Function at 0x49c530
Capabilities:
Create process on windows
Delete file
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
lea ebx, [ebp - 0x14c]
sub esp, 0x188
mov esi, dword [ecx + 4]
mov edi, dword [ecx]
call fcn.00402d40
mov ecx, ebx
mov eax, dword [esi]
mov dword [esp], eax
call fcn.004016c0
sub esp, 4
mov ecx, ebx
mov dword [esp + 8], 2
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0x4a510c
call fcn.0042e180
lea ecx, [ebp - 0x134]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.0042ea40
lea eax, [ebp - 0x134]
sub esp, 0xc
mov dword [esp + 8], 0x4a510f
mov dword [esp + 4], eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call fcn.004997e0
mov eax, dword [0x4e7038]
lea ecx, [ebp - 0x5c]
mov dword [esp + 4], eax
mov eax, dword [0x4e7034]
mov dword [esp], eax
call fcn.0048a700
sub esp, 8
lea ecx, [ebp - 0x11c]
lea ebx, [ebp - 0x54]
mov dword [esp], eax
call fcn.0048aac0
mov eax, dword [ebp - 0x5c]
sub esp, 4
cmp eax, ebx
je 0x49c600
mov dword [esp], eax
call fcn.0049b3a0
call fcn.00402680
test al, al
je 0x49cc1a
cmp edi, 3
je 0x49c9d4
lea eax, [ebp - 0x11c]
mov dword [esp], eax
call fcn.00401c00
test al, al
je 0x49c958
mov eax, dword [ebp - 0x14c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x8c]
mov dword [esp], eax
call fcn.00402340
mov eax, dword [ebp - 0x11c]
lea ebx, [ebp - 0xec]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00402340
mov dword [esp + 4], 0x4a516d
mov dword [esp], 0
mov ecx, ebx
call fcn.004898f0
push ebx
push ebx
lea ecx, [ebp - 0xd4]
mov dword [esp], eax
call fcn.0048aac0
push esi
lea ecx, [ebp - 0xd4]
mov dword [esp], 0x4a516f
call fcn.00489440
push edx
lea ecx, [ebp - 0xbc]
mov dword [esp], eax
call fcn.0048aac0
push ecx
lea ecx, [ebp - 0xbc]
mov dword [esp], 0x4a516d
call fcn.00489440
lea edi, [ebp - 0xa4]
push esi
lea esi, [ebp - 0x9c]
mov ecx, edi
mov dword [esp], eax
mov dword [ebp - 0x15c], edi
call fcn.0048aac0
push edi
mov edi, dword [ebp - 0xa4]
mov ebx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x88]
cmp edi, esi
lea edx, [ebx + eax]
je 0x49ce19
mov esi, dword [ebp - 0x9c]
cmp edx, esi
mov ecx, dword [ebp - 0x8c]
jbe 0x49ce08
lea esi, [ebp - 0x84]
cmp ecx, esi
mov dword [ebp - 0x160], esi
je 0x49cddb
mov esi, dword [ebp - 0x84]
cmp edx, esi
jbe 0x49ce23
mov dword [esp], ecx
mov ecx, dword [ebp - 0x15c]
mov dword [esp + 4], eax
call fcn.0048a700
push ebx
push ebx
lea edi, [ebp - 0x6c]
lea edx, [eax + 8]
mov dword [ebp - 0x74], edi
mov ecx, dword [eax]
cmp ecx, edx
je 0x49ce4d
mov dword [ebp - 0x74], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x6c], ecx
mov ecx, dword [eax + 4]
lea ebx, [ebp - 0x74]
mov dword [ebp - 0x70], ecx
mov dword [eax], edx
mov ecx, ebx
mov dword [eax + 4], 0
mov byte [eax + 8], 0
mov dword [esp], 0x4a516f
call fcn.00489440
push edx
lea ecx, [ebp - 0x5c]
mov dword [esp], eax
call fcn.0048aac0
push ecx
lea ecx, [ebp - 0x5c]
mov dword [esp], str.3f4edb8b4
call fcn.00489440
push esi
lea esi, [ebp - 0x104]
mov dword [esp], eax
mov ecx, esi
call fcn.0048aac0
mov eax, dword [ebp - 0x5c]
push edi
lea edi, [ebp - 0x54]
cmp eax, edi
je 0x49c7bc
mov dword [esp], eax
call fcn.0049b3a0
mov eax, dword [ebp - 0x74]
lea edi, [ebp - 0x6c]
cmp eax, edi
je 0x49c7ce
mov dword [esp], eax
call fcn.0049b3a0
mov eax, dword [ebp - 0xa4]
lea edi, [ebp - 0x9c]
cmp eax, edi
je 0x49c7e6
mov dword [esp], eax
call fcn.0049b3a0
mov eax, dword [ebp - 0xbc]
lea edx, [ebp - 0xb4]
cmp eax, edx
je 0x49c7fe
mov dword [esp], eax
call fcn.0049b3a0
mov eax, dword [ebp - 0xd4]
lea edx, [ebp - 0xcc]
cmp eax, edx
je 0x49c816
mov dword [esp], eax
call fcn.0049b3a0
mov eax, dword [ebp - 0xec]
lea edx, [ebp - 0xe4]
cmp eax, edx
je 0x49c82e
mov dword [esp], eax
call fcn.0049b3a0
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x160]
je 0x49c844
mov dword [esp], eax
call fcn.0049b3a0
lea edx, [ebp - 0x58]
xor eax, eax
mov ecx, 0x10
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x134]
mov dword [esp], ebx
mov dword [ebp - 0x5c], 0x44
mov dword [esp + 4], eax
call fcn.00402340
mov dword [esp], ebx
call fcn.00401ac0
mov dword [esp], esi
mov ebx, eax
call fcn.00401ac0
lea esi, [ebp - 0x8c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x24], esi
lea esi, [ebp - 0x5c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp + 0x20], esi
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
jne 0x49cde5
mov eax, dword [ebp - 0x74]
lea esi, [ebp - 0x6c]
cmp eax, esi
je 0x49c8e8
mov dword [esp], eax
call fcn.0049b3a0
mov eax, dword [ebp - 0x104]
lea edx, [ebp - 0xfc]
cmp eax, edx
je 0x49c900
mov dword [esp], eax
call fcn.0049b3a0
xor ebx, ebx
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x114]
cmp eax, edx
je 0x49c91a
mov dword [esp], eax
call fcn.0049b3a0
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x12c]
cmp eax, edx
je 0x49c932
mov dword [esp], eax
call fcn.0049b3a0
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x144]
cmp eax, edx
je 0x49c94a
mov dword [esp], eax
call fcn.0049b3a0
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
lea ecx, [ebp - 0x5c]
mov dword [esp], str.Error
call fcn.004016c0
push eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call fcn.00401ac0
lea ebx, [ebp - 0x74]
mov dword [esp], 0x4a5157
mov esi, eax
mov ecx, ebx
call fcn.004016c0
push edi
mov dword [esp], ebx
call fcn.00401ac0
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x74]
lea edx, [ebp - 0x6c]
sub esp, 0x10
cmp eax, edx
je 0x49c9c1
mov dword [esp], eax
call fcn.0049b3a0
mov eax, dword [ebp - 0x5c]
lea edi, [ebp - 0x54]
cmp eax, edi
jne 0x49c8f8
jmp 0x49c900
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x5c]
mov dword [esp], eax
call fcn.004016c0
push ebx
lea ecx, [ebp - 0x5c]
mov dword [esp], str..temp
call fcn.00489440
lea edi, [ebp - 0xa4]
push edx
mov ecx, edi
mov dword [esp], eax
mov dword [ebp - 0x15c], edi
call fcn.0048aac0
mov eax, dword [ebp - 0x5c]
lea edi, [ebp - 0x54]
push ecx
cmp eax, edi
je 0x49ca1c
mov dword [esp], eax
call fcn.0049b3a0
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x5c]
mov dword [esp], eax
call fcn.004016c0
mov esi, dword [ebp - 0x5c]
push eax
mov ebx, dword [sym.imp.msvcrt.dll__errno]
