Function at 0x4949d0
Capabilities:
Create process on windows
Create process suspended
Resume thread
Use process replacement

Disassembly:
push 0xffffffffffffffff
push 0x5e1c92
mov eax, dword fs:[0]
push eax
sub esp, 0x330
mov eax, dword [0x65f810]
xor eax, esp
mov dword [esp + 0x32c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x65f810]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
xor ebx, ebx
push 0x40
lea eax, [esp + 0x34]
push ebx
push eax
mov esi, ecx
mov dword [esp + 0x38], ebx
call fcn.00578cb0
xor eax, eax
mov ecx, 5
mov word [esp + 0x68], cx
mov cl, 0x74
add esp, 0xc
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dl, 0x61
mov al, 0x65
mov byte [esp + 0x12e], cl
mov byte [esp + 0x133], cl
mov ecx, dword [0x66d460]
add esi, 0x1178
push esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x4c], 0x44
mov byte [esp + 0x130], dl
mov byte [esp + 0x131], 0x6c
mov byte [esp + 0x133], al
mov byte [esp + 0x134], 0x72
mov byte [esp + 0x135], 0x6e
mov byte [esp + 0x136], dl
mov byte [esp + 0x138], al
mov byte [esp + 0x139], 0x5c
mov byte [esp + 0x13a], bl
mov byte [esp + 0x13b], bl
call fcn.00454410
add eax, 0x20
push eax
lea edx, [esp + 0xe0]
push edx
call fcn.0043bca0
add esp, 0xc
mov ecx, dword [0x66d460]
mov dword [esp + 0x34c], ebx
call fcn.00454410
mov ebp, dword [esp + 0x354]
cmp dword [eax + 0x358], ebx
je 0x494b7f
cmp ebp, ebx
jne 0x494b07
mov ecx, dword [0x66d460]
call fcn.00454410
cmp dword [eax + 0x174], ebx
je 0x494b7f
push 0x206
lea ecx, [esp + 0x13e]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x144], ax
call fcn.00578cb0
mov ecx, dword [0x66d460]
add esp, 0xc
call fcn.00454410
add eax, 0x20
mov edi, 8
cmp dword [eax + 0x18], edi
jb 0x494b44
mov eax, dword [eax + 4]
jmp 0x494b47
add eax, 4
push str.DataCache
push eax
lea edx, [esp + 0x140]
push 0x5f683c
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x148]
push 0x10
push eax
call fcn.0045bbf0
add esp, 0x18
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x494b84
mov edi, 8
mov ecx, dword [0x66d460]
call fcn.00454410
cmp dword [eax + 0x358], ebx
je 0x494baf
mov ecx, dword [0x66d460]
call fcn.00454410
cmp dword [eax + 0x174], ebx
je 0x494baf
call fcn.004bae90
push str.__launch
lea ecx, [esp + 0xdc]
push ecx
lea edx, [esp + 0xc4]
push edx
call fcn.0043bbd0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xe4]
mov byte [esp + 0x358], 1
call fcn.00439be0
mov byte [esp + 0x34c], bl
cmp dword [esp + 0xd4], edi
jb 0x494c04
mov eax, dword [esp + 0xc0]
push eax
call fcn.00506f70
add esp, 4
mov eax, dword [esp + 0xdc]
cmp dword [esp + 0xf0], edi
jae 0x494c1b
lea eax, [esp + 0xdc]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x30]
push edx
push ebx
push ebx
push 4
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
cmp eax, ebx
je 0x494ec9
mov dword [esp + 0xd4], 0xf
mov dword [esp + 0xd0], ebx
mov byte [esp + 0xc0], bl
mov ecx, dword [0x66d460]
push str.WTFConfig.wtf
mov byte [esp + 0x350], 2
call fcn.00454410
add eax, 0x20
push eax
lea eax, [esp + 0x118]
push eax
call fcn.0043bbd0
lea ecx, [esp + 0xc8]
push ecx
lea edx, [esp + 0x120]
push edx
push ebx
mov byte [esp + 0x364], 3
call fcn.004c2cf0
add esp, 0x18
cmp dword [eax + 0x18], 0x10
jb 0x494caa
mov eax, dword [eax + 4]
jmp 0x494cad
add eax, 4
push str.__t_n_r_v_
push 0x5f67fc
push 0x5f2f38
push eax
lea ecx, [esp + 0x80]
call fcn.004948e0
push str.SET_locale
lea eax, [esp + 0xf8]
push eax
lea ecx, [esp + 0x78]
mov byte [esp + 0x354], 4
call fcn.00490c60
mov ecx, dword [0x66d460]
mov byte [esp + 0x34c], 5
call fcn.00454410
cmp dword [eax + 0x358], ebx
je 0x494d6d
mov ecx, dword [0x66d460]
call fcn.00454410
cmp dword [eax + 0x174], ebx
je 0x494d6d
cmp dword [esp + 0x108], ebx
je 0x494d37
lea ecx, [esp + 0xf4]
push str.zhCN
push ecx
call fcn.00438cb0
add esp, 8
test al, al
je 0x494d6d
cmp dword [esi + 0x18], edi
jb 0x494d41
mov esi, dword [esi + 4]
jmp 0x494d44
add esi, 4
push str.wow_64.exe
push esi
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x494d60
mov edx, dword [esp + 0x1c]
push edx
call fcn.004c3570
jmp 0x494d6a
mov eax, dword [esp + 0x1c]
push eax
call fcn.004c32f0
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
push edx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [0x66d460]
call fcn.00454410
cmp dword [eax + 0x358], ebx
je 0x494e33
cmp ebp, ebx
je 0x494e33
mov ecx, dword [esp + 0x14]
push ebx
push 0xc
lea eax, [esp + 0x134]
push eax
push ecx
call fcn.0045bef0
mov esi, eax
add esp, 0x10
cmp esi, ebx
je 0x494e33
mov edi, dword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
mov ebp, dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov edi, edi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x28]
push edx
push 0x40
push 0x400
push esi
push eax
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push ecx
push 0xb
push str.elternate_
push esi
push edx
call ebp
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
push ecx
push 0x400
push esi
push edx
call edi
mov ecx, dword [esp + 0x14]
inc esi
push esi
push 0xc
lea eax, [esp + 0x134]
push eax
push ecx
call fcn.0045bef0
mov esi, eax
add esp, 0x10
cmp esi, ebx
jne 0x494dd0
mov edi, 8
mov esi, 0x10
cmp dword [esp + 0x10c], esi
jb 0x494e51
mov edx, dword [esp + 0xf8]
push edx
call fcn.00506f70
add esp, 4
lea ecx, [esp + 0x74]
mov dword [esp + 0x10c], 0xf
mov dword [esp + 0x108], ebx
mov byte [esp + 0xf8], bl
mov dword [esp + 0x70], vtable.INC::FILE::basic_config_char_.0
call fcn.00491830
cmp dword [esp + 0x128], edi
jb 0x494e94
mov eax, dword [esp + 0x114]
push eax
call fcn.00506f70
add esp, 4
xor ecx, ecx
mov dword [esp + 0x128], 7
mov dword [esp + 0x124], ebx
mov word [esp + 0x114], cx
cmp dword [esp + 0xd4], esi
jb 0x494ec9
mov edx, dword [esp + 0xc0]
push edx
call fcn.00506f70
add esp, 4
mov esi, dword [esp + 0x1c]
cmp dword [esp + 0xf0], edi
jb 0x494ee6
mov eax, dword [esp + 0xdc]
push eax
call fcn.00506f70
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x32c]
xor ecx, esp
call fcn.005792fc
add esp, 0x33c
ret 4