Function at 0x49d793bd
Capabilities:
Create process on windows
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x49d79818
push 0x49d91f71
mov eax, dword fs:[0]
push eax
push ecx
push ecx
mov eax, 0x1c5c0
call fcn.49d72bc6
mov eax, dword [0x49d940ac]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x1c454], eax
mov dword [ebp - 0x1c464], eax
mov esi, 0x49d79804
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
or dword [ebp - 0x1c44c], 0xffffffff
mov dword [ebp - 0x1c460], eax
mov dword [ebp - 0x1c45c], eax
mov dword [ebp - 0x1c444], 0x80010
push 0x48
pop esi
push esi
push eax
lea eax, [ebp - 0x1c4c8]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c528]
mov dword [ebp - 0x1c484], eax
mov dword [ebp - 0x1c4c8], esi
xor edi, edi
mov dword [ebp - 0x1c4c4], edi
mov dword [ebp - 0x1c4c0], edi
mov dword [ebp - 0x1c4bc], edi
mov dword [ebp - 0x1c4b8], edi
mov dword [ebp - 0x1c4b4], edi
mov dword [ebp - 0x1c4b0], edi
mov dword [ebp - 0x1c4ac], edi
mov dword [ebp - 0x1c49c], edi
xor eax, eax
inc eax
mov word [ebp - 0x1c498], ax
xor eax, eax
mov word [ebp - 0x1c496], ax
mov dword [ebp - 0x1c494], edi
push 0xfffffffffffffff6
mov esi, dword [fcn.49d712c4]
call esi
mov dword [ebp - 0x1c490], eax
push 0xfffffffffffffff5
call esi
mov dword [ebp - 0x1c48c], eax
push 0xfffffffffffffff4
call esi
mov dword [ebp - 0x1c488], eax
xor eax, eax
mov word [ebp - 0x443c], ax
mov word [ebp - 0x1043c], ax
mov dword [ebp - 0x1c458], edi
mov eax, ebx
mov dword [ebp - 0x1c448], eax
cmp ebx, edi
je 0x49d8b1f1
mov esi, 0x2000
cmp word [eax], di
je 0x49d79572
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
xor ebx, ebx
inc ebx
push 0
push eax
call fcn.49d72b03
mov dword [ebp - 0x1c448], eax
movzx ecx, word [eax]
cmp cx, 0x22
je 0x49d8b1ff
push esi
cmp cx, word [0x49db061c]
je 0x49d7ba7b
lea eax, [ebp - 0x443c]
push eax
lea eax, [ebp - 0x1c448]
push eax
push 0
call fcn.49d79839
cmp eax, ebx
je 0x49d832d3
mov eax, dword [ebp - 0x1c448]
cmp word [eax], 0
je 0x49d79572
push eax
push esi
lea eax, [ebp - 0x1043c]
push eax
call fcn.49d717fb
lea eax, [ebp - 0x1043c]
mov dword [ebp - 0x1c454], eax
cmp word [ebp - 0x443c], 0
je 0x49d8b565
cmp word [ebp - 0x443c], 0x22
je 0x49d795a3
push 0x20
lea eax, [ebp - 0x443c]
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x49d8b57b
lea eax, [ebp - 0x443c]
push eax
push esi
lea eax, [ebp - 0x1443c]
push eax
call fcn.49d717fb
lea eax, [ebp - 0x443c]
push eax
call fcn.49d71b0c
push eax
push esi
lea eax, [ebp - 0x443c]
push eax
call fcn.49d717fb
xor bl, bl
mov byte [ebp - 0x1c43d], bl
lea eax, [ebp - 0x1c468]
push eax
lea eax, [ebp - 0x443c]
push eax
push 0x2d
call fcn.49d746f3
cmp eax, 0xffffffff
jne 0x49d832ca
lea eax, [ebp - 0x443c]
push eax
push esi
lea eax, [ebp - 0x1843c]
push eax
call fcn.49d717fb
lea eax, [ebp - 0x443c]
mov dword [ebp - 0x1c5a0], eax
push esi
push eax
lea eax, [ebp - 0x1c5d8]
push eax
call fcn.49d732a0
cmp eax, 3
je 0x49d7fe6f
xor edi, edi
cmp eax, edi
je 0x49d7fe83
cmp eax, 2
je 0x49d7c782
cmp eax, 5
je 0x49d8b5a2
cmp byte [ebp - 0x1c43d], 0
jne 0x49d796a5
test bl, bl
jne 0x49d7c67e
mov ebx, dword [ebp - 0x1c454]
lea eax, [ebp - 0x1443c]
push eax
push esi
