Function at 0x49b702
Capabilities:
Create process on windows

Disassembly:
push 0x274
mov eax, 0x6c353c
call fcn.00432a44
mov byte [ebp - 0x221], dl
mov ebx, ecx
lea ecx, [ebp - 0x228]
call fcn.004366f5
and dword [ebp - 4], 0
lea ecx, [ebp - 0x228]
call fcn.00437b82
lea eax, [ebp - 0x22c]
push eax
push 1
push 0
push 0x49b9a0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x49b762
push eax
call fcn.00435aec
mov esi, eax
test esi, esi
jns 0x49b762
mov edi, esi
jmp 0x49b788
mov ecx, dword [ebp - 0x22c]
lea eax, [ebp - 0x228]
push eax
call fcn.0049b157
push dword [ebp - 0x22c]
mov esi, eax
mov edi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jns 0x49b79e
cmp edi, 0x80070002
jne 0x49b982
mov esi, 0x805e000c
jmp 0x49b982
lea ecx, [ebp - 0x220]
call fcn.004366f5
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x220]
push 0x22
pop esi
push esi
call fcn.00497099
mov eax, dword [ebp - 0x228]
lea ecx, [ebp - 0x220]
push dword [eax - 0xc]
push eax
call fcn.00439535
push 0x438e70
lea ecx, [ebp - 0x220]
call fcn.00439500
cmp byte [ebp - 0x221], 0
jne 0x49b890
cmp byte [0x6fe672], 0
jne 0x49b819
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push eax
mov ecx, 0x6fe668
call fcn.0060fb9f
cmp byte [0x6fe672], 0
jne 0x49b819
xor eax, eax
jmp 0x49b827
mov eax, dword [0x6fe66c]
test eax, eax
jne 0x49b827
mov eax, dword [0x6fe668]
mov edi, 0x105
lea ecx, [ebp - 0x21c]
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x49b87b
cmp eax, edi
jae 0x49b87b
push 0x49ba24
lea ecx, [ebp - 0x220]
call fcn.00439500
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.00439500
push 0x49ba34
lea ecx, [ebp - 0x220]
call fcn.00439500
test ebx, ebx
jne 0x49b8a0
jmp 0x49b8ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00435aec
mov esi, eax
xor ebx, ebx
jmp 0x49b971
test ebx, ebx
je 0x49b8b8
push esi
lea ecx, [ebp - 0x220]
call fcn.00497099
push ebx
lea ecx, [ebp - 0x220]
call fcn.00439500
push esi
lea ecx, [ebp - 0x220]
call fcn.00497099
push 0x40
xor ebx, ebx
mov dword [ebp - 0x280], 0x44
lea eax, [ebp - 0x27c]
push ebx
push eax
call fcn.00436326
add esp, 0xc
xor ecx, ecx
inc ecx
mov dword [ebp - 0x254], ecx
push 5
pop eax
mov word [ebp - 0x250], ax
mov eax, dword [ebp - 0x220]
cmp dword [eax - 4], ecx
jle 0x49b908
push dword [eax - 0xc]
lea ecx, [ebp - 0x220]
call fcn.00439c6c
mov eax, dword [ebp - 0x220]
lea ecx, [ebp - 0x23c]
push ecx
lea ecx, [ebp - 0x280]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push eax
call fcn.004050cb
push 0xffffffffffffffff
lea ecx, [ebp - 0x220]
mov esi, eax
call fcn.00439c15
test esi, esi
jns 0x49b959
cmp esi, 0x80070002
je 0x49b952
cmp esi, 0x80070003
jne 0x49b971
mov esi, 0x805e000c
jmp 0x49b971
push dword [ebp - 0x23c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x238]
call esi
mov esi, ebx
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.0040119b
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.0040119b
mov eax, esi
call fcn.00402698
ret