Function at 0x49b0d8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x17
push 0
push 0
dec ecx
jne 0x49b0e0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49b750
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push dword [eax + 0x3c4]
push dword [eax + 0x3c0]
lea ecx, [ebp - 0x16]
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x12]
call fcn.0040a1fc
mov eax, dword [ebp - 4]
push dword [eax + 0x3c4]
push dword [eax + 0x3c0]
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x22]
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x1e]
call fcn.00409f14
mov cx, word [ebp - 0x16]
mov dx, word [ebp - 0x14]
mov ax, word [ebp - 0x12]
call fcn.0040a07c
fstp qword [ebp - 0x88]
wait
push 0
mov cx, word [ebp - 0x22]
mov dx, word [ebp - 0x20]
mov ax, word [ebp - 0x1e]
call fcn.00409ed4
fadd qword [ebp - 0x88]
mov eax, dword [ebp - 4]
fstp qword [eax + 0x3c0]
wait
call fcn.0040a244
add esp, 0xfffffff8
fstp qword [esp]
wait
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x1a]
lea eax, [ebp - 0x18]
call fcn.0040a1fc
call fcn.0040a244
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x2a]
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x26]
call fcn.00409f14
mov cx, word [ebp - 0x1c]
mov dx, word [ebp - 0x1a]
mov ax, word [ebp - 0x18]
call fcn.0040a07c
fstp qword [ebp - 0x88]
wait
push 0
mov cx, word [ebp - 0x2a]
mov dx, word [ebp - 0x28]
mov ax, word [ebp - 0x26]
call fcn.00409ed4
fadd qword [ebp - 0x88]
fstp qword [ebp - 0x38]
wait
push dword [ebp - 0x34]
push dword [ebp - 0x38]
mov eax, dword [ebp - 4]
push dword [eax + 0x3c4]
push dword [eax + 0x3c0]
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 4]
call fcn.0049cff4
mov eax, dword [ebp - 4]
fld qword [eax + 0x3c0]
fsub qword [ebp - 0x38]
mov eax, dword [ebp - 4]
fstp qword [eax + 0x3b0]
wait
mov eax, dword [ebp - 4]
fld qword [eax + 0x3b0]
fcomp dword [0x49b760]
fnstsw ax
sahf
jbe 0x49b53e
lea eax, [ebp - 0xc]
mov edx, 0x49b76c
call fcn.004045d8
lea eax, [ebp - 0x10]
mov edx, 0x49b76c
call fcn.004045d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
cmp byte [eax + 0x38], 0
je 0x49b293
mov eax, dword [ebp - 0x78]
shl eax, 3
lea eax, [eax + eax*2]
add eax, dword [ebp - 0x74]
cmp eax, 0x63
jle 0x49b27e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov edx, 9
call fcn.004613f8
jmp 0x49b2a6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov edx, 8
call fcn.004613f8
jmp 0x49b2a6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov edx, 5
call fcn.004613f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3a4]
cmp byte [eax + 0x38], 0
je 0x49b377
mov eax, dword [ebp - 0x78]
shl eax, 3
lea eax, [eax + eax*2]
add eax, dword [ebp - 0x74]
test eax, eax
jne 0x49b377
cmp dword [ebp - 0x70], 0
jne 0x49b377
cmp dword [ebp - 0x6c], 0xa
jg 0x49b377
mov eax, dword [ebp - 0x6c]
and eax, 0x80000001
jns 0x49b2f0
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x49b308
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3cc]
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x3d0]
jmp 0x49b31a
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3d0]
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x3cc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov edx, ebx
call fcn.0043f8a8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, ebx
call fcn.0043f8a8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov edx, ebx
call fcn.00461484
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0043f8a8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov edx, esi
call fcn.00461498
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3a8]
mov eax, dword [eax + 0x68]
mov edx, esi
call fcn.0041df40
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
cmp byte [eax + 0x38], 0
je 0x49b44f
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x78]
shl eax, 3
lea eax, [eax + eax*2]
add eax, dword [ebp - 0x74]
mov dword [ebp - 0x88], eax
mov byte [ebp - 0x84], 0
lea edx, [ebp - 0x88]
xor ecx, ecx
mov eax, 0x49b778
call fcn.004095c0
push dword [ebp - 0x90]
push dword [ebp - 0xc]
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x88], eax
