Function at 0x597ec1
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x5c
mov eax, 0x6a618b
call fcn.006375a8
sub esp, 0x3c
xor eax, eax
push ebx
push esi
push edi
push 7
mov esi, ecx
lea edi, [ebp - 0x48]
pop ecx
rep stosd dword es:[edi], eax
xor ebx, ebx
mov eax, 0x400
push ebx
push eax
push eax
push ebx
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
movzx ecx, byte [esi]
test ecx, ecx
jne 0x597f05
xor eax, eax
inc eax
jmp 0x598429
lea eax, [ecx - 2]
cmp eax, 3
jae 0x598427
mov byte [esi + 8], bl
mov byte [esi], bl
cmp ecx, 2
jne 0x597f20
cmp byte [esi + 9], bl
jne 0x597efd
cmp ecx, 3
jne 0x597f5f
mov eax, dword [0x7d29dc]
inc dword [0x79fc94]
push dword [eax*4 + 0x793c60]
push str.Failed_to_connect_to_host_at:__s
push 0x80
call fcn.00485eae
mov eax, dword [0x7d29dc]
add esp, 0xc
dec eax
and eax, 1
mov dword [0x7d29dc], eax
or eax, 0xffffffff
jmp 0x598429
inc dword [0x79fc90]
cmp ecx, 4
jne 0x597f72
push 2
pop eax
jmp 0x598429
push 0
lea ebx, [esi + 0xc]
push str.info
lea eax, [ebp + 0x30]
mov dword [ebp + 0x48], ebx
push eax
mov ecx, ebx
call fcn.0045c894
and dword [ebp - 4], 0
cmp dword [ebp + 0x40], 0
je 0x598019
call fcn.0057c48f
test al, al
jne 0x598019
test byte [esi + 4], 2
je 0x598019
push 0
push str.infotype
mov ecx, ebx
call fcn.0045c661
test eax, eax
jne 0x597fbe
push 0x40
pop eax
jmp 0x597fc9
dec eax
neg eax
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x30
cmp dword [ebp + 0x44], 8
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x2c], 1
jae 0x597fdf
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x18]
push 0x6b6d5c
push eax
call fcn.004638e7
add esp, 0xc
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 1
jb 0x597ffd
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00589668
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0
call fcn.004267c2
push 0
push 0x6c3118
mov ecx, ebx
call fcn.0045c7eb
mov edi, eax
test edi, edi
je 0x59804e
cmp dword [edi], 0x70747468
jne 0x59804e
push edi
call fcn.0046a47c
test eax, eax
je 0x59804e
push 5
xor eax, eax
push eax
push eax
push edi
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push str.u.msg
lea eax, [ebp]
mov ecx, ebx
push eax
call fcn.0045c894
mov eax, dword fs:[0x2c]
mov edi, dword [0x7d3240]
mov byte [ebp - 4], 2
mov ecx, dword [eax + edi*4]
mov eax, dword [0x7d2c30]
cmp eax, dword [ecx + 4]
jle 0x59810a
mov ebx, 0x7d2c30
push ebx
call fcn.0063772c
cmp dword [0x7d2c30], 0xffffffff
pop ecx
jne 0x59810a
push str.u.url
mov ecx, 0x7d2bb8
call fcn.0040d4cf
push str.u.siz
mov ecx, 0x7d2bd0
mov byte [ebp - 4], 3
call fcn.0040d4cf
push str.u.sha
mov ecx, 0x7d2be8
mov byte [ebp - 4], 4
call fcn.0040d4cf
push str.u.sig
mov ecx, 0x7d2c00
mov byte [ebp - 4], 5
call fcn.0040d4cf
push str.u.ver
mov ecx, 0x7d2c18
mov byte [ebp - 4], 6
call fcn.0040d4cf
push 0x6b2cc4
mov byte [ebp - 4], 2
call fcn.00637590
push ebx
call fcn.006376ed
pop ecx
pop ecx
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + edi*4]
mov eax, dword [0x7d2cb0]
cmp eax, dword [ecx + 4]
jle 0x5981aa
mov edi, 0x7d2cb0
push edi
call fcn.0063772c
cmp dword [0x7d2cb0], 0xffffffff
pop ecx
jne 0x5981aa
push str.l.url
mov ecx, 0x7d2c38
call fcn.0040d4cf
push str.l.siz
mov ecx, 0x7d2c50
mov byte [ebp - 4], 7
call fcn.0040d4cf
push str.l.sha
mov ecx, 0x7d2c68
mov byte [ebp - 4], 8
call fcn.0040d4cf
push str.l.sig
mov ecx, 0x7d2c80
mov byte [ebp - 4], 9
call fcn.0040d4cf
push str.l.ver
mov ecx, 0x7d2c98
mov byte [ebp - 4], 0xa
call fcn.0040d4cf
push 0x6b2ce2
mov byte [ebp - 4], 2
