Function at 0x49d858
Capabilities:
Create process on windows
Get common file path
Move file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x17
push 0
push 0
dec ecx
jne 0x49d860
push ecx
push ebx
push esi
push edi
mov eax, 0x49d4f0
call fcn.00406a9c
xor eax, eax
push ebp
push 0x49e371
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402954
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4bc8e8]
mov eax, dword [eax]
call fcn.00403f30
mov eax, dword [0x4bc820]
setne byte [eax]
call fcn.004029ac
lea eax, [ebp - 0x18]
call fcn.0049d454
mov edx, dword [ebp - 0x18]
mov eax, 0x49e38c
call fcn.0040410c
test eax, eax
jle 0x49d8ca
mov eax, dword [0x4bcbf4]
mov byte [eax], 0
lea ecx, [ebp - 0x1c]
mov edx, 0x49e39c
mov eax, 0x49e3b0
call fcn.00454264
mov eax, dword [ebp - 0x1c]
mov edx, dword [0x4bcb2c]
mov edx, dword [edx]
call fcn.00403f30
je 0x49d905
mov ecx, dword [0x4bcb2c]
mov ecx, dword [ecx]
mov eax, 0x49e3b0
mov edx, 0x49e39c
call fcn.00454040
lea ecx, [ebp - 0x20]
mov eax, 0x49e3b0
mov edx, 0x49e3e4
call fcn.00454264
mov eax, dword [ebp - 0x20]
mov edx, dword [0x4bc8e8]
mov edx, dword [edx]
call fcn.00403f30
je 0x49d940
mov ecx, dword [0x4bc8e8]
mov ecx, dword [ecx]
mov eax, 0x49e3b0
mov edx, 0x49e3e4
call fcn.00454040
mov edx, dword [0x4bcb2c]
mov edx, dword [edx]
mov eax, dword [0x4bc904]
mov ecx, 0x49e3f8
call fcn.00403e6c
mov edx, dword [0x4bcb2c]
mov edx, dword [edx]
mov eax, dword [0x4bcb48]
mov ecx, 0x49e410
call fcn.00403e6c
lea edx, [ebp - 0x24]
mov eax, dword [0x4bc8e8]
mov eax, dword [eax]
call fcn.00408754
mov edx, dword [ebp - 0x24]
mov eax, 0x4c804c
call fcn.00403bf4
push 0x104
mov eax, dword [0x4bc96c]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
cmp eax, 2
jb 0x49da03
lea edx, [ebp - 0x28]
mov eax, dword [0x4bc96c]
call fcn.00409464
mov edx, dword [ebp - 0x28]
mov eax, dword [0x4bc808]
call fcn.00403bf4
mov eax, dword [0x4bc808]
mov eax, dword [eax]
call fcn.00403e20
cmp eax, 3
jle 0x49d9de
mov eax, dword [0x4bc808]
mov edx, 0x49e428
call fcn.00403e28
mov eax, dword [0x4bc808]
mov eax, dword [0x4bc808]
mov eax, dword [eax]
cmp byte [eax + 1], 0x3a
jne 0x49da0b
mov eax, dword [0x4bc808]
mov eax, dword [eax]
mov al, byte [eax]
call fcn.004029e8
mov edx, dword [0x4bc968]
mov byte [edx], al
jmp 0x49da0b
mov eax, dword [0x4bc968]
mov byte [eax], 0x43
push 0x104
mov eax, dword [0x4bc96c]
push eax
push 0x49e42c
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, dword [0x4bc96c]
call fcn.00409444
mov edx, eax
mov eax, 0x4c805c
call fcn.00403d58
mov eax, 0x4c805c
call fcn.004528a8
mov eax, dword [0x4c804c]
cmp byte [eax], 0x5c
jne 0x49da54
mov eax, dword [0x4bcb44]
mov byte [eax], 2
jmp 0x49da6f
mov edx, dword [0x4c804c]
mov eax, dword [0x4c805c]
call fcn.0040410c
dec eax
jne 0x49da6f
mov eax, dword [0x4bcb44]
mov byte [eax], 1
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.00402954
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.00408790
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x4bca68]
call fcn.00403bf4
lea edx, [ebp - 0x38]
mov eax, 2
call fcn.00402954
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.00408790
mov edx, dword [ebp - 0x34]
mov eax, dword [0x4bca98]
call fcn.00403bf4
mov eax, dword [0x4bca68]
mov eax, dword [eax]
mov edx, 0x49e43c
call fcn.00403f30
jne 0x49dad4
mov eax, dword [0x4bc974]
mov byte [eax], 1
mov eax, dword [0x4bca68]
mov eax, dword [eax]
