Function at 0x49d030
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x616790
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x448
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
push 0x6c0948
mov dword [ebp - 4], esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, esi
je 0x49d180
push 0x6be53c
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x49d16f
lea ecx, [ebp - 0x38]
lea edx, [ebp - 0x454]
push ecx
push edx
push 0x6bd840
push 0x6be530
push 2
push esi
mov dword [ebp - 0x38], 0x104
call eax
cmp eax, esi
jne 0x49d16f
lea eax, [ebp - 0x454]
push 0x5c
push eax
call fcn.005de073
mov esi, eax
add esp, 8
test esi, esi
je 0x49d16f
add esi, 2
push 0x6be69c
push esi
call fcn.005e07bc
add esp, 8
test eax, eax
je 0x49d125
push 0x6be684
push esi
call fcn.005e07bc
add esp, 8
test eax, eax
je 0x49d125
push 0x6be63c
push esi
call fcn.005e07bc
add esp, 8
test eax, eax
je 0x49d125
push 0x6be580
push esi
call fcn.005e07bc
add esp, 8
test eax, eax
je 0x49d125
push 0x6be0bc
push esi
call fcn.005e07bc
add esp, 8
test eax, eax
jne 0x49d16f
mov ecx, dword [ebp + 0xc]
xor esi, esi
push esi
push ecx
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x30], si
call fcn.00402d00
mov eax, dword [ebp - 0x34]
cmp eax, esi
jne 0x49d148
lea eax, [ebp - 0x30]
push 1
push esi
lea edx, [ebp - 0x454]
push eax
mov eax, dword [ebp + 8]
push edx
push 0x6bd840
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x34]
mov edi, 1
call fcn.00401070
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
cmp edi, esi
jne 0x49d393
xor eax, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x18], si
mov ecx, dword [0x6ec760]
mov byte [ebp - 4], 1
cmp ecx, esi
mov esi, ecx
jne 0x49d1a1
mov esi, 0x6ec764
mov ecx, 0x6bc11c
test ecx, ecx
je 0x49d2a5
test esi, esi
je 0x49d2a5
mov edx, 0x6c3e70
test edx, edx
je 0x49d2a5
push ecx
lea ecx, [ebp - 0x44]
call fcn.00402350
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040e020
push 0x6c3e70
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.0040e020
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.00401070
mov edi, dword [ebp - 0x28]
test edi, edi
jne 0x49d200
lea edi, [ebp - 0x24]
mov esi, dword [ebp - 0x3c]
lea ecx, [ebp - 0x34]
call fcn.004023d0
push eax
call fcn.005de123
push edi
mov ebx, eax
call fcn.005de123
add esi, ebx
lea ebx, [eax + esi + 3]
lea esi, [ebx + ebx]
push esi
call fcn.005f6c5c
mov edi, eax
add esp, 0xc
test edi, edi
mov dword [ebp - 0x1c], edi
je 0x49d27e
mov ecx, esi
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x34]
call fcn.004023d0
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.004023d0
lea ecx, [ebp - 0x44]
mov edi, eax
call fcn.004023d0
push esi
push edi
push eax
mov eax, dword [ebp - 0x1c]
push ebx
push eax
call fcn.005de0b3
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.005de123
add esp, 0x18
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.00401070
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00401070
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x1c]
xor ebx, ebx
cmp eax, ebx
jne 0x49d2ae
lea eax, [ebp - 0x18]
push 0x6c3e68
push eax
call fcn.005df7bf
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x49d2da
push esi
push 0xd
push 1
push 0x6c3e58
call fcn.005df655
push esi
call fcn.005df5d8
add esp, 0x14
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x24c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
jne 0x49d2f3
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x24c]
push edx
push ebx
push eax
call dword [sym.imp.SHELL32.dll_FindExecutableW]
cmp eax, 0x20
jle 0x49d35f
lea eax, [ebp - 0x24c]
push eax
call fcn.005de123
add esp, 4
test eax, eax
je 0x49d35f
mov ecx, dword [ebp + 0xc]
push ebx
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x24], bx
call fcn.00402d00
mov eax, dword [ebp - 0x28]
cmp eax, ebx
jne 0x49d33b
lea eax, [ebp - 0x24]
push 1
push ebx
lea edx, [ebp - 0x24c]
push eax
mov eax, dword [ebp + 8]
push edx
push 0x6bd840
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x28]
call fcn.00401070
jmp 0x49d376
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push 1
push ebx
push ebx
push ecx
push 0x6bc04c
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
jne 0x49d380
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.00401070
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret