Function at 0x49106c
Capabilities:
Create process on windows
Print debug messages
Schedule task via at

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xe
push 0
push 0
dec ecx
jne 0x491074
mov eax, 0x490c84
call fcn.00406b60
xor eax, eax
push ebp
push 0x491762
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402bec
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00409aa8
lea eax, [ebp - 0x14]
mov edx, 0x491778
call fcn.00404ab0
mov eax, dword [ebp - 0x14]
call fcn.00409664
mov edx, dword [0x494818]
mov byte [edx], al
mov eax, dword [0x494818]
cmp byte [eax], 0
je 0x4912b1
push 0x40
push 0x491780
push 0x491788
mov eax, dword [0x494730]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_MessageBoxA_1
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x4917c8
mov edx, 0x4917fc
mov eax, 0x491834
call fcn.00430438
mov edx, dword [ebp - 0x1c]
mov eax, 0x496034
call fcn.0040483c
push 0x496040
mov ecx, 0x49603c
mov edx, 0x496038
mov eax, dword [0x496034]
call fcn.0048d09c
mov eax, dword [0x494830]
mov edx, dword [0x496034]
call fcn.0040483c
mov eax, dword [0x4948f4]
mov edx, 0x491854
call fcn.0040483c
mov eax, dword [0x494840]
mov edx, dword [0x496038]
call fcn.0040483c
mov eax, dword [0x4946a8]
mov edx, dword [0x496040]
call fcn.0040483c
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x491868
mov edx, 0x491878
mov eax, 0x49188c
call fcn.00430438
mov edx, dword [ebp - 0x20]
mov eax, 0x496034
call fcn.0040483c
mov eax, dword [0x4943ec]
mov edx, dword [0x496034]
call fcn.0040483c
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x4918ac
mov edx, 0x4918c4
mov eax, 0x4918dc
call fcn.00430438
mov edx, dword [ebp - 0x24]
mov eax, 0x496034
call fcn.0040483c
mov eax, dword [0x494594]
mov edx, dword [0x496034]
call fcn.0040483c
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x4918f4
mov edx, 0x491904
mov eax, 0x491914
call fcn.00430438
mov edx, dword [ebp - 0x28]
mov eax, 0x496034
call fcn.0040483c
xor edx, edx
mov eax, dword [0x496034]
call fcn.004091f0
mov edx, dword [0x494394]
mov dword [edx], eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x491930
xor edx, edx
mov eax, 0x49193c
call fcn.00430438
mov edx, dword [ebp - 0x2c]
mov eax, 0x496034
call fcn.0040483c
mov eax, dword [0x4946cc]
mov edx, dword [0x496034]
call fcn.0040483c
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x491930
xor edx, edx
mov eax, 0x491958
call fcn.00430438
mov edx, dword [ebp - 0x30]
mov eax, 0x496034
call fcn.0040483c
mov eax, dword [0x494734]
mov edx, dword [0x496034]
call fcn.0040483c
lea eax, [ebp - 0x34]
push eax
mov ecx, 0x491974
mov edx, 0x491980
mov eax, 0x4919a0
call fcn.00430438
mov edx, dword [ebp - 0x34]
mov eax, 0x496034
call fcn.0040483c
xor edx, edx
mov eax, dword [0x496034]
call fcn.004091f0
mov edx, dword [0x494620]
mov dword [edx], eax
jmp 0x4913eb
lea edx, [ebp - 0x3c]
mov eax, 1
call fcn.00402bec
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.00409bc4
mov edx, dword [ebp - 0x38]
mov eax, dword [0x4948f4]
call fcn.0040483c
mov edx, dword [0x494830]
mov eax, 2
call fcn.00402bec
mov edx, dword [0x494840]
mov eax, 3
call fcn.00402bec
mov edx, dword [0x4946a8]
mov eax, 4
call fcn.00402bec
mov edx, dword [0x4943ec]
mov eax, 5
call fcn.00402bec
mov edx, dword [0x494594]
mov eax, 6
call fcn.00402bec
lea edx, [ebp - 0x40]
mov eax, 7
call fcn.00402bec
mov eax, dword [ebp - 0x40]
xor edx, edx
call fcn.004091f0
mov edx, dword [0x494394]
mov dword [edx], eax
lea edx, [ebp - 0x44]
mov eax, 8
call fcn.00402bec
mov eax, dword [ebp - 0x44]
xor edx, edx
call fcn.004091f0
mov edx, dword [0x494620]
mov dword [edx], eax
mov edx, dword [0x4946cc]
mov eax, 9
call fcn.00402bec
mov eax, dword [0x4946cc]
mov eax, dword [eax]
mov edx, 0x491974
call fcn.00404bf4
jne 0x491391
mov eax, dword [0x4946cc]
call fcn.004047e8
mov edx, dword [0x494734]
mov eax, 0xa
call fcn.00402bec
mov eax, dword [0x494734]
mov eax, dword [eax]
mov edx, 0x491974
call fcn.00404bf4
jne 0x4913be
mov eax, dword [0x494734]
call fcn.004047e8
mov edx, dword [0x494700]
mov eax, 0xb
call fcn.00402bec
mov eax, dword [0x494700]
mov eax, dword [eax]
mov edx, 0x491974
call fcn.00404bf4
jne 0x4913eb
mov eax, dword [0x494700]
call fcn.004047e8
mov eax, dword [0x494620]
cmp dword [eax], 0
je 0x49145d
mov eax, dword [0x494594]
cmp dword [eax], 0
je 0x49145d
mov eax, dword [0x494394]
cmp dword [eax], 0
je 0x49145d
mov eax, dword [0x494620]
mov eax, dword [eax]
mov edx, dword [0x494578]
mov dword [edx], eax
mov eax, dword [0x494500]
mov edx, dword [0x494594]
mov edx, dword [edx]
call fcn.0040483c
mov eax, dword [0x494394]
mov eax, dword [eax]
mov edx, dword [0x494304]
mov dword [edx], eax
mov eax, dword [0x49448c]
mov edx, dword [0x4946cc]
mov edx, dword [edx]
call fcn.0040483c
mov eax, dword [0x4947a0]
mov edx, dword [0x494734]
mov edx, dword [edx]
call fcn.0040483c
push 0x4919bc
mov eax, dword [0x494830]
push dword [eax]
push 0x4919d8
mov eax, dword [0x4948f4]
push dword [eax]
push 0x4919e8
mov eax, dword [0x494840]
push dword [eax]
push 0x4919fc
mov eax, dword [0x4946a8]
push dword [eax]
lea eax, [ebp - 0x48]
mov edx, 8
call fcn.00404b68
mov eax, dword [ebp - 0x48]
call fcn.00404ca8
push eax
call sub.kernel32.dll_OutputDebugStringA
push 0x491a10
mov eax, dword [0x494594]
push dword [eax]
push 0x491a30
lea edx, [ebp - 0x50]
mov eax, dword [0x494394]
mov eax, dword [eax]
call fcn.00409078
push dword [ebp - 0x50]
push 0x491a40
lea edx, [ebp - 0x54]
mov eax, dword [0x494620]
mov eax, dword [eax]
call fcn.00409078
push dword [ebp - 0x54]
push 0x491a50
mov eax, dword [0x4946cc]
push dword [eax]
push 0x491a60
mov eax, dword [0x494734]
push dword [eax]
lea eax, [ebp - 0x4c]
mov edx, 0xa
call fcn.00404b68
mov eax, dword [ebp - 0x4c]
call fcn.00404ca8
push eax
call sub.kernel32.dll_OutputDebugStringA
lea edx, [ebp - 0x58]
mov eax, dword [0x494830]
mov eax, dword [eax]
call fcn.00408ca4
cmp dword [ebp - 0x58], 0
je 0x49153e
mov eax, dword [0x494840]
cmp dword [eax], 0
je 0x49153e
mov eax, dword [0x4946a8]
cmp dword [eax], 0
jne 0x49155b
push 0x40
mov ecx, 0x491780
mov edx, 0x491a68
mov eax, dword [0x494730]
mov eax, dword [eax]
call fcn.00463cf0
jmp 0x491747
lea edx, [ebp - 0x60]
xor eax, eax
call fcn.00402bec
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.00409aa8
mov edx, dword [ebp - 0x5c]
mov eax, dword [0x4944fc]
call fcn.0040483c
mov edx, dword [0x4944fc]
mov edx, dword [edx]
mov eax, dword [0x494354]
mov ecx, 0x491a8c
call fcn.00404af4
mov eax, dword [0x494354]
mov eax, dword [eax]
call fcn.00409674
test al, al
jne 0x4915b0
mov eax, dword [0x494354]
mov eax, dword [eax]
call fcn.00409698
mov al, byte [0x491a94]
push eax
lea eax, [ebp - 0x64]
push eax
mov eax, dword [0x494830]
mov eax, dword [eax]
mov ecx, 0x491aa0
mov edx, 0x491aac
call fcn.0040e41c
mov edx, dword [ebp - 0x64]
mov eax, dword [0x494830]
call fcn.0040483c
mov al, byte [0x491a94]
push eax
lea eax, [ebp - 0x68]
push eax
mov eax, dword [0x4948f4]
mov eax, dword [eax]
mov ecx, 0x491aa0
mov edx, 0x491aac
call fcn.0040e41c
mov edx, dword [ebp - 0x68]
mov eax, dword [0x4948f4]
call fcn.0040483c
push 0x491abc
mov eax, dword [0x494840]
push dword [eax]
push 0x491acc
mov eax, dword [0x4946a8]
push dword [eax]
push 0x491ad8
mov eax, dword [0x494840]
mov edx, 5
call fcn.00404b68
mov dl, 1
mov eax, dword [0x48df18]
call fcn.0048e8e8
mov edx, dword [0x4945dc]
mov dword [edx], eax
mov eax, dword [0x494730]
mov eax, dword [eax]
call fcn.00463ac8
mov ecx, dword [0x4945cc]
mov eax, dword [0x494730]
mov eax, dword [eax]
mov edx, dword [0x48dbe4]
call fcn.00463ae0
mov eax, dword [0x494730]
mov eax, dword [eax]
call fcn.00463b60
mov eax, dword [0x4945dc]
cmp dword [eax], 0
je 0x491699
mov eax, dword [0x4945dc]
mov eax, dword [eax]
call fcn.00403934
mov eax, dword [0x4945dc]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x494818]
cmp byte [eax], 0
jne 0x491747
mov eax, dword [0x4948f4]
mov eax, dword [eax]
call fcn.00409664
test al, al
je 0x4916e4
push 5
push 0
push 0x491ae4
mov eax, dword [0x4948f4]
mov eax, dword [eax]
call fcn.00404ca8
push eax
push 0x491ae8
mov eax, dword [0x494730]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x491747
mov ecx, dword [0x4948f4]
mov ecx, dword [ecx]
mov edx, dword [0x4944fc]
mov edx, dword [edx]
lea eax, [ebp - 0x6c]
call fcn.00404af4
mov eax, dword [ebp - 0x6c]
call fcn.00409664
test al, al
je 0x491747
push 5
push 0
push 0x491ae4
mov ecx, dword [0x4948f4]
mov ecx, dword [ecx]
mov edx, dword [0x4944fc]
mov edx, dword [edx]
lea eax, [ebp - 0x70]
call fcn.00404af4
mov eax, dword [ebp - 0x70]
call fcn.00404ca8
push eax
push 0x491ae8
mov eax, dword [0x494730]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491769
lea eax, [ebp - 0x70]
mov edx, 0x18
call fcn.0040480c
ret