mov edx, 0x49e448
call fcn.00403f30
je 0x49dafe
mov eax, dword [0x4bca98]
mov eax, dword [eax]
mov edx, 0x49e448
call fcn.00403f30
je 0x49dafe
xor eax, eax
jmp 0x49db00
mov al, 1
test al, al
je 0x49db2a
mov eax, 0x7d0
call fcn.0045504c
mov eax, dword [0x4bc904]
mov eax, dword [eax]
call fcn.00408d78
test al, al
je 0x49db2a
mov eax, dword [0x4bc904]
mov eax, dword [eax]
call fcn.00408efc
lea eax, [ebp - 0x3c]
call fcn.00455264
mov edx, dword [ebp - 0x3c]
mov eax, 0x4c8064
call fcn.00403bf4
mov eax, dword [0x4bc974]
cmp byte [eax], 1
jne 0x49dc63
mov eax, dword [0x4bcb44]
cmp byte [eax], 0
jne 0x49dc63
mov edx, dword [0x4bcb2c]
mov edx, dword [edx]
lea eax, [ebp - 0x40]
mov ecx, 0x49e454
call fcn.00403e6c
mov eax, dword [ebp - 0x40]
call fcn.00408d78
test al, al
je 0x49dc63
mov dl, 1
mov eax, dword [0x40ede0]
call fcn.00402e48
mov ebx, eax
mov ecx, 0x49e454
mov edx, dword [0x4bcb2c]
mov edx, dword [edx]
lea eax, [ebp - 0x48]
call fcn.00403e6c
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0x44]
call fcn.00404314
mov eax, dword [ebp - 0x44]
push eax
push ebx
call fcn.004559b0
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x49dc5c
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
cmp esi, 0
jl 0x49dc34
lea ecx, [ebp - 0x4c]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x4c]
mov eax, 0x4c806c
call fcn.00403bf4
mov eax, 0x4c8068
mov ecx, 0x49e468
mov edx, dword [0x4c806c]
call fcn.00403e6c
push 1
mov eax, 0x4c806c
call fcn.00403ff0
push eax
mov eax, 0x4c8068
call fcn.00403ff0
push eax
call sub.kernel32.dll_MoveFileExA
test eax, eax
je 0x49dc2e
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
dec esi
cmp esi, 0xffffffff
jne 0x49dbd6
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x49dc5c
mov ecx, 0x49e454
mov edx, dword [0x4bcb2c]
mov edx, dword [edx]
lea eax, [ebp - 0x50]
call fcn.00403e6c
mov eax, dword [ebp - 0x50]
call fcn.00408efc
mov eax, ebx
call fcn.00402e78
mov dl, 1
mov eax, dword [0x44ae58]
call fcn.00402e48
mov dword [0x4c8054], eax
lea edx, [ebp - 0x5c]
mov eax, dword [0x4bcb2c]
mov eax, dword [eax]
call fcn.00408754
mov eax, dword [ebp - 0x5c]
call fcn.0044b030
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x58]
call fcn.00408b10
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x54]
mov edx, 0x49e478
call fcn.00403e6c
mov edx, dword [ebp - 0x54]
mov eax, dword [0x4c8054]
call fcn.0044aee4
test eax, eax
jne 0x49dd6f
mov eax, 0x49e48c
xor edx, edx
call fcn.00455168
mov ebx, eax
test ebx, ebx
je 0x49e2d9
mov eax, 0x3e8
call fcn.0045504c
mov eax, dword [0x4bca68]
mov eax, dword [eax]
mov edx, 0x49e4a4
call fcn.00403f30
jne 0x49dd03
push 0
push 0
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x49e2d9
mov eax, dword [0x4bca68]
mov eax, dword [eax]
mov edx, 0x49e4b0
call fcn.00403f30
jne 0x49dd5b
mov eax, dword [0x4bca98]
cmp dword [eax], 0
jne 0x49dd2f
mov eax, dword [0x4bca98]
mov edx, 0x49e4bc
call fcn.00403bf4
mov eax, dword [0x4bca98]
mov eax, dword [eax]
push eax
mov eax, 0x49e3b0
mov edx, 0x49e4c8
pop ecx
call fcn.00454040
push 0
push 1
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x49e2d9
push 0
push 0
push 0x600
push ebx
call sub.user32.dll_PostMessageA
jmp 0x49e2d9
lea eax, [ebp - 0x60]
mov edx, dword [0x4c804c]
call fcn.00404314
mov eax, dword [ebp - 0x60]
mov dx, 0x20
call fcn.00453f94
mov dword [0x4c8058], eax
mov edx, dword [0x4bcb2c]
mov edx, dword [edx]
lea eax, [ebp - 0x64]
