Function at 0x100049af
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc60
mov eax, dword [0x10017014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0xc08]
xor ebx, ebx
push eax
push dword [ebp + 8]
mov dword [ebp - 0xc08], ebx
call fcn.10004506
pop ecx
pop ecx
test eax, eax
je 0x10004c41
push edi
mov edi, dword [ebp - 0xc08]
test edi, edi
je 0x10004c40
push esi
push 0x10017cc4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x10017a98], ebx
je 0x10004b29
mov ebx, dword [0x10017ca8]
mov dword [ebp - 0xc08], ebx
test ebx, ebx
je 0x10004b27
cmp dword [edi + 4], 0
mov esi, 0x3ff
je 0x10004a4a
push esi
push dword [edi + 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
pop ecx
pop ecx
cmp eax, esi
jbe 0x10004a44
mov eax, esi
mov dword [ebp - 0xc0c], esi
jmp 0x10004a60
cmp dword [edi + 4], 0
jne 0x10004a4e
xor eax, eax
jmp 0x10004a5a
push esi
push dword [edi + 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
pop ecx
pop ecx
mov dword [ebp - 0xc0c], eax
push eax
push dword [edi + 4]
lea ecx, [ebx + 0x24]
push eax
push ecx
call fcn.10006ad9
mov eax, dword [ebp - 0xc0c]
add esp, 0x10
mov byte [eax + ebx + 0x24], 0
mov ebx, 0x1ff
cmp dword [edi + 8], 0
je 0x10004a9d
push ebx
push dword [edi + 8]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
pop ecx
pop ecx
cmp eax, ebx
ja 0x10004aaf
cmp dword [edi + 8], 0
jne 0x10004aa1
xor ebx, ebx
jmp 0x10004aaf
push ebx
push dword [edi + 8]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
pop ecx
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0xc08]
push ebx
push dword [edi + 8]
add ecx, 0x424
push ebx
push ecx
call fcn.10006ad9
mov eax, dword [ebp - 0xc08]
add esp, 0x10
mov byte [ebx + eax + 0x424], 0
cmp dword [edi + 0xc], 0
je 0x10004af3
push esi
push dword [edi + 0xc]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
pop ecx
pop ecx
cmp eax, esi
ja 0x10004b05
cmp dword [edi + 0xc], 0
jne 0x10004af7
xor esi, esi
jmp 0x10004b05
push esi
push dword [edi + 0xc]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
pop ecx
pop ecx
mov esi, eax
mov ebx, dword [ebp - 0xc08]
push esi
push dword [edi + 0xc]
lea ecx, [ebx + 0x624]
push esi
push ecx
call fcn.10006ad9
add esp, 0x10
mov byte [esi + ebx + 0x624], 0
xor ebx, ebx
push 0x10017cc4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x800
lea eax, [ebp - 0xc04]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, 0x400
lea eax, [ebp - 0x404]
push esi
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
lea eax, [ebp - 0x404]
push ebx
push 0x200
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.10001785
add esp, 0x10
lea eax, [ebp - 0x404]
push 0x10011800
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x1e
mov edi, 0x10017aa0
lea eax, [ebp - 0x404]
push edi
push eax
push str.__s___s__d
lea eax, [ebp - 0xc04]
push esi
push eax
call fcn.10001b16
push 0x44
pop esi
push esi
lea eax, [ebp - 0xc60]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push 0x10
lea eax, [ebp - 0xc1c]
mov dword [ebp - 0xc60], esi
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x30
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0xc60]
push eax
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc04]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop esi
test eax, eax
je 0x10004c12
lea eax, [ebp - 0xc04]
push eax
push str.CreateProcess___s__success_r_n
call fcn.1000150d
pop ecx
pop ecx
jmp 0x10004c40
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc04]
push eax
push str.CreateProcess___s__failed__err___d__r_n
call fcn.1000150d
push ebx
push edi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess]
add esp, 0x14
test eax, eax
jne 0x10004c40
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
xor ecx, ebp
pop ebx
call fcn.100085db
leave
ret