Function at 0x49f3e4
Capabilities:
Copy file
Create process on windows
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x17
push 0
push 0
dec ecx
jne 0x49f3ec
push ebx
push esi
push edi
mov eax, 0x49f084
call fcn.00406aec
mov esi, dword [0x4bdbac]
xor eax, eax
push ebp
push 0x49fda7
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004029ac
mov edx, dword [esi]
lea eax, [ebp - 0x14]
mov ecx, 0x49fdc0
call fcn.00403e6c
mov eax, dword [ebp - 0x14]
call fcn.00408e3c
test al, al
je 0x49f52a
mov dl, 1
mov eax, dword [0x40eeac]
call fcn.00402e48
mov ebx, eax
mov edx, dword [esi]
lea eax, [ebp - 0x1c]
mov ecx, 0x49fdc0
call fcn.00403e6c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.00404314
mov eax, dword [ebp - 0x18]
push eax
push ebx
call fcn.004557e0
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x49f52a
lea ecx, [ebp - 0x24]
xor edx, edx
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408a24
mov edx, dword [ebp - 0x20]
mov eax, 0x4c9058
call fcn.00403bf4
lea edx, [ebp - 0x2c]
mov eax, dword [0x4c9058]
call fcn.00409120
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00408818
mov eax, dword [ebp - 0x28]
mov edx, 0x49fdd8
call fcn.00403f30
jne 0x49f52a
lea edx, [ebp - 0x30]
mov eax, dword [0x4bdb04]
mov eax, dword [eax]
call fcn.00431900
mov edx, dword [ebp - 0x30]
mov eax, 0x4c905c
call fcn.00403bf4
mov edx, dword [esi]
mov eax, 0x4c9060
mov ecx, dword [0x4c9058]
call fcn.00403e6c
push 0
mov eax, 0x4c9060
call fcn.00403ff0
push eax
mov eax, 0x4c905c
call fcn.00403ff0
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x49f52a
push 1
mov eax, 0x4c9060
call fcn.00403ff0
push eax
call sub.kernel32.dll_WinExec
jmp 0x49fd31
lea eax, [ebp - 0x34]
call fcn.0049efe8
mov edx, dword [ebp - 0x34]
mov eax, 0x49fde8
call fcn.0040410c
test eax, eax
jle 0x49f54b
mov eax, dword [0x4bdc74]
mov byte [eax], 0
lea ecx, [ebp - 0x38]
mov edx, 0x49fdf8
mov eax, 0x49fe0c
call fcn.004540bc
mov eax, dword [ebp - 0x38]
mov edx, dword [esi]
call fcn.00403f30
je 0x49f57a
mov eax, 0x49fe0c
mov ecx, dword [esi]
mov edx, 0x49fdf8
call fcn.00453e98
mov edx, dword [esi]
mov eax, dword [0x4bd970]
mov ecx, 0x49fe40
call fcn.00403e6c
mov edx, dword [esi]
mov eax, dword [0x4bdbc8]
mov ecx, 0x49fe58
call fcn.00403e6c
lea edx, [ebp - 0x40]
mov eax, dword [0x4bdb04]
mov eax, dword [eax]
call fcn.00431900
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.00408818
mov edx, dword [ebp - 0x3c]
mov eax, 0x4c9044
call fcn.00403bf4
push 0x104
mov eax, dword [0x4bd9d8]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
cmp eax, 2
jb 0x49f63c
lea edx, [ebp - 0x44]
mov eax, dword [0x4bd9d8]
call fcn.00409528
mov edx, dword [ebp - 0x44]
mov eax, dword [0x4bd878]
call fcn.00403bf4
mov eax, dword [0x4bd878]
mov eax, dword [eax]
call fcn.00403e20
cmp eax, 3
jle 0x49f617
mov eax, dword [0x4bd878]
mov edx, 0x49fe70
call fcn.00403e28
mov eax, dword [0x4bd878]
mov eax, dword [0x4bd878]
mov eax, dword [eax]
cmp byte [eax + 1], 0x3a
jne 0x49f644
mov eax, dword [0x4bd878]