lea eax, [ebp - 0x1c43c]
push eax
call fcn.49d717fb
push 0x49d71b2c
push esi
lea eax, [ebp - 0x1c43c]
push eax
call fcn.49d71a89
cmp ebx, edi
je 0x49d79699
push ebx
push esi
lea eax, [ebp - 0x1c43c]
push eax
call fcn.49d71a89
lea eax, [ebp - 0x1c43c]
mov dword [ebp - 0x1c454], eax
cmp dword [ebp - 0x1c460], edi
jne 0x49d8044a
mov dword [ebp - 0x1c590], 0x44
lea eax, [ebp - 0x1c590]
push eax
call dword [0x49d71374]
mov eax, dword [ebp - 0x1c588]
mov dword [ebp - 0x1c4c0], eax
cmp byte [ebp - 0x1c43d], 0
jne 0x49d7fea3
mov dword [ebp - 0x1c46c], 0x20
lea eax, [ebp - 0x1c46c]
push eax
push edi
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0x1c528]
push eax
call dword [0x49d71380]
cmp eax, edi
je 0x49d8b5e4
mov dword [ebp - 0x1c480], esi
push edi
push edi
push 4
lea eax, [ebp - 0x1c480]
push eax
push 0x60001
push edi
lea eax, [ebp - 0x1c528]
push eax
call dword [0x49d7137c]
cmp eax, edi
je 0x49d8b602
lea eax, [ebp - 0x1c47c]
push eax
lea eax, [ebp - 0x1c4c8]
push eax
push dword [ebp - 0x1c458]
push dword [ebp - 0x1c464]
mov eax, dword [ebp - 0x1c444]
or eax, 0x400
push eax
push esi
push edi
push edi
push dword [ebp - 0x1c454]
lea eax, [ebp - 0x443c]
push eax
call dword [0x49d71370]
mov dword [ebp - 0x1c450], eax
lea eax, [ebp - 0x1c528]
push eax
call dword [fcn.49d71378]
cmp dword [ebp - 0x1c460], edi
jne 0x49d80458
call dword [fcn.49d712cc]
mov dword [0x49d94120], eax
cmp dword [ebp - 0x1c450], edi
je 0x49d7fdb1
cmp dword [ebp - 0x1c44c], 0xffffffff
jne 0x49d8b61c
push dword [ebp - 0x1c478]
call dword [0x49d712a4]
cmp dword [ebp - 0x1c47c], edi
je 0x49d797e3
push dword [ebp - 0x1c47c]
cmp dword [ebp - 0x1c45c], edi
jne 0x49d804b9
call dword [0x49d712a4]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.49d7139d
leave
ret 4
inc eax
inc eax
mov dword [ebp - 0x1c448], eax
lea eax, [ebp - 0x843c]
push eax
lea eax, [ebp - 0x1c448]
push eax
push ebx
call fcn.49d79839
cmp eax, ebx
je 0x49d832d3
push 0x49d7bb64
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x49d8b25c
push 0x49d7bb4c
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x49d8b359
push 0x49d7bb34
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x49d8b368
push 0x49d7bb30
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
jne 0x49d7bb76
and dword [ebp - 0x1c45c], eax
mov dword [ebp - 0x1c460], ebx
mov eax, dword [ebp - 0x1c444]
and eax, 0xffffffef
or eax, 0x200
mov dword [ebp - 0x1c444], eax
mov eax, dword [ebp - 0x1c448]
cmp word [eax], 0
jne 0x49d79506
jmp 0x49d79572
push dword [ebp - 0x843c]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x44
je 0x49d8b377
push 0x49d7bc34
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x49d8b419
push dword [ebp - 0x843c]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x49
je 0x49d8b428
push dword [ebp - 0x843c]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x3f
je 0x49d8b4f9
push 0x49d7bc2c
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x49d8b446
push 0x49d7bc24
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
jne 0x49d837b3
or dword [ebp - 0x1c49c], ebx
mov eax, 0xfffe
and word [ebp - 0x1c498], ax
or word [ebp - 0x1c498], 7
jmp 0x49d7bb1b
push str.COMSPEC
call fcn.49d71931
mov edi, eax
