Function at 0x49a8c0
Capabilities:
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x6009e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 1
mov dword [ebp - 0x48], edx
mov esi, ecx
push 4
push 0x616b00
or edx, 0xffffffff
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
call fcn.004b3b30
add esp, 0xc
test eax, eax
jne 0x49a948
push esi
push 0x616b08
push 0x118
push 0x6457a0
call fcn.00401140
push esi
push str._s.exe
push 0x1000
push 0x6247a0
mov ebx, eax
call fcn.00401140
push 0x616b14
lea eax, [ebp - 0x3c]
push 0x6247a0
push eax
call fcn.0058bf3b
add esp, 0x2c
jmp 0x49a99e
test esi, esi
jne 0x49a950
xor eax, eax
jmp 0x49a95e
push 0x1000
push esi
call fcn.0058cca6
add esp, 8
lea ecx, [eax - 1]
test ecx, ecx
js 0x49a97a
mov al, byte [ecx + esi]
mov edx, 0x616b18
cmp al, byte [edx]
je 0x49ab1a
sub ecx, 1
jns 0x49a965
push esi
push 0x616b20
push 0x118
push 0x6457a0
call fcn.00401140
mov ebx, eax
add esp, 0x10
mov byte [ebx + 0x64579c], 0x5f
sub ebx, 3
lea edx, [ebp - 0x38]
mov ecx, esi
call fcn.00403e40
test eax, eax
jne 0x49a9fb
lea edx, [ebx + 0x6457a0]
xor edi, edi
movzx ecx, byte [ebp + edi - 0x38]
lea edx, [edx + 2]
mov eax, ecx
inc edi
shr eax, 4
and ecx, 0xf
movzx eax, byte [eax + 0x5f00e0]
mov byte [edx - 2], al
movzx eax, byte [ecx + 0x5f00e0]
mov byte [edx - 1], al
cmp edi, 0x30
jl 0x49a9b4
mov byte [edx], 0
lea ecx, [ebx + 0x6457b0]
push 5
push str..exe
mov edx, 5
call fcn.00401000
add esp, 8
push 0x616b2c
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.0058bf3b
mov eax, dword [ebp - 0x3c]
add esp, 0xc
test eax, eax
je 0x49ac4f
push 0
push 0
push eax
mov dword [0x6234d8], 0x6457a0
call fcn.0058885d
add esp, 0xc
push dword [ebp - 0x3c]
push 2
push 1
push 0x6247a0
call fcn.0058d150
movzx eax, word [0x6247a0]
add esp, 0x10
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, 0x4d5a
cmp ax, cx
jne 0x49ac44
push 0
push 0x3c
push dword [ebp - 0x3c]
call fcn.0058885d
add esp, 0xc
push dword [ebp - 0x3c]
push 4
push 1
push 0x6247a0
call fcn.0058d150
push 0
push dword [0x6247a0]
push dword [ebp - 0x3c]
call fcn.0058885d
add esp, 0x1c
push dword [ebp - 0x3c]
push 0x18
push 1
push 0x6247a0
call fcn.0058d150
add esp, 0x10
cmp dword [0x6247a0], 0x4550
jne 0x49ac44
movzx esi, word [0x6247b4]
lea eax, [esi + 0x24]
call fcn.005851e0
mov ecx, esp
mov edx, esi
push 1
push 4
call fcn.004ae4d0
mov esi, eax
lea eax, [esi + 4]
mov dword [esi], eax
push dword [ebp - 0x3c]
push dword [esi - 0x10]
push 1
push esi
call fcn.0058d150
movzx eax, word [esi]
add esp, 0x18
cmp eax, 0x10b
je 0x49ab44
cmp eax, 0x20b
je 0x49ab32
push dword [ebp - 0x3c]
call fcn.00588467
add esp, 4
lea esp, [ebp - 0x5c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00584a28
mov esp, ebp
pop ebp
ret
test ecx, ecx
jle 0x49a97a
lea eax, [esi + 1]
add eax, ecx
push eax
push 0x616b1c
jmp 0x49a980
mov eax, dword [esi + 0x90]
test eax, eax
je 0x49ab56
push 0
add eax, 0xfffffff0
push eax
jmp 0x49ab5a
mov eax, dword [esi + 0x80]
test eax, eax
je 0x49ab56
push 0
add eax, 0xfffffff0
push eax
jmp 0x49ab5a
push 2
push 0xfffffffffffffff0
push dword [ebp - 0x3c]
call fcn.0058885d
add esp, 0xc
push dword [ebp - 0x3c]
push 0x10
push 1
push 0x6247a0
call fcn.0058d150
add esp, 0x10
mov esi, str.B996015880544A19B7F7E9BE44914C18
xor edi, edi
mov ecx, esi
call fcn.004acb90
add esi, 2
mov byte [edi + 0x6257a0], al
lea edi, [edi + 1]
cmp esi, 0x61abe0
jl 0x49ab80
mov ecx, 0x6247a0
mov edx, 0x6257a0
mov esi, 0xc
nop word [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x49ac44
add ecx, 4
add edx, 4
sub esi, 4
jae 0x49abb0
push 1
push 0xffffffffffffffec
push dword [ebp - 0x3c]
call fcn.0058885d
add esp, 0xc
lea eax, [ebp - 0x40]
push dword [ebp - 0x3c]
push 4
push 1
push eax
call fcn.0058d150
add esp, 0x10
push dword [ebp - 0x40]
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, eax
mov eax, 0xfffffffc
push 1
sub eax, ecx
mov dword [ebp - 0x40], ecx
push eax
push dword [ebp - 0x3c]
call fcn.0058885d
mov esi, dword [ebp - 0x40]
add esp, 0xc
inc esi
push esi
call fcn.0058d200
mov ebx, eax
add esp, 4
mov dword [ebp - 0x44], ebx
test ebx, ebx
je 0x49ac73
push esi
push 0
push ebx
call fcn.005869c0
add esp, 0xc
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 1
push ebx
call fcn.0058d150
mov eax, dword [ebp - 0x40]
add esp, 0x10
mov byte [ebx + eax], 0
push dword [ebp - 0x3c]
call fcn.00588467
add esp, 4
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
mov dword [ecx], eax
lea esp, [ebp - 0x5c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00584a28
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x61c4e8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x4c4
push 0x61c504
push 0x61c520
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3