Function at 0x49ce5c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x49ce64
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x49d13b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0049cd64
push dword [ebp - 4]
lea edx, [ebp - 0x20]
mov eax, dword [0x4a4688]
mov eax, dword [eax]
call fcn.00473d98
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00494f50
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0xc]
call fcn.00494fc8
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
mov edx, 5
call fcn.0043c8bc
push dword [ebp - 8]
push 0x49d154
mov eax, 0x4aa118
mov edx, 3
call fcn.004056e8
mov eax, dword [0x4a9ff8]
mov edx, 0x49d164
call fcn.0040577c
jne 0x49d106
lea edx, [ebp - 0x24]
mov eax, dword [0x4a4688]
mov eax, dword [eax]
call fcn.00473d98
mov eax, dword [ebp - 0x24]
mov edx, dword [0x4aa118]
call fcn.0049c9d4
mov edx, 6
mov eax, dword [0x4aa118]
call fcn.0040a814
mov eax, dword [0x4a9ff4]
mov eax, dword [eax + 0x364]
mov edx, 0x49d16c
call fcn.004941cc
push 0
lea eax, [ebp - 0x28]
mov edx, dword [0x4aa114]
call fcn.00405cdc
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
mov edx, dword [0x4aa118]
call fcn.00405cdc
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x4a9ff4]
mov eax, dword [eax + 0x364]
pop ecx
call fcn.00494074
mov eax, dword [0x4a9ff4]
mov eax, dword [eax + 0x364]
mov edx, 1
call fcn.004940e8
cmp dword [0x4aa05c], 0
je 0x49cfd5
cmp dword [0x4aa060], 0
je 0x49cfd5
xor eax, eax
push ebp
push 0x49cfcb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4aa060]
call fcn.0040a094
mov edx, eax
mov eax, dword [0x4a9ff4]
call fcn.00454cec
mov eax, dword [0x4aa05c]
call fcn.0040a094
mov edx, eax
mov eax, dword [0x4a9ff4]
call fcn.00454d20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49cfd5
mov eax, dword [0x4aa0a8]
mov edx, 0x49d194
call fcn.0040577c
jne 0x49cff2
mov dl, 3
mov eax, dword [0x4a9ff4]
call fcn.0046c0c4
mov eax, dword [0x4a4824]
cmp dword [eax], 0
je 0x49d094
xor eax, eax
push ebp
push 0x49d08a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4a9ff4]
call fcn.0046ada8
mov ebx, eax
mov eax, dword [0x4aa044]
call fcn.0040a094
add ebx, eax
mov edx, ebx
mov eax, dword [0x4a463c]
mov eax, dword [eax]
call fcn.004703d8
mov eax, dword [0x4a9ff4]
call fcn.0046adc8
mov ebx, eax
mov eax, dword [0x4aa048]
call fcn.0040a094
add ebx, eax
mov edx, ebx
mov eax, dword [0x4a463c]
mov eax, dword [eax]
call fcn.00470414
mov edx, dword [0x4a4824]
mov edx, dword [edx]
mov eax, dword [0x4a463c]
mov eax, dword [eax]
mov eax, dword [eax + 0x360]
call fcn.00455634
mov eax, dword [0x4a463c]
mov eax, dword [eax]
call fcn.0046f9d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49d094
mov eax, dword [0x4a9ff4]
mov eax, dword [eax + 0x360]
mov dl, 1
call fcn.00440610
cmp dword [0x4aa07c], 0
je 0x49d0da
mov eax, dword [0x4aa07c]
mov edx, 0x49d1a0
call fcn.0040577c
je 0x49d0da
push 1
push 0
push 0
mov eax, dword [0x4aa07c]
call fcn.004057e4
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
push ebp
push 0x49d0fc
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00447320
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49d106
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d142
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00405b74
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00405378
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405378
ret