Function at 0x496dd4
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4970d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi]
push eax
call sub.kernel32.dll_FreeLibrary_1
mov eax, dword [esi]
push eax
call sub.kernel32.dll_FreeLibrary_1
lea eax, [ebp - 8]
mov ecx, 0x4970f0
mov edx, edi
call fcn.00404ff4
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040a10c
mov edx, edi
mov eax, ebx
call fcn.0040a10c
mov eax, 0x400
call fcn.00402b50
mov esi, eax
mov eax, 0x200
call fcn.00402b50
mov ebx, eax
mov byte [esi], 0x3a
mov byte [esi + 1], 0x74
mov byte [esi + 2], 0x72
mov byte [esi + 3], 0x79
mov byte [esi + 4], 0xd
mov byte [esi + 5], 0xa
mov byte [esi + 6], 0x64
mov byte [esi + 7], 0x65
mov byte [esi + 8], 0x6c
mov byte [esi + 9], 0x20
mov byte [esi + 0xa], 0x22
mov byte [esi + 0xb], 0
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00402f98
lea eax, [ebp - 0xc]
mov edx, 0x497100
call fcn.00404fb0
mov eax, dword [ebp - 0xc]
call fcn.004051a8
push eax
push esi
call sub.kernel32.dll_lstrcatA
mov byte [ebx], 0x2f
mov byte [ebx + 1], 0x71
mov byte [ebx + 2], 0xd
mov byte [ebx + 3], 0xa
mov byte [ebx + 4], 0x69
mov byte [ebx + 5], 0x66
mov byte [ebx + 6], 0x20
mov byte [ebx + 7], 0x65
mov byte [ebx + 8], 0x78
mov byte [ebx + 9], 0x69
mov byte [ebx + 0xa], 0x73
mov byte [ebx + 0xb], 0x74
mov byte [ebx + 0xc], 0x20
mov byte [ebx + 0xd], 0x22
mov byte [ebx + 0xe], 0
push ebx
push esi
call sub.kernel32.dll_lstrcatA
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402f98
lea eax, [ebp - 0x10]
mov edx, 0x4970f0
call fcn.00404fb0
mov eax, dword [ebp - 0x10]
call fcn.004051a8
push eax
push esi
call sub.kernel32.dll_lstrcatA
mov byte [ebx], 0x22
mov byte [ebx + 1], 0x20
mov byte [ebx + 2], 0x67
mov byte [ebx + 3], 0x6f
mov byte [ebx + 4], 0x74
mov byte [ebx + 5], 0x6f
mov byte [ebx + 6], 0x20
mov byte [ebx + 7], 0x74
mov byte [ebx + 8], 0x72
mov byte [ebx + 9], 0x79
mov byte [ebx + 0xa], 0
push ebx
push esi
call sub.kernel32.dll_lstrcatA
push 0x497110
push edi
push 0x49711c
xor eax, eax
mov al, byte [ebp + 8]
push dword [eax*4 + 0x531de0]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00405068
mov eax, dword [ebp - 0x14]
call fcn.004051a8
push eax
push esi
call sub.kernel32.dll_lstrcatA
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402f98
lea eax, [ebp - 0x18]
mov edx, 0x497128
call fcn.00404fb0
mov eax, dword [ebp - 0x18]
call fcn.004051a8
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 0x497130
push esi
call sub.kernel32.dll_lstrcatA
push 0x49713c
push esi
call sub.kernel32.dll_lstrcatA
push 0x49714c
lea eax, [ebp - 0x120]
mov edx, ebx
call fcn.00403964
lea edx, [ebp - 0x120]
lea eax, [ebp - 0x20]
call fcn.00404f4c
push dword [ebp - 0x20]
push 0x497158
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405068
mov eax, dword [ebp - 0x1c]
call fcn.004051a8
push eax
push esi
call sub.kernel32.dll_lstrcatA
push 0x497168
lea eax, [ebp - 0x128]
mov edx, ebx
call fcn.00404ee0
push dword [ebp - 0x128]
push 0x497180
lea eax, [ebp - 0x124]
mov edx, 3
call fcn.00405068
mov eax, dword [ebp - 0x124]
call fcn.004051a8
push eax
push esi
call sub.kernel32.dll_lstrcatA
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.kernel32.dll_CreateFileA_1
mov edi, eax
cmp edi, 0xffffffff
je 0x497098
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x12c]
mov edx, esi
call fcn.00404ee0
mov eax, dword [ebp - 0x12c]
call fcn.00404fa8
push eax
push esi
push edi
call sub.kernel32.dll_WriteFile_1
push edi
call sub.kernel32.dll_CloseHandle_1
push 0
push ebx
call sub.kernel32.dll_WinExec
mov eax, ebx
call fcn.00402b80
mov eax, esi
call fcn.00402b80
xor eax, eax
call fcn.00404c4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4970df
lea eax, [ebp - 0x12c]
mov edx, 3
call fcn.00404d0c
lea eax, [ebp - 0x20]
mov edx, 7
call fcn.00404d0c
ret