mov ecx, 0x49e4d8
call fcn.00403e6c
mov eax, dword [ebp - 0x64]
call fcn.00408d78
test al, al
je 0x49de70
mov dl, 1
mov eax, dword [0x40ede0]
call fcn.00402e48
mov ebx, eax
mov edx, dword [0x4bcb2c]
mov edx, dword [edx]
lea eax, [ebp - 0x6c]
mov ecx, 0x49e4d8
call fcn.00403e6c
mov edx, dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
call fcn.00404314
mov eax, dword [ebp - 0x68]
push eax
push ebx
call fcn.004559b0
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, 2
jl 0x49de69
lea ecx, [ebp - 0x74]
mov edx, 1
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x74]
lea edx, [ebp - 0x70]
call fcn.00408960
mov edx, dword [ebp - 0x70]
mov eax, 0x4c8050
call fcn.00403bf4
cmp dword [0x4c8050], 0
je 0x49de69
mov edx, dword [0x4bcb2c]
mov edx, dword [edx]
mov eax, 0x4c8050
mov ecx, 0x49e4f0
call fcn.00403e6c
mov eax, dword [0x4c8050]
call fcn.00408d78
test al, al
je 0x49de69
push 1
push 0
push 0
mov eax, 0x4c8050
call fcn.00403ff0
push eax
push 0x49e500
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, ebx
call fcn.00402e78
mov eax, dword [0x4bca8c]
mov eax, dword [eax]
call fcn.004312bc
call fcn.00487408
mov ecx, dword [0x4bc900]
mov eax, dword [0x4bca8c]
mov eax, dword [eax]
mov edx, dword [0x4853b8]
call fcn.004312d4
mov ecx, dword [0x4bcab8]
mov eax, dword [0x4bca8c]
mov eax, dword [eax]
mov edx, dword [0x489178]
call fcn.004312d4
mov ecx, dword [0x4bc888]
mov eax, dword [0x4bca8c]
mov eax, dword [eax]
mov edx, dword [0x487598]
call fcn.004312d4
mov eax, dword [0x4bcbf4]
cmp byte [eax], 0
je 0x49deeb
mov ecx, dword [0x4bc8b0]
mov eax, dword [0x4bca8c]
mov eax, dword [eax]
mov edx, dword [0x49d1f0]
call fcn.004312d4
mov eax, dword [0x4bcab8]
mov eax, dword [eax]
mov edx, dword [0x4bc900]
mov edx, dword [edx]
mov dword [edx + 0x2f4], eax
call fcn.00487504
lea edx, [ebp - 0x7c]
mov eax, 1
call fcn.00402954
mov eax, dword [ebp - 0x7c]
lea edx, [ebp - 0x78]
call fcn.00408790
mov eax, dword [ebp - 0x78]
mov edx, 0x49e510
call fcn.00403f30
jne 0x49df92
mov eax, 0x49e3b0
mov ecx, 0x1a803549
mov edx, 0x49e51c
call fcn.004544d8
lea edx, [ebp - 0x84]
mov eax, 2
call fcn.00402954
mov eax, dword [ebp - 0x84]
lea edx, [ebp - 0x80]
call fcn.00408790
mov eax, dword [ebp - 0x80]
mov edx, 0x49e52c
call fcn.00403f30
jne 0x49df83
mov eax, 0x49e3b0
mov ecx, 0x1a803549
mov edx, 0x49e538
call fcn.004544d8
jmp 0x49df92
mov eax, 0x49e3b0
mov edx, 0x49e538
call fcn.00454978
mov dl, 1
mov eax, dword [0x40ede0]
call fcn.00402e48
mov edx, dword [0x4bca78]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x40e968]
call fcn.00402e48
mov edx, dword [0x4bca74]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x40ede0]
call fcn.00402e48
mov ebx, eax
mov edx, dword [0x4bcb2c]
mov edx, dword [edx]
lea eax, [ebp - 0x8c]
mov ecx, 0x49e548
call fcn.00403e6c
mov edx, dword [ebp - 0x8c]
lea eax, [ebp - 0x88]
call fcn.00404314
mov eax, dword [ebp - 0x88]
push eax
push ebx
call fcn.004559b0
test al, al
je 0x49e10e
jmp 0x49e0fa
lea ecx, [ebp - 0x94]
xor edx, edx
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x94]
lea edx, [ebp - 0x90]
call fcn.00408960
mov edx, dword [ebp - 0x90]
mov eax, 0x4c8060
call fcn.00403bf4
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
cmp dword [0x4c8060], 0
je 0x49e25f
mov edx, dword [0x4c8060]
mov eax, 0x49e55c
call fcn.0040410c
mov dword [0x4bc6f8], eax
cmp dword [0x4bc6f8], 0
je 0x49e25f