mov eax, dword [eax]
mov al, byte [eax]
call fcn.004029e8
mov edx, dword [0x4bd9d4]
mov byte [edx], al
jmp 0x49f644
mov eax, dword [0x4bd9d4]
mov byte [eax], 0x43
push 0x104
mov eax, dword [0x4bd9d8]
push eax
push 0x49fe74
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, dword [0x4bd9d8]
call fcn.00409508
mov eax, dword [0x4c9044]
cmp byte [eax], 0x5c
jne 0x49f677
mov eax, dword [0x4bdbc4]
mov byte [eax], 2
jmp 0x49f6a3
lea eax, [ebp - 0x48]
mov edx, dword [0x4bd9d8]
mov ecx, 0x105
call fcn.00403dd0
mov eax, dword [ebp - 0x48]
mov edx, dword [0x4c9044]
call fcn.0040410c
dec eax
jne 0x49f6a3
mov eax, dword [0x4bdbc4]
mov byte [eax], 1
lea edx, [ebp - 0x50]
mov eax, 1
call fcn.00402954
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x4c]
call fcn.00408854
mov edx, dword [ebp - 0x4c]
mov eax, dword [0x4bdae0]
call fcn.00403bf4
lea edx, [ebp - 0x58]
mov eax, 2
call fcn.00402954
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
call fcn.00408854
mov edx, dword [ebp - 0x54]
mov eax, dword [0x4bdb10]
call fcn.00403bf4
lea eax, [ebp - 0x5c]
call fcn.00455270
mov edx, dword [ebp - 0x5c]
mov eax, dword [0x4bd808]
call fcn.00403bf4
mov eax, dword [0x4bdae0]
mov eax, dword [eax]
mov edx, 0x49fe84
call fcn.00403f30
je 0x49f72c
mov eax, dword [0x4bdb10]
mov eax, dword [eax]
mov edx, 0x49fe84
call fcn.00403f30
je 0x49f72c
xor eax, eax
jmp 0x49f72e
mov al, 1
test al, al
je 0x49f758
mov eax, 0x7d0
call fcn.00454ea4
mov eax, dword [0x4bd970]
mov eax, dword [eax]
call fcn.00408e3c
test al, al
je 0x49f758
mov eax, dword [0x4bd970]
mov eax, dword [eax]
call fcn.00408fc0
mov dl, 1
mov eax, dword [0x44af34]
call fcn.00402e48
mov dword [0x4c904c], eax
lea edx, [ebp - 0x68]
mov eax, dword [esi]
call fcn.00408818
mov eax, dword [ebp - 0x68]
call fcn.0044b10c
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x64]
call fcn.00408bd4
mov ecx, dword [ebp - 0x64]
lea eax, [ebp - 0x60]
mov edx, 0x49fe90
call fcn.00403e6c
mov edx, dword [ebp - 0x60]
mov eax, dword [0x4c904c]
call fcn.0044afc0
test eax, eax
jne 0x49f85e
mov eax, 0x49fea4
xor edx, edx
call fcn.00454fc0
mov ebx, eax
test ebx, ebx
je 0x49fd27
mov eax, 0x3e8
call fcn.00454ea4
mov eax, dword [0x4bdae0]
mov eax, dword [eax]
mov edx, 0x49febc
call fcn.00403f30
jne 0x49f7f3
push 0
push 0
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x49fd27
mov eax, dword [0x4bdae0]
mov eax, dword [eax]
mov edx, 0x49fec8
call fcn.00403f30
jne 0x49f84a
mov eax, dword [0x4bdb10]
cmp dword [eax], 0
jne 0x49f81f
mov eax, dword [0x4bdb10]
mov edx, 0x49fed4
call fcn.00403bf4
mov eax, 0x49fe0c
mov ecx, dword [0x4bdb10]
mov ecx, dword [ecx]
mov edx, 0x49fee0
call fcn.00453e98
push 0
push 1
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x49fd27
push 0
push 0
push 0x600
push ebx
call sub.user32.dll_PostMessageA
jmp 0x49fd27
lea eax, [ebp - 0x6c]
mov edx, dword [0x4c9044]
call fcn.00404314
mov eax, dword [ebp - 0x6c]
mov dx, 0x20
call fcn.00453dec
mov dword [0x4c9050], eax
mov edx, dword [esi]
