Function at 0x4a5a61
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x290]
sub esp, 0x320
mov eax, dword [0x5e5710]
xor eax, ebp
mov dword [ebp + 0x28c], eax
mov eax, dword [ebp + 0x2a0]
mov dword [ebp + 0x7c], eax
mov eax, dword [ebp + 0x2a4]
mov dword [ebp + 0x78], eax
mov eax, dword [ebp + 0x2a8]
push ebx
push esi
mov esi, dword [ebp + 0x298]
mov dword [ebp + 0x74], eax
mov eax, dword [ebp + 0x2ac]
push edi
mov dword [ebp + 0x58], eax
mov eax, dword [ebp + 0x2b4]
xor ebx, ebx
push 0x206
mov dword [ebp + 0x70], eax
lea eax, [ebp + 0x86]
push ebx
push eax
mov dword [ebp + 0x5c], esi
mov word [ebp + 0x84], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp + 0x84]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x84]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.knewvip.exe
lea eax, [ebp + 0x84]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x40
lea eax, [ebp - 0x70]
push ebx
push eax
call sub.MSVCR80.dll_memset
xor eax, eax
mov dword [ebp + 0x60], ebx
lea edi, [ebp + 0x64]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
add esp, 0xc
inc eax
push eax
push 3
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x74], 0x44
mov dword [ebp - 0x48], eax
mov word [ebp - 0x44], 0xa
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_int_]
cmp esi, ebx
mov esi, 0x58b0ec
push esi
je 0x4a5b4d
push dword [ebp + 0x5c]
jmp 0x4a5b54
lea eax, [ebp + 0x84]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004a58b3
pop ecx
pop ecx
push eax
call fcn.004a58b3
pop ecx
pop ecx
push dword [ebp + 0x29c]
lea eax, [ebp - 0x28]
push str._open_opction
push eax
call fcn.004a58b3
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int_]
cmp dword [ebp + 0x7c], ebx
mov edi, 0x58b0f0
je 0x4a5bca
push dword [ebp + 0x7c]
call dword [sym.imp.MSVCR80.dll_wcslen]
test eax, eax
pop ecx
jbe 0x4a5bca
push edi
push dword [ebp + 0x7c]
lea eax, [ebp - 0x28]
push str._token_
push esi
push eax
call fcn.004a58b3
pop ecx
pop ecx
push eax
call fcn.004a58b3
pop ecx
pop ecx
push eax
call fcn.004a58b3
pop ecx
pop ecx
push eax
call fcn.004a58b3
pop ecx
pop ecx
cmp dword [ebp + 0x78], ebx
je 0x4a5c0a
push dword [ebp + 0x78]
call dword [sym.imp.MSVCR80.dll_wcslen]
test eax, eax
pop ecx
jbe 0x4a5c0a
push edi
push dword [ebp + 0x78]
lea eax, [ebp - 0x28]
push str._url_
push esi
push eax
call fcn.004a58b3
pop ecx
pop ecx
push eax
call fcn.004a58b3
pop ecx
pop ecx
push eax
call fcn.004a58b3
pop ecx
pop ecx
push eax
call fcn.004a58b3
pop ecx
pop ecx
mov eax, dword [ebp + 0x58]
push dword [eax]
lea eax, [ebp - 0x28]
push str._from
push esi
push eax
call fcn.004a58b3
pop ecx
pop ecx
push eax
call fcn.004a58b3
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int_]
cmp dword [ebp + 0x74], ebx
je 0x4a5c59
push dword [ebp + 0x74]
lea eax, [ebp - 0x28]
push str._parent
push esi
push eax
call fcn.004a58b3
pop ecx
pop ecx
push eax
call fcn.004a58b3
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int_]
cmp byte [ebp + 0x2b0], bl
je 0x4a5c8a
movzx eax, byte [ebp + 0x2b0]
push eax
push str._delay_show
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004a58b3
pop ecx
pop ecx
push eax
call fcn.004a58b3
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int_]
cmp dword [ebp + 0x70], ebx
je 0x4a5cb3
push dword [ebp + 0x70]
lea eax, [ebp - 0x28]
push str._url_param
push esi
push eax
call fcn.004a58b3
pop ecx
pop ecx
push eax
call fcn.004a58b3
pop ecx
pop ecx
push eax
call fcn.004a58b3
pop ecx
pop ecx
cmp dword [ebp + 0x2b8], ebx
jle 0x4a5ce2
push dword [ebp + 0x2b8]
lea eax, [ebp - 0x28]
push str._width
push esi
push eax
call fcn.004a58b3
pop ecx
pop ecx
push eax
call fcn.004a58b3
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int_]
cmp dword [ebp + 0x2bc], ebx
jle 0x4a5d11
push dword [ebp + 0x2bc]
lea eax, [ebp - 0x28]
push str._height
push esi
push eax
call fcn.004a58b3
pop ecx
pop ecx
push eax
call fcn.004a58b3
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int_]
cmp dword [ebp + 0x2c0], ebx
jle 0x4a5d40
push dword [ebp + 0x2c0]
lea eax, [ebp - 0x28]
push str._interceptpop
push esi
push eax
call fcn.004a58b3
pop ecx
pop ecx
push eax
call fcn.004a58b3
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int_]
cmp byte [ebp + 0x2c4], bl
je 0x4a5d71
movzx eax, byte [ebp + 0x2c4]
push eax
push str._top_most
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004a58b3
pop ecx
pop ecx
push eax
call fcn.004a58b3
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int_]
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::str_void_]
mov ecx, eax
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
lea ecx, [ebp - 0x90]
setne byte [ebp + 0x83]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
cmp dword [ebp + 0x64], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4a5dc7
push dword [ebp + 0x64]
call esi
mov dword [ebp + 0x64], ebx
cmp dword [ebp + 0x60], ebx
je 0x4a5dd4
push dword [ebp + 0x60]
call esi
mov dword [ebp + 0x60], ebx
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::vbase_dtor_void_]
mov ecx, dword [ebp + 0x28c]
mov al, byte [ebp + 0x83]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056f17c
add ebp, 0x290
leave
ret