test edi, edi
je 0x49d8b5b7
lea eax, [ebp - 0x1443c]
push eax
push 0x49d7c710
push esi
lea eax, [ebp - 0xc43c]
push eax
call fcn.49d71799
add esp, 0x10
push edi
push esi
lea eax, [ebp - 0x443c]
push eax
call fcn.49d717fb
lea eax, [ebp - 0x443c]
push eax
push esi
lea eax, [ebp - 0x1443c]
push eax
call fcn.49d717fb
push 0x49d7c704
lea eax, [ebp - 0xc43c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x49d7c775
cmp word [ebp - 0x1043c], 0
je 0x49d7c775
lea eax, [ebp - 0x1043c]
lea edx, [eax + 2]
jmp 0x49d7c71e
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x49d7c71e
sub eax, edx
sar eax, 1
mov edx, eax
lea eax, [ebp - 0xc43c]
lea edi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x49d7c737
sub eax, edi
sar eax, 1
add eax, edx
cmp eax, esi
jae 0x49d8b5c9
push 0x49d71b2c
push esi
lea eax, [ebp - 0xc43c]
push eax
call fcn.49d71a89
lea eax, [ebp - 0x1043c]
push eax
push esi
lea eax, [ebp - 0xc43c]
push eax
call fcn.49d71a89
lea ebx, [ebp - 0xc43c]
xor edi, edi
jmp 0x49d79661
mov bl, 1
jmp 0x49d7964a
cmp byte [ebp - 0x1c43d], 0
je 0x49d7feae
push 0x3c
pop esi
push esi
push edi
lea eax, [ebp - 0x1c508]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x1c508], esi
mov dword [ebp - 0x1c504], 0x8140
test byte [ebp - 0x1c444], 0x10
je 0x49d7fdf5
mov dword [ebp - 0x1c504], 0x140
call dword [0x49d7136c]
mov dword [ebp - 0x1c500], eax
lea eax, [ebp - 0x443c]
mov dword [ebp - 0x1c4f8], eax
lea eax, [ebp - 0x1043c]
mov dword [ebp - 0x1c4f4], eax
mov eax, dword [ebp - 0x1c458]
mov dword [ebp - 0x1c4f0], eax
movzx eax, word [ebp - 0x1c498]
mov dword [ebp - 0x1c4ec], eax
mov dword [ebp - 4], edi
lea eax, [ebp - 0x1c508]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x1c450], eax
cmp eax, edi
je 0x49d83a82
mov eax, dword [ebp - 0x1c4d0]
mov dword [ebp - 0x1c47c], eax
mov dword [ebp - 4], 0xfffffffe
cmp dword [ebp - 0x1c450], edi
jne 0x49d797c3
lea eax, [ebp - 0x443c]
push eax
call fcn.49d83a1b
xor eax, eax
inc eax
jmp 0x49d797e5
mov byte [ebp - 0x1c43d], 1
lea eax, [ebp - 0x1843c]
push eax
push esi
lea eax, [ebp - 0x443c]
push eax
call fcn.49d717fb
jmp 0x49d7964a
mov dword [ebp - 0x1c450], edi
jmp 0x49d79787
cmp byte [0x49d94081], 0
je 0x49d7fec2
cmp eax, 0xc1
je 0x49d7fdbe
cmp eax, 0x2e4
je 0x49d7fdbe
jmp 0x49d7fe63
push 1
push edi
call dword [0x49d71224]
jmp 0x49d796b1
push edi
push edi
call dword [0x49d71224]
jmp 0x49d79793
call fcn.49d73d1e
mov dword [0x49d94180], eax
jmp 0x49d797e3
inc bl
xor edi, edi
jmp 0x49d7964a
mov eax, ebx
jmp 0x49d797e5
push 0x49d838a4
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x49d8b452
push 0x49d83894
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x49d8b471
push 0x49d83880
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x49d8b47d
push 0x49d8386c
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x49d8b48c
push 0x49d8385c
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x49d8b49b
push 0x49d83850
lea eax, [ebp - 0x843c]
push eax
call edi
pop ecx
pop ecx
test eax, eax
jne 0x49d8b4aa
mov dword [ebp - 0x1c45c], ebx
jmp 0x49d7bb1b
mov eax, dword [ebp - 0x1c4e8]
cmp eax, edi
je 0x49d8b653
cmp eax, 0x20
je 0x49d8b662
mov dword [0x49d94120], eax
jmp 0x49d7fe5c