mov eax, 0x4c9048
mov ecx, 0x49fef0
call fcn.00403e6c
mov eax, dword [0x4c9048]
call fcn.00408e3c
test al, al
je 0x49f8b9
push 1
push 0
push 0
mov eax, 0x4c9048
call fcn.00403ff0
push eax
push 0x49ff00
push 0
call sub.shell32.dll_ShellExecuteA
mov edx, dword [esi]
lea eax, [ebp - 0x70]
mov ecx, 0x49ff10
call fcn.00403e6c
mov eax, dword [ebp - 0x70]
call fcn.00408fc0
mov eax, dword [0x4bdb04]
mov eax, dword [eax]
call fcn.00431388
call fcn.00487764
mov ecx, dword [0x4bd96c]
mov eax, dword [0x4bdb04]
mov eax, dword [eax]
mov edx, dword [0x4856b0]
call fcn.004313a0
mov ecx, dword [0x4bdb30]
mov eax, dword [0x4bdb04]
mov eax, dword [eax]
mov edx, dword [0x4928c0]
call fcn.004313a0
mov ecx, dword [0x4bd8f8]
mov eax, dword [0x4bdb04]
mov eax, dword [eax]
mov edx, dword [0x4878f4]
call fcn.004313a0
mov eax, dword [0x4bdc74]
cmp byte [eax], 0
je 0x49f94b
mov ecx, dword [0x4bd920]
mov eax, dword [0x4bdb04]
mov eax, dword [eax]
mov edx, dword [0x491464]
call fcn.004313a0
mov eax, dword [0x4bdb30]
mov eax, dword [eax]
mov edx, dword [0x4bd96c]
mov edx, dword [edx]
mov dword [edx + 0x2f4], eax
call fcn.00487860
lea edx, [ebp - 0x78]
mov eax, 1
call fcn.00402954
mov eax, dword [ebp - 0x78]
lea edx, [ebp - 0x74]
call fcn.00408854
mov eax, dword [ebp - 0x74]
mov edx, 0x49ff28
call fcn.00403f30
jne 0x49f9ec
mov eax, 0x49fe0c
mov ecx, 0x1a803549
mov edx, 0x49ff34
call fcn.00454330
lea edx, [ebp - 0x80]
mov eax, 2
call fcn.00402954
mov eax, dword [ebp - 0x80]
lea edx, [ebp - 0x7c]
call fcn.00408854
mov eax, dword [ebp - 0x7c]
mov edx, 0x49ff44
call fcn.00403f30
jne 0x49f9dd
mov eax, 0x49fe0c
mov ecx, 0x1a803549
mov edx, 0x49ff50
call fcn.00454330
jmp 0x49f9ec
mov eax, 0x49fe0c
mov edx, 0x49ff50
call fcn.004547d0
mov dl, 1
mov eax, dword [0x40eeac]
call fcn.00402e48
mov edx, dword [0x4bdaf0]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x40ea34]
call fcn.00402e48
mov edx, dword [0x4bdaec]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x40eeac]
call fcn.00402e48
mov ebx, eax
mov edx, dword [esi]
lea eax, [ebp - 0x88]
mov ecx, 0x49ff60
call fcn.00403e6c
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 0x84]
call fcn.00404314
mov eax, dword [ebp - 0x84]
push eax
push ebx
call fcn.004557e0
test al, al
je 0x49fb62
jmp 0x49fb4e
lea ecx, [ebp - 0x90]
xor edx, edx
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x90]
lea edx, [ebp - 0x8c]
call fcn.00408a24
mov edx, dword [ebp - 0x8c]
mov eax, 0x4c9054
call fcn.00403bf4
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
cmp dword [0x4c9054], 0
je 0x49fcad
mov edx, dword [0x4c9054]
mov eax, 0x49ff74
call fcn.0040410c
mov dword [0x4bd75c], eax
cmp dword [0x4bd75c], 0
je 0x49fcad
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [0x4bd75c]
dec ecx
mov edx, 1
mov eax, dword [0x4c9054]
call fcn.00404028
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0x94]
call fcn.00408a24
mov edx, dword [ebp - 0x94]
mov eax, dword [0x4bdaf0]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0xa0]
push eax
