
lea ecx, [ebp - 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004a12a4
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 4]
mov edx, 0x49eb6c
call fcn.00403dbc
push 3
mov eax, dword [ebp - 0x14]
call fcn.00403f34
push eax
mov eax, dword [ebp - 4]
call fcn.00403f34
push eax
mov eax, dword [ebp - 0x18]
call fcn.00403f34
push eax
push 0x49eb5c
mov eax, dword [0x4ada04]
call fcn.004366f4
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x49ea96
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 8]
call fcn.00408954
mov eax, dword [ebp - 0x44]
mov edx, 0x49eb0c
call fcn.00403e80
je 0x49ea75
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x49eb0c
call fcn.00403dbc
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403f34
push eax
push 0
mov eax, dword [0x4ada04]
call fcn.004366f4
push eax
call sub.shell32.dll_ShellExecuteA
lea eax, [ebx + 0x23824]
call fcn.00403af0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49eac3
lea eax, [ebp - 0x44]
mov edx, 0x11
call fcn.00403b14
ret