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [0x4bc6f8]
dec ecx
mov edx, 1
mov eax, dword [0x4c8060]
call fcn.00404028
mov eax, dword [ebp - 0x9c]
lea edx, [ebp - 0x98]
call fcn.00408960
mov edx, dword [ebp - 0x98]
mov eax, dword [0x4bca78]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0xa4]
push eax
mov edx, dword [0x4bc6f8]
inc edx
mov ecx, 0x400
mov eax, dword [0x4c8060]
call fcn.00404028
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0xa0]
call fcn.00408960
mov eax, dword [ebp - 0xa0]
call fcn.00408b80
mov edx, eax
mov eax, dword [0x4bca74]
mov eax, dword [eax]
call fcn.004100a4
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jg 0x49e00b
jmp 0x49e25f
mov edx, dword [0x4bcb2c]
mov edx, dword [edx]
lea eax, [ebp - 0xac]
mov ecx, 0x49e568
call fcn.00403e6c
mov edx, dword [ebp - 0xac]
lea eax, [ebp - 0xa8]
call fcn.00404314
mov eax, dword [ebp - 0xa8]
push eax
push ebx
call fcn.004559b0
test al, al
je 0x49e25f
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x49e1c4
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
lea ecx, [ebp - 0xb0]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xb0]
mov eax, 0x4c8070
call fcn.00403bf4
lea edx, [ebp - 0xb4]
mov eax, dword [0x4c8070]
call fcn.00408960
mov edx, dword [ebp - 0xb4]
mov eax, 0x4c8074
call fcn.00403bf4
mov eax, dword [0x4c8074]
mov edx, dword [0x4c8070]
call fcn.00403f30
je 0x49e1be
mov ecx, dword [0x4c8074]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x20]
inc esi
dec dword [ebp - 0x10]
jne 0x49e15e
lea eax, [ebp - 0xb8]
call fcn.004550d8
mov edx, dword [ebp - 0xb8]
mov eax, 0x4c8070
call fcn.00403bf4
cmp dword [0x4c8070], 0
je 0x49e207
push 0x49e580
push dword [0x4c8070]
push 0x49e58c
mov eax, 0x4c8070
mov edx, 3
call fcn.00403ee0
xor esi, esi
jmp 0x49e245
lea ecx, [ebp - 0xbc]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xbc]
mov eax, 0x4c8074
call fcn.00403bf4
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [0x4c8074]
mov edx, dword [0x4c8070]
call fcn.00403f30
je 0x49e250
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
cmp esi, eax
jl 0x49e20b
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jg 0x49e0fa
mov eax, ebx
call fcn.00402e78
mov eax, dword [0x4bca78]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x49e2ba
mov eax, dword [0x4bca78]
mov eax, dword [eax]
mov edx, 0x49e598
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [0x4bca78]
mov eax, dword [eax]
mov edx, 0x49e5b4
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [0x4bca74]
mov eax, dword [eax]
mov edx, 0x20b9
call fcn.004100a4
mov eax, dword [0x4bca74]
mov eax, dword [eax]
mov edx, 0x20b9
call fcn.004100a4
mov eax, dword [0x4bc830]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4bca8c]
mov eax, dword [eax]
call fcn.00431354
mov eax, dword [0x4c8058]
call fcn.00402e78
mov eax, dword [0x4c8054]
call fcn.00402e78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e37b
lea eax, [ebp - 0xbc]
mov edx, 5
call fcn.00403bc4
lea eax, [ebp - 0xa8]
call fcn.004041d0
lea eax, [ebp - 0xa4]
mov edx, 7
call fcn.00403bc4
lea eax, [ebp - 0x88]
call fcn.004041d0
lea eax, [ebp - 0x84]
mov edx, 7
call fcn.00403bc4
lea eax, [ebp - 0x68]
call fcn.004041d0
lea eax, [ebp - 0x64]
call fcn.00403ba0
lea eax, [ebp - 0x60]
call fcn.004041d0
lea eax, [ebp - 0x5c]
mov edx, 6
call fcn.00403bc4
lea eax, [ebp - 0x44]
call fcn.004041d0
lea eax, [ebp - 0x40]
mov edx, 0xc
call fcn.00403bc4
ret