Function at 0x59db22
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x5c
mov eax, 0x6b189e
call fcn.006426c4
sub esp, 0x3c
xor eax, eax
push ebx
push esi
push edi
push 7
mov esi, ecx
lea edi, [ebp - 0x48]
pop ecx
rep stosd dword es:[edi], eax
xor ebx, ebx
mov eax, 0x400
push ebx
push eax
push eax
push ebx
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
movzx ecx, byte [esi]
test ecx, ecx
jne 0x59db66
xor eax, eax
inc eax
jmp 0x59e08a
lea eax, [ecx - 2]
cmp eax, 3
jae 0x59e088
mov byte [esi + 8], bl
mov byte [esi], bl
cmp ecx, 2
jne 0x59db81
cmp byte [esi + 9], bl
jne 0x59db5e
cmp ecx, 3
jne 0x59dbc0
mov eax, dword [0x7e4fd0]
inc dword [0x7b11e8]
push dword [eax*4 + 0x7a469c]
push str.Failed_to_connect_to_host_at:__s
push 0x80
call fcn.0048941f
mov eax, dword [0x7e4fd0]
add esp, 0xc
dec eax
and eax, 1
mov dword [0x7e4fd0], eax
or eax, 0xffffffff
jmp 0x59e08a
inc dword [0x7b11e4]
cmp ecx, 4
jne 0x59dbd3
push 2
pop eax
jmp 0x59e08a
push 0
lea ebx, [esi + 0xc]
push str.info
lea eax, [ebp + 0x30]
mov dword [ebp + 0x48], ebx
push eax
mov ecx, ebx
call fcn.0045e8eb
and dword [ebp - 4], 0
cmp dword [ebp + 0x40], 0
je 0x59dc7a
call fcn.005817cb
test al, al
jne 0x59dc7a
test byte [esi + 4], 2
je 0x59dc7a
push 0
push str.infotype
mov ecx, ebx
call fcn.0045e6b8
test eax, eax
jne 0x59dc1f
push 0x40
pop eax
jmp 0x59dc2a
dec eax
neg eax
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x30
cmp dword [ebp + 0x44], 8
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x2c], 1
jae 0x59dc40
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x18]
push 0x6c408c
push eax
call fcn.00465d7f
add esp, 0xc
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 1
jb 0x59dc5e
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0058eef2
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0
call fcn.004285f6
push 0
push 0x6d05e8
mov ecx, ebx
call fcn.0045e842
mov edi, eax
test edi, edi
je 0x59dcaf
cmp dword [edi], 0x70747468
jne 0x59dcaf
push edi
call fcn.0046d080
test eax, eax
je 0x59dcaf
push 5
xor eax, eax
push eax
push eax
push edi
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push str.u.msg
lea eax, [ebp]
mov ecx, ebx
push eax
call fcn.0045e8eb
mov eax, dword fs:[0x2c]
mov edi, dword [0x7e59f0]
mov byte [ebp - 4], 2
mov ecx, dword [eax + edi*4]
mov eax, dword [0x7e5350]
cmp eax, dword [ecx + 4]
jle 0x59dd6b
mov ebx, 0x7e5350
push ebx
call fcn.00642848
cmp dword [0x7e5350], 0xffffffff
pop ecx
jne 0x59dd6b
push str.u.url
mov ecx, 0x7e52d8
call fcn.0040f32f
push str.u.siz
mov ecx, 0x7e52f0
mov byte [ebp - 4], 3
call fcn.0040f32f
push str.u.sha
mov ecx, 0x7e5308
mov byte [ebp - 4], 4
call fcn.0040f32f
push str.u.sig
mov ecx, 0x7e5320
mov byte [ebp - 4], 5
call fcn.0040f32f
push str.u.ver
mov ecx, 0x7e5338
mov byte [ebp - 4], 6
call fcn.0040f32f
push 0x6befd5
mov byte [ebp - 4], 2
call fcn.006426af
push ebx
call fcn.00642809
pop ecx
pop ecx
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + edi*4]
mov eax, dword [0x7e53d0]
cmp eax, dword [ecx + 4]
jle 0x59de0b
mov edi, 0x7e53d0
push edi
call fcn.00642848
cmp dword [0x7e53d0], 0xffffffff
pop ecx
jne 0x59de0b
push str.l.url
mov ecx, 0x7e5358
call fcn.0040f32f
push str.l.siz
mov ecx, 0x7e5370
mov byte [ebp - 4], 7
call fcn.0040f32f
push str.l.sha
mov ecx, 0x7e5388
mov byte [ebp - 4], 8
call fcn.0040f32f
push str.l.sig
mov ecx, 0x7e53a0
mov byte [ebp - 4], 9
call fcn.0040f32f
push str.l.ver
mov ecx, 0x7e53b8
mov byte [ebp - 4], 0xa
call fcn.0040f32f
push 0x6beff3
mov byte [ebp - 4], 2