call ebx
mov eax, dword [eax]
mov dword [ebp - 0x160], eax
call ebx
mov dword [eax], 0
lea eax, [ebp - 0xbc]
mov dword [esp + 8], 0xa
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strtol
cmp esi, dword [ebp - 0xbc]
mov edi, eax
je 0x49cef6
call ebx
cmp dword [eax], 0x22
je 0x49cf91
call ebx
cmp dword [eax], 0
je 0x49cc93
mov eax, dword [ebp - 0x5c]
lea esi, [ebp - 0x54]
cmp eax, esi
je 0x49ca96
mov dword [esp], eax
call fcn.0049b3a0
test edi, edi
je 0x49cbe3
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub esp, 0xc
test eax, eax
mov esi, eax
je 0x49cbe3
mov dword [esp + 4], 0
mov dword [esp], eax
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
call ebx
push edi
push edi
mov edi, 5
jmp 0x49cb04
test eax, eax
jne 0x49cb08
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
mov dword [esp + 4], 0
mov dword [esp], esi
call ebx
push edx
push edx
sub edi, 1
test edi, edi
jg 0x49cae0
test eax, eax
jne 0x49ce5b
lea ecx, [ebp - 0x5c]
mov dword [esp], str.Error
call fcn.004016c0
push eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call fcn.00401ac0
lea ebx, [ebp - 0x74]
mov dword [esp], 0x4a511c
mov edi, eax
mov ecx, ebx
call fcn.004016c0
push eax
mov dword [esp], ebx
call fcn.00401ac0
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x74]
lea edx, [ebp - 0x6c]
sub esp, 0x10
cmp eax, edx
je 0x49cb79
mov dword [esp], eax
call fcn.0049b3a0
mov eax, dword [ebp - 0x5c]
lea edi, [ebp - 0x54]
cmp eax, edi
je 0x49ce69
mov dword [esp], eax
call fcn.0049b3a0
jmp 0x49ce69
mov eax, dword [ebp - 0x15c]
mov dword [esp], eax
call fcn.00401c00
test al, al
jne 0x49cca2
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0x9c]
cmp eax, edx
je 0x49c616
mov dword [esp], eax
call fcn.0049b3a0
jmp 0x49c616
lea eax, [ebp - 0x54]
mov edx, dword [ebp - 0x148]
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x14c]
add edx, eax
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00401610
mov eax, dword [ebp - 0x5c]
push esi
push esi
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], str.runas
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ebx, eax
mov eax, dword [ebp - 0x5c]
lea esi, [ebp - 0x54]
sub esp, 0x18
cmp eax, esi
je 0x49c902
mov dword [esp], eax
call fcn.0049b3a0
jmp 0x49c902
call ebx
mov esi, dword [ebp - 0x160]
mov dword [eax], esi
jmp 0x49ca84
lea eax, [ebp - 0x134]
mov dword [esp + 8], 0x4a510f
mov dword [esp + 4], eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call fcn.004997e0
lea ecx, [ebp - 0x5c]
mov dword [esp], str.LoginMain1.dll
call fcn.00489440
push edx
lea ecx, [ebp - 0x8c]
lea edi, [ebp - 0x54]
mov dword [esp], eax
call fcn.0048aac0
mov eax, dword [ebp - 0x5c]
push ecx
cmp eax, edi
je 0x49ccf0
mov dword [esp], eax
call fcn.0049b3a0
mov ebx, 0x18
lea esi, [ebp - 0x74]
lea edi, [ebp - 0x6c]
jmp 0x49cd14
mov dword [esp], 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
push eax
je 0x49ce78
lea eax, [ebp - 0x54]
mov edx, dword [ebp - 0x118]
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x11c]
add edx, eax
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00401610