mov byte [ebp - 0x84], 0
lea edx, [ebp - 0x88]
xor ecx, ecx
mov eax, 0x49b778
call fcn.004095c0
push dword [ebp - 0x94]
push dword [ebp - 0x10]
lea eax, [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x88], eax
mov byte [ebp - 0x84], 0
lea edx, [ebp - 0x88]
xor ecx, ecx
mov eax, 0x49b778
call fcn.004095c0
push dword [ebp - 0x98]
lea eax, [ebp - 0x8c]
mov edx, 5
call fcn.004048c0
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
call fcn.004614d4
jmp 0x49b4d4
lea eax, [ebp - 0xa0]
push eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x88], eax
mov byte [ebp - 0x84], 0
lea edx, [ebp - 0x88]
xor ecx, ecx
mov eax, 0x49b778
call fcn.004095c0
push dword [ebp - 0xa0]
push dword [ebp - 0x10]
lea eax, [ebp - 0xa4]
push eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x88], eax
mov byte [ebp - 0x84], 0
lea edx, [ebp - 0x88]
xor ecx, ecx
mov eax, 0x49b778
call fcn.004095c0
push dword [ebp - 0xa4]
lea eax, [ebp - 0x9c]
mov edx, 3
call fcn.004048c0
mov edx, dword [ebp - 0x9c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
call fcn.004614d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov edx, dword [eax + 0x260]
mov eax, dword [0x4a09c8]
mov eax, dword [eax]
call fcn.0045f0e8
mov eax, dword [ebp - 4]
push dword [eax + 0x3e8]
push 0x49b788
lea edx, [ebp - 0xac]
mov eax, dword [0x4a09c8]
mov eax, dword [eax]
call fcn.0045f09c
push dword [ebp - 0xac]
lea eax, [ebp - 0xa8]
mov edx, 3
call fcn.004048c0
mov edx, dword [ebp - 0xa8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
call fcn.00491748
jmp 0x49b725
call fcn.0040a244
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 8]
mov eax, dword [0x4a0984]
mov eax, dword [eax]
call fcn.0040aeec
mov eax, dword [0x4a0998]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
call fcn.00404b44
test eax, eax
jle 0x49b57a
lea edx, [ebp - 8]
mov ecx, 0xff
xchg edx, eax
call fcn.00404aa0
mov eax, dword [0x4a0a28]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
call fcn.00404b44
test eax, eax
jle 0x49b59b
lea edx, [ebp - 8]
mov ecx, 0xff
xchg edx, eax
call fcn.00404aa0
lea edx, [ebp - 0xb0]
mov eax, dword [ebp - 8]
call fcn.004086cc
mov edx, dword [ebp - 0xb0]
lea eax, [ebp - 8]
call fcn.004045d8
mov eax, dword [ebp - 8]
call fcn.00404800
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
call fcn.004613f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov edx, dword [ebp - 8]
call fcn.004614d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov edx, dword [eax + 0x260]
mov eax, dword [0x4a09c8]
mov eax, dword [eax]
call fcn.0045f0e8
mov eax, dword [ebp - 4]
push dword [eax + 0x3e8]
push 0x49b788
lea edx, [ebp - 0xb8]
mov eax, dword [0x4a09c8]
mov eax, dword [eax]
call fcn.0045f09c
push dword [ebp - 0xb8]
lea eax, [ebp - 0xb4]
mov edx, 3
call fcn.004048c0
mov edx, dword [ebp - 0xb4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
call fcn.00491748
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x318]
xor edx, edx
call fcn.0042d000
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3ec], 0
je 0x49b689
push 5
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ec]
call fcn.00404a00
push eax
push 0x49b78c
mov eax, dword [ebp - 4]
call fcn.00445ef0
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c8]
call fcn.00408c98
test al, al
je 0x49b6fc
xor edx, edx
push ebp
push 0x49b6f2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x328]
add eax, 0x318
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x3c8]
call fcn.00404594
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x328]
mov byte [eax + 0x31e], 1
call fcn.00464b3c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x328]
call fcn.00464e78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49b6fc
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3f0], 0
je 0x49b70f
call fcn.00404448
jmp 0x49b725
mov eax, dword [ebp - 4]
call fcn.0049bf7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
call fcn.00490b5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b757
lea eax, [ebp - 0xb8]
mov edx, 0xc
call fcn.00404564
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404564
ret