call fcn.006426af
push edi
call fcn.00642809
pop ecx
pop ecx
push 0x7e52d8
lea ebx, [esi + 0x20]
mov ecx, esi
push ebx
call fcn.0059fb32
test al, al
je 0x59dfbb
push 0x7e5358
lea eax, [esi + 0x54]
mov ecx, esi
push eax
call fcn.0059fb32
test al, al
je 0x59dfbb
mov eax, dword [esi + 0x78]
lea ecx, [esi + 0x44]
or eax, dword [ecx]
je 0x59dfee
test dword [esi + 4], 0x1000
mov al, 1
push 6
mov dword [ebp + 0x58], 4
pop edi
mov byte [ebp + 0x5f], al
je 0x59deb8
call fcn.005817cb
test al, al
jne 0x59deb2
cmp dword [ebp + 0x14], 8
mov eax, dword [ebp]
jae 0x59de76
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
push 0x80a6
push dword [0x7c1ee4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x4e
push 0x4e
push 0xffffffffffffffff
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
lea ecx, [esi + 0x44]
test eax, eax
je 0x59deb5
cmp dword [ebp - 0x3c], 0
mov edi, dword [ebp - 0x40]
setne al
jmp 0x59deb8
lea ecx, [esi + 0x44]
mov al, byte [ebp + 0x5f]
sub edi, 6
je 0x59defc
sub edi, 1
jne 0x59dfa9
test al, al
jne 0x59def4
mov dword [ebp + 0x58], 3
cmp dword [ecx], edi
je 0x59dedd
mov eax, dword [esi + 0x40]
mov dword [0x7b1040], eax
cmp dword [esi + 0x78], 0
je 0x59dfa9
mov eax, dword [esi + 0x74]
mov dword [0x7b1044], eax
jmp 0x59dfa9
push 2
pop eax
jmp 0x59dfac
mov byte [ebp + 0x5f], 1
call fcn.00479151
lea eax, [esi + 0x44]
mov byte [ebp - 4], 0xb
xor edi, edi
mov dword [ebp + 0x58], 1
sub eax, ebx
mov byte [esi], 4
mov dword [ebp + 0x4c], eax
cmp dword [eax + ebx], 0
je 0x59df6d
inc byte [esi]
mov eax, dword [0x7af720]
push 0x7af720
mov dword [ebp + 0x50], 0x7af720
call dword [eax + 4]
xor eax, eax
mov byte [ebp - 4], 0xc
push eax
push eax
push eax
lea eax, [ebp + 0x50]
push eax
push 0x59d8d7
push ebx
push dword [edi + esi + 0x20]
call fcn.00467be1
mov eax, dword [ebp + 0x50]
mov byte [ebp - 4], 0xd
test eax, eax
je 0x59df66
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x4c]
mov byte [ebp - 4], 0xb
add edi, 0x34
add ebx, 0x34
cmp edi, 0x68
jne 0x59df1d
test dword [esi + 4], 0x1000
je 0x59df9c
call fcn.005817cb
test al, al
jne 0x59df9c
push 0
push 0
push 0x10
push dword [0x7c1ee4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov byte [ebp - 4], 0xe
call fcn.00479192
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x58]
push eax
push 0x7b1000
mov ecx, esi
call fcn.0059ed0e
jmp 0x59dfee
test byte [esi + 4], 2
je 0x59dfee
call fcn.005817cb
test al, al
jne 0x59dfee
push 0x478
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], 0x30
call fcn.0058dfbe
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0058eef2
pop ecx
pop ecx
mov edi, dword [ebp + 0x48]
xor ebx, ebx
push ebx
push 0x6d2fec
mov ecx, edi
call fcn.0045e842
mov esi, eax
test esi, esi
je 0x59e019
push esi
call fcn.0040f53e
pop ecx
push eax
push esi
mov ecx, 0x7b1060
call fcn.0040f2b7
push ebx
push 0x6d9db0
mov ecx, edi
call fcn.0045e842
test eax, eax
je 0x59e072
lea ecx, [ebp + 0x5f]
mov byte [ebp + 0x5f], bl
push ecx
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.004ccb35
cmp byte [ebp + 0x5f], bl
je 0x59e072
mov byte [ebp + 0x57], 1
call fcn.00479151
mov ecx, dword [0x7b5024]
lea eax, [ebp + 0x1c]
push 1
push eax
mov byte [ebp - 4], 0xf
call fcn.00516081
push 1
lea eax, [ebp + 0x1c]
push eax
call fcn.0048ff2e
mov byte [ebp - 4], 0x10
call fcn.00479192
push ebx
push 1
lea ecx, [ebp]
call fcn.004285f6
push ebx
push 1
lea ecx, [ebp + 0x30]
call fcn.004285f6
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
lea esp, [ebp + 0x60]
pop ebp
ret