mov edx, dword [0x4bd75c]
inc edx
mov ecx, 0x400
mov eax, dword [0x4c9054]
call fcn.00404028
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x9c]
call fcn.00408a24
mov eax, dword [ebp - 0x9c]
call fcn.00408c44
mov edx, eax
mov eax, dword [0x4bdaec]
mov eax, dword [eax]
call fcn.00410170
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jg 0x49fa5f
jmp 0x49fcad
mov edx, dword [esi]
lea eax, [ebp - 0xa8]
mov ecx, 0x49ff80
call fcn.00403e6c
mov edx, dword [ebp - 0xa8]
lea eax, [ebp - 0xa4]
call fcn.00404314
mov eax, dword [ebp - 0xa4]
push eax
push ebx
call fcn.004557e0
test al, al
je 0x49fcad
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x49fc12
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
lea ecx, [ebp - 0xac]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xac]
mov eax, 0x4c9064
call fcn.00403bf4
lea edx, [ebp - 0xb0]
mov eax, dword [0x4c9064]
call fcn.00408a24
mov edx, dword [ebp - 0xb0]
mov eax, 0x4c9068
call fcn.00403bf4
mov eax, dword [0x4c9068]
mov edx, dword [0x4c9064]
call fcn.00403f30
je 0x49fc0c
mov ecx, dword [0x4c9068]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x20]
inc esi
dec dword [ebp - 0x10]
jne 0x49fbac
lea eax, [ebp - 0xb4]
call fcn.00454f30
mov edx, dword [ebp - 0xb4]
mov eax, 0x4c9064
call fcn.00403bf4
cmp dword [0x4c9064], 0
je 0x49fc55
push 0x49ff98
push dword [0x4c9064]
push 0x49ffa4
mov eax, 0x4c9064
mov edx, 3
call fcn.00403ee0
xor esi, esi
jmp 0x49fc93
lea ecx, [ebp - 0xb8]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xb8]
mov eax, 0x4c9068
call fcn.00403bf4
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [0x4c9068]
mov edx, dword [0x4c9064]
call fcn.00403f30
je 0x49fc9e
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
cmp esi, eax
jl 0x49fc59
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jg 0x49fb4e
mov eax, ebx
call fcn.00402e78
mov eax, dword [0x4bdaf0]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x49fd08
mov eax, dword [0x4bdaf0]
mov eax, dword [eax]
mov edx, 0x49ffb0
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [0x4bdaf0]
mov eax, dword [eax]
mov edx, 0x49ffcc
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [0x4bdaec]
mov eax, dword [eax]
mov edx, 0x20b9
call fcn.00410170
mov eax, dword [0x4bdaec]
mov eax, dword [eax]
mov edx, 0x20b9
call fcn.00410170
mov eax, dword [0x4bd8a0]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4bdb04]
mov eax, dword [eax]
call fcn.00431420
mov eax, dword [0x4c9050]
call fcn.00402e78
mov eax, dword [0x4c904c]
call fcn.00402e78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49fdae
lea eax, [ebp - 0xb8]
mov edx, 5
call fcn.00403bc4
lea eax, [ebp - 0xa4]
call fcn.004041d0
lea eax, [ebp - 0xa0]
mov edx, 7
call fcn.00403bc4
lea eax, [ebp - 0x84]
call fcn.004041d0
lea eax, [ebp - 0x80]
mov edx, 5
call fcn.00403bc4
lea eax, [ebp - 0x6c]
call fcn.004041d0
lea eax, [ebp - 0x68]
mov edx, 0x14
call fcn.00403bc4
lea eax, [ebp - 0x18]
call fcn.004041d0
lea eax, [ebp - 0x14]
call fcn.00403ba0
ret