Function at 0x49bfde
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8c
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x208
mov dword [ebp - 0xa38], eax
xor ebx, ebx
lea eax, [ebp - 0x414]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0xa30], edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x414]
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x208
lea eax, [ebp - 0x61c]
push ebx
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x414]
push eax
push str._s_system32cmd.exe
lea eax, [ebp - 0x61c]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x1c
call fcn.00403a64
push eax
lea ecx, [ebp - 0xa34]
call fcn.00402a6b
lea eax, [ebp - 0xa34]
mov ecx, edi
push eax
call fcn.004983e4
mov esi, dword [ebp - 0xa34]
test eax, eax
je 0x49c25c
push 0x551
push 0x53f078
push 0x2712
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x44
lea eax, [ebp - 0xa8c]
push ebx
push eax
call sub.msvcrt.dll_memset
or dword [ebp - 0xa60], 1
lea edi, [ebp - 0xa48]
xor eax, eax
mov dword [ebp - 0xa8c], 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov edi, 0x410
mov word [ebp - 0xa5c], ax
push edi
lea eax, [ebp - 0xa2c]
push ebx
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0xa38]
lea eax, [ebp - 0xa2c]
push esi
push 0x53f0d0
push edi
push eax
call fcn.0044b53c
add esp, 0x30
lea eax, [ebp - 0xa48]
push eax
lea eax, [ebp - 0xa8c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xa2c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x49c25c
push 0x208
lea eax, [ebp - 0x20c]
mov edi, ebx
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xa30]
add esp, 0xc
cmp dword [eax + 0x8d8], ebx
jne 0x49c1dc
mov esi, eax
push 0x3e8
push dword [ebp - 0xa44]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x49c1c8
mov eax, edi
inc edi
cmp eax, 0xa
jle 0x49c1c0
cmp edi, 0x258
jge 0x49c1c0
push 6
pop ecx
mov eax, edi
cdq
idiv ecx
push eax
push str._._colorrgb_102_102_102____.__d__
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004329e6
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push str._._colorrgb_102_102_102____._C:WindowsMemory.dmp
push 0x2711
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esi + 0x8d8], ebx
je 0x49c15f
mov eax, dword [ebp - 0xa30]
mov esi, dword [ebp - 0xa34]
cmp dword [eax + 0x8d8], ebx
je 0x49c206
lea eax, [ebp - 0xa38]
push eax
push dword [ebp - 0xa44]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0xa38]
push dword [ebp - 0xa44]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ebx, ebx
inc ebx
jmp 0x49c25c
cmp edi, 0xa
jle 0x49c246
push 0x64
push str._._colorrgb_102_102_102____.__d__
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004329e6
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0xa30]
push str._._colorrgb_102_102_102____._C:WindowsMemory.dmp
push 0x2711
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0xa44]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0xa48]
call edi
lea ecx, [esi - 0x10]
call fcn.004042e9
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret 4