Function at 0x49ea00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
mov eax, 0x5e4abc
push ebx
push esi
push edi
mov esi, 0x5f9d24
lea ebx, [ebp - 0x60]
call fcn.005a26b0
mov word [ebx + 0x10], 0xc
xor edx, edx
lea ecx, [ebp - 8]
mov dword [ebp - 8], edx
push ecx
inc dword [ebx + 0x1c]
mov edx, 0x5e43cd
lea eax, [ebp - 4]
call fcn.005b0490
inc dword [ebx + 0x1c]
mov edx, dword [eax]
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ecx + 0x3b0]
call fcn.004468a8
lea edx, [ebp - 8]
lea eax, [ebp - 0x10]
mov ecx, dword [edx]
mov edx, str.x7fx7ax66x79x5ex43x42x57x5ex54
push ecx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
push eax
inc dword [ebx + 0x1c]
lea eax, [ebp - 0xc]
call fcn.005b0490
inc dword [ebx + 0x1c]
mov edx, dword [eax]
mov ecx, dword [esi]
mov eax, dword [ecx]
mov ecx, dword [eax + 0x3b0]
mov eax, dword [esi]
mov eax, dword [eax]
call fcn.004468a8
lea edx, [ebp - 0x10]
mov ecx, dword [edx]
push ecx
call fcn.0042b760
add esp, 8
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.005b05bc
dec dword [ebx + 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.005b05bc
dec dword [ebx + 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.005b05bc
dec dword [ebx + 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005b05bc
mov word [ebx + 0x10], 0x18
xor ecx, ecx
mov edx, 0x5e440c
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x18]
push ecx
lea eax, [ebp - 0x14]
inc dword [ebx + 0x1c]
call fcn.005b0490
inc dword [ebx + 0x1c]
mov edx, dword [eax]
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [esi]
mov edi, dword [eax]
mov ecx, dword [ecx + 0x3b0]
mov eax, edi
call fcn.004468a8
mov eax, dword [esi]
lea edx, [ebp - 0x18]
mov ecx, dword [eax]
mov eax, edi
mov edx, dword [edx]
mov ecx, dword [ecx + 0x3cc]
call fcn.00441b38
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.005b05bc
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.005b05bc
push 5
push 0
mov word [ebx + 0x10], 0x24
xor ecx, ecx
mov edx, str.x71x2x65x6cx60x42x59x51x40x59x54x74x51x44x57x6ax6ex5cx17x5ax43
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x20]
push ecx
lea eax, [ebp - 0x1c]
inc dword [ebx + 0x1c]
call fcn.005b0490
inc dword [ebx + 0x1c]
mov edx, dword [eax]
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ecx + 0x3b0]
call fcn.004468a8
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x24]
xor ecx, ecx
call fcn.005b0218
inc dword [ebx + 0x1c]
lea edx, [ebp - 0x24]
inc dword [ebx + 0x1c]
mov dword [ebp - 0x68], edx
mov ecx, dword [ebp - 0x68]
cmp dword [ecx], 0
jne 0x49eba9
mov eax, 0x5e44af
jmp 0x49ebae
mov edx, dword [ebp - 0x68]
mov eax, dword [edx]
push eax
xor edx, edx
mov dword [ebp - 0x2c], edx
lea ecx, [ebp - 0x2c]
push ecx
inc dword [ebx + 0x1c]
mov edx, 0x5e4458
lea eax, [ebp - 0x28]
call fcn.005b0490
inc dword [ebx + 0x1c]
mov edx, dword [eax]
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ecx + 0x3b0]
call fcn.004468a8
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x30]
xor ecx, ecx
call fcn.005b0218
inc dword [ebx + 0x1c]
lea edx, [ebp - 0x30]
inc dword [ebx + 0x1c]
mov dword [ebp - 0x64], edx
mov ecx, dword [ebp - 0x64]
cmp dword [ecx], 0
jne 0x49ec08
mov eax, 0x5e44ae
jmp 0x49ec0d
mov edx, dword [ebp - 0x64]
mov eax, dword [edx]
push eax
xor edx, edx
mov dword [ebp - 0x38], edx
lea ecx, [ebp - 0x38]
push ecx
inc dword [ebx + 0x1c]
mov edx, 0x5e444b
lea eax, [ebp - 0x34]
call fcn.005b0490
inc dword [ebx + 0x1c]
mov edx, dword [eax]
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ecx + 0x3b0]
call fcn.004468a8
lea edx, [ebp - 0x38]
lea eax, [ebp - 0x3c]
xor ecx, ecx
call fcn.005b0218
inc dword [ebx + 0x1c]
lea edi, [ebp - 0x3c]
inc dword [ebx + 0x1c]
cmp dword [edi], 0
jne 0x49ec61
mov eax, 0x5e44ad
jmp 0x49ec63
mov eax, dword [edi]
push eax
push 0
call sub.SHELL32.DLL_ShellExecuteA
sub dword [ebx + 0x1c], 2
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.0042b660
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.005b05bc
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.005b05bc
sub dword [ebx + 0x1c], 2
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.0042b660
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.005b05bc
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.005b05bc
sub dword [ebx + 0x1c], 2
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0042b660
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.005b05bc
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.005b05bc
mov ecx, dword [ebx]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret