Function at 0x49df40
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
sub esp, 0x64
push ebx
push esi
push edi
xor edi, edi
xor ebx, ebx
test eax, eax
je 0x49df9f
mov esi, eax
lea ecx, [esi + 2]
lea esp, [esp]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x49df60
push dword [0x54b7b4]
sub esi, ecx
sar esi, 1
add esi, esi
lea eax, [esi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov ebx, eax
xor ecx, ecx
lea eax, [ebx + 8]
push esi
push dword [ebp + 0xc]
mov dword [ebx + 4], eax
mov dword [ebx], esi
mov word [eax + esi], cx
push dword [ebx + 4]
call fcn.004dd620
add esp, 0xc
mov eax, dword [ebp + 8]
test eax, eax
je 0x49dff4
mov esi, eax
lea ecx, [esi + 2]
jmp 0x49dfb0
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x49dfb0
push dword [0x54b7b4]
sub esi, ecx
sar esi, 1
add esi, esi
lea eax, [esi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov edi, eax
xor eax, eax
lea ecx, [edi + 8]
push esi
push dword [ebp + 8]
mov dword [edi + 4], ecx
mov dword [edi], esi
mov word [ecx + esi], ax
push dword [edi + 4]
call fcn.004dd620
add esp, 0xc
jmp 0x49e0b0
test ebx, ebx
je 0x49e0b0
lea eax, [esp + 0x14]
push eax
push dword [ebx + 4]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x49e0b0
mov eax, dword [esi]
mov ecx, eax
mov dword [esp + 0x10], eax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49e020
push dword [0x54b7b4]
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
mov dword [esp + 0x10], eax
add eax, 0xa
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov ecx, dword [esp + 0xc]
mov edi, eax
lea eax, [edi + 8]
xor edx, edx
mov dword [edi + 4], eax
mov dword [edi], ecx
mov word [eax + ecx], dx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x49e06e
push ecx
push eax
push dword [edi + 4]
call fcn.004dd620
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [edi + 4]
call dword [sym.imp.ntdll.dll_RtlDoesFileExists_U]
test al, al
jne 0x49e0b0
mov ecx, dword [edi + 4]
lea eax, [esp + 0x10]
push eax
lea esi, [edi - 8]
call fcn.004a1420
test al, al
je 0x49e09c
mov edi, dword [esp + 0x10]
jmp 0x49e09e
xor edi, edi
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
dec eax
jne 0x49e0b0
mov ecx, esi
call fcn.004a2a20
mov esi, dword [ebp + 0x1c]
mov ecx, esi
and ecx, 2
mov eax, esi
shl ecx, 9
mov edx, ecx
or edx, 4
and al, 4
mov eax, esi
cmove edx, ecx
mov ecx, edx
or ecx, 0x1000000
and al, 8
mov eax, esi
cmove ecx, edx
mov edx, ecx
or edx, 0x10
and al, 0x10
mov eax, esi
cmove edx, ecx
mov ecx, edx
or ecx, 0x80000
and al, 0x20
cmove ecx, edx
cmp dword [ebp + 0x18], 0
mov dword [esp + 0xc], ecx
jne 0x49e114
push 0x44
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.004dce30
add esp, 0xc
mov dword [esp + 0x28], 0x44
cmp dword [ebp + 0x20], 0
je 0x49e161
test ebx, ebx
je 0x49e123
mov edx, dword [ebx + 4]
jmp 0x49e125
xor edx, edx
test edi, edi
je 0x49e12e
mov ecx, dword [edi + 4]
jmp 0x49e130
xor ecx, ecx
cmp dword [ebp + 0x18], 0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
cmovne eax, dword [ebp + 0x18]
and esi, 1
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [esp + 0x1c]
push esi
push 0
push 0
push edx
push ecx
push dword [ebp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x49e1a3
test ebx, ebx
je 0x49e16a
mov edx, dword [ebx + 4]
jmp 0x49e16c
xor edx, edx
test edi, edi
je 0x49e175
mov ecx, dword [edi + 4]
jmp 0x49e177
xor ecx, ecx
cmp dword [ebp + 0x18], 0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
cmovne eax, dword [ebp + 0x18]
and esi, 1
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [esp + 0x1c]
push esi
push 0
push 0
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x49e1ab
xor esi, esi
jmp 0x49e1c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x49e1c0
movzx esi, si
or esi, 0xc0070000
or ecx, 0xffffffff
test edi, edi
je 0x49e1dc
mov eax, ecx
lock xadd dword [edi - 4], eax
dec eax
jne 0x49e1dc
lea ecx, [edi - 8]
call fcn.004a2a20
or ecx, 0xffffffff
test ebx, ebx
je 0x49e1f0
lock xadd dword [ebx - 4], ecx
dec ecx
jne 0x49e1f0
lea ecx, [ebx - 8]
call fcn.004a2a20
test esi, esi
js 0x49e249
mov ecx, dword [ebp + 0x24]
test ecx, ecx
je 0x49e208
mov eax, dword [esp + 0x20]
mov dword [ecx], eax
mov eax, dword [esp + 0x24]
mov dword [ecx + 4], eax
mov ecx, dword [ebp + 0x28]
mov eax, dword [esp + 0x18]
test ecx, ecx
je 0x49e217
mov dword [ecx], eax
jmp 0x49e222
test eax, eax
je 0x49e222
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebp + 0x2c]
test eax, eax
je 0x49e23a
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x28
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x49e249
push eax
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x28