Function at 0x49d04f
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
push ebx
xor ebx, ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x49d1bc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x49d1d0
call fcn.00499a68
test al, al
jne 0x49d189
call fcn.0049ce3c
test al, al
je 0x49cfa3
call fcn.0049ce68
mov ebx, eax
test ebx, ebx
jge 0x49cf61
mov eax, 0x49d1e4
call fcn.00435d44
jmp 0x49d189
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [0x4a33b0]
test al, al
jne 0x49d04f
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x74]
call fcn.0040bf78
mov ecx, dword [ebp - 0x74]
lea eax, [ebp - 0x70]
mov edx, 0x49d220
call fcn.00404a3c
mov eax, dword [ebp - 0x70]
mov edx, 0x49d244
call fcn.00498704
jmp 0x49d189
mov eax, dword [0x4a3a9c]
cmp dword [eax], 2
jne 0x49cfb5
mov eax, dword [0x4a360c]
cmp dword [eax], 6
call fcn.0049c484
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x49cfd7
mov edx, 0x49d244
mov eax, 0x49d258
call fcn.00498704
jmp 0x49d189
xor eax, eax
push ebp
push 0x49d048
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
push 0xf00ff
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x49d031
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x7c]
call fcn.0040bf78
mov ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
mov edx, 0x49d29c
call fcn.00404a3c
mov eax, dword [ebp - 0x78]
push eax
mov edx, 0x49d244
pop eax
call fcn.00498704
call fcn.00404164
jmp 0x49d189
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d04f
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor edx, edx
push ebp
push 0x49d182
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040d4b4
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x94], eax
mov byte [ebp - 0x90], 0xb
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov byte [ebp - 0x88], 0xb
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
mov byte [ebp - 0x80], 0xb
lea edx, [ebp - 0x94]
mov ecx, 2
mov eax, 0x49d2bc
call fcn.00409cd8
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x44
call fcn.0040311c
lea eax, [ebp - 0x6c]
xor ecx, ecx
mov edx, 0x10
call fcn.0040311c
mov dword [ebp - 0x5c], 0x44
mov eax, 0x49d2c8
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x30], 1
mov word [ebp - 0x2c], 0xa
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404bf0
push eax
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CreateProcessAsUserA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x49d13a
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x49d16b
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0xa0]
call fcn.0040bf78
mov ecx, dword [ebp - 0xa0]
lea eax, [ebp - 0x9c]
mov edx, 0x49d2e0
call fcn.00404a3c
mov eax, dword [ebp - 0x9c]
call fcn.00435d44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d189
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d1c3
lea eax, [ebp - 0xa0]
mov edx, 3
call fcn.00404754
lea eax, [ebp - 0x7c]
mov edx, 4
call fcn.00404754
lea eax, [ebp - 4]
call fcn.00404730
ret