call fcn.00637590
push edi
call fcn.006376ed
pop ecx
pop ecx
push 0x7d2bb8
lea ebx, [esi + 0x20]
mov ecx, esi
push ebx
call fcn.00599af4
test al, al
je 0x59835a
push 0x7d2c38
lea eax, [esi + 0x54]
mov ecx, esi
push eax
call fcn.00599af4
test al, al
je 0x59835a
mov eax, dword [esi + 0x78]
lea ecx, [esi + 0x44]
or eax, dword [ecx]
je 0x59838d
test dword [esi + 4], 0x1000
mov al, 1
push 6
mov dword [ebp + 0x58], 4
pop edi
mov byte [ebp + 0x5f], al
je 0x598257
call fcn.0057c48f
test al, al
jne 0x598251
cmp dword [ebp + 0x14], 8
mov eax, dword [ebp]
jae 0x598215
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
push 0x80a5
push dword [0x7b0818]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x4e
push 0x4e
push 0xffffffffffffffff
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
lea ecx, [esi + 0x44]
test eax, eax
je 0x598254
cmp dword [ebp - 0x3c], 0
mov edi, dword [ebp - 0x40]
setne al
jmp 0x598257
lea ecx, [esi + 0x44]
mov al, byte [ebp + 0x5f]
sub edi, 6
je 0x59829b
sub edi, 1
jne 0x598348
test al, al
jne 0x598293
mov dword [ebp + 0x58], 3
cmp dword [ecx], edi
je 0x59827c
mov eax, dword [esi + 0x40]
mov dword [0x79faec], eax
cmp dword [esi + 0x78], 0
je 0x598348
mov eax, dword [esi + 0x74]
mov dword [0x79faf0], eax
jmp 0x598348
push 2
pop eax
jmp 0x59834b
mov byte [ebp + 0x5f], 1
call fcn.00475cf1
lea eax, [esi + 0x44]
mov byte [ebp - 4], 0xb
xor edi, edi
mov dword [ebp + 0x58], 1
sub eax, ebx
mov byte [esi], 4
mov dword [ebp + 0x4c], eax
cmp dword [eax + ebx], 0
je 0x59830c
inc byte [esi]
mov eax, dword [0x79e2a8]
push 0x79e2a8
mov dword [ebp + 0x50], 0x79e2a8
call dword [eax + 4]
xor eax, eax
mov byte [ebp - 4], 0xc
push eax
push eax
push eax
lea eax, [ebp + 0x50]
push eax
push 0x597c76
push ebx
push dword [edi + esi + 0x20]
call fcn.0046581f
mov eax, dword [ebp + 0x50]
mov byte [ebp - 4], 0xd
test eax, eax
je 0x598305
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x4c]
mov byte [ebp - 4], 0xb
add edi, 0x34
add ebx, 0x34
cmp edi, 0x68
jne 0x5982bc
test dword [esi + 4], 0x1000
je 0x59833b
call fcn.0057c48f
test al, al
jne 0x59833b
push 0
push 0
push 0x10
push dword [0x7b0818]
call dword [sym.imp.USER32.dll_PostMessageW]
mov byte [ebp - 4], 0xe
call fcn.00475d32
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x58]
push eax
push 0x79faac
mov ecx, esi
call fcn.00599075
jmp 0x59838d
test byte [esi + 4], 2
je 0x59838d
call fcn.0057c48f
test al, al
jne 0x59838d
push 0x46b
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], 0x30
call fcn.00588778
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00589668
pop ecx
pop ecx
mov edi, dword [ebp + 0x48]
xor ebx, ebx
push ebx
push 0x6c587c
mov ecx, edi
call fcn.0045c7eb
mov esi, eax
test esi, esi
je 0x5983b8
push esi
call fcn.0040d6de
pop ecx
push eax
push esi
mov ecx, 0x79fb0c
call fcn.0040d457
push ebx
push 0x6cc570
mov ecx, edi
call fcn.0045c7eb
test eax, eax
je 0x598411
lea ecx, [ebp + 0x5f]
mov byte [ebp + 0x5f], bl
push ecx
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.004c8ee5
cmp byte [ebp + 0x5f], bl
je 0x598411
mov byte [ebp + 0x57], 1
call fcn.00475cf1
mov ecx, dword [0x7a3ad0]
lea eax, [ebp + 0x1c]
push 1
push eax
mov byte [ebp - 4], 0xf
call fcn.005122f0
push 1
lea eax, [ebp + 0x1c]
push eax
call fcn.0048cbc2
mov byte [ebp - 4], 0x10
call fcn.00475d32
push ebx
push 1
lea ecx, [ebp]
call fcn.004267c2
push ebx
push 1
lea ecx, [ebp + 0x30]
call fcn.004267c2
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
lea esp, [ebp + 0x60]
pop ebp
ret