mov edx, dword [ebp - 0xa0]
push eax
mov ecx, esi
push eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x74], edi
add edx, eax
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00401610
push eax
push eax
lea eax, [ebp - 0x5c]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00401e10
mov edx, dword [ebp - 0x74]
cmp edx, edi
je 0x49cd85
mov dword [esp], edx
mov byte [ebp - 0x15c], al
call fcn.0049b3a0
movzx eax, byte [ebp - 0x15c]
mov edx, dword [ebp - 0x5c]
lea ecx, [ebp - 0x54]
cmp edx, ecx
je 0x49cda4
mov dword [esp], edx
mov byte [ebp - 0x15c], al
call fcn.0049b3a0
movzx eax, byte [ebp - 0x15c]
test al, al
je 0x49ccfd
mov eax, dword [ebp - 0xa4]
mov dword [esp], eax
call sub.msvcrt.dll_remove
mov eax, dword [ebp - 0x8c]
lea edi, [ebp - 0x84]
cmp eax, edi
je 0x49cbf9
mov dword [esp], eax
call fcn.0049b3a0
jmp 0x49cbf9
mov esi, 0xf
jmp 0x49c720
mov eax, dword [ebp - 0x8c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x88]
push ecx
mov dword [esp], eax
call ebx
push edx
jmp 0x49c8d6
lea edi, [ebp - 0x84]
mov dword [ebp - 0x160], edi
jmp 0x49c728
mov esi, 0xf
jmp 0x49c6f8
lea ecx, [ebp - 0x8c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.004885a0
sub esp, 0x10
jmp 0x49c73c
mov ecx, 4
mov esi, edx
rep movsd dword es:[edi], dword [esi]
jmp 0x49c758
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
jmp 0x49cbe3
lea ecx, [ebp - 0x5c]
mov dword [esp], str.Error
call fcn.004016c0
push eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call fcn.00401ac0
mov dword [esp], 0x4a513e
mov ecx, esi
mov ebx, eax
call fcn.004016c0
push eax
mov dword [esp], esi
call fcn.00401ac0
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x74]
sub esp, 0x10
cmp eax, edi
je 0x49cedb
mov dword [esp], eax
call fcn.0049b3a0
mov eax, dword [ebp - 0x5c]
lea esi, [ebp - 0x54]
cmp eax, esi
je 0x49cdac
mov dword [esp], eax
call fcn.0049b3a0
jmp 0x49cdac
mov dword [esp], str.stoi
call fcn.00496fe0
mov esi, eax
call ebx
cmp dword [eax], 0
jne 0x49cf15
call ebx
mov edi, dword [ebp - 0x160]
mov dword [eax], edi
mov ebx, esi
mov eax, dword [ebp - 0x5c]
lea esi, [ebp - 0x54]
cmp eax, esi
je 0x49cf29
mov dword [esp], eax
call fcn.0049b3a0
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0x9c]
cmp eax, edx
je 0x49cf41
mov dword [esp], eax
call fcn.0049b3a0
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x114]
cmp eax, edx
je 0x49cf59
mov dword [esp], eax
call fcn.0049b3a0
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x12c]
cmp eax, edx
je 0x49cf71
mov dword [esp], eax
call fcn.0049b3a0
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x144]
cmp eax, edx
je 0x49cf89
mov dword [esp], eax
call fcn.0049b3a0
mov dword [esp], ebx
call fcn.0040f7a0
mov dword [esp], str.stoi
call fcn.00496b10
mov ebx, eax
mov eax, dword [ebp - 0x74]
cmp eax, edi
je 0x49cfae
mov dword [esp], eax
call fcn.0049b3a0
mov eax, dword [ebp - 0x5c]
lea esi, [ebp - 0x54]
cmp eax, esi
je 0x49cfc0
mov dword [esp], eax
call fcn.0049b3a0
mov eax, dword [ebp - 0x8c]
lea edx, [ebp - 0x84]
cmp eax, edx
jne 0x49cf21
jmp 0x49cf29