Function at 0x49abf0
Capabilities:
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x6019e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 1
mov dword [ebp - 0x48], edx
mov esi, ecx
push 4
push 0x61e714
or edx, 0xffffffff
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
call fcn.004b42d0
add esp, 0xc
test eax, eax
jne 0x49ac78
push esi
push 0x61e71c
push 0x118
push 0x64d420
call fcn.00401140
push esi
push str._s.exe
push 0x1000
push 0x62c420
mov ebx, eax
call fcn.00401140
push 0x61e728
lea eax, [ebp - 0x3c]
push 0x62c420
push eax
call fcn.0058c7cb
add esp, 0x2c
jmp 0x49acce
test esi, esi
jne 0x49ac80
xor eax, eax
jmp 0x49ac8e
push 0x1000
push esi
call fcn.0058d536
add esp, 8
lea ecx, [eax - 1]
test ecx, ecx
js 0x49acaa
mov al, byte [ecx + esi]
mov edx, 0x61e72c
cmp al, byte [edx]
je 0x49ae4a
sub ecx, 1
jns 0x49ac95
push esi
push 0x61e734
push 0x118
push 0x64d420
call fcn.00401140
mov ebx, eax
add esp, 0x10
mov byte [ebx + 0x64d41c], 0x5f
sub ebx, 3
lea edx, [ebp - 0x38]
mov ecx, esi
call fcn.00403f10
test eax, eax
jne 0x49ad2b
lea edx, [ebx + 0x64d420]
xor edi, edi
movzx ecx, byte [ebp + edi - 0x38]
lea edx, [edx + 2]
mov eax, ecx
inc edi
shr eax, 4
and ecx, 0xf
movzx eax, byte [eax + 0x5f10e0]
mov byte [edx - 2], al
movzx eax, byte [ecx + 0x5f10e0]
mov byte [edx - 1], al
cmp edi, 0x30
jl 0x49ace4
mov byte [edx], 0
lea ecx, [ebx + 0x64d430]
push 5
push str..exe
mov edx, 5
call fcn.00401000
add esp, 8
push 0x61e740
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.0058c7cb
mov eax, dword [ebp - 0x3c]
add esp, 0xc
test eax, eax
je 0x49af7f
push 0
push 0
push eax
mov dword [0x62b158], 0x64d420
call fcn.005890ed
add esp, 0xc
push dword [ebp - 0x3c]
push 2
push 1
push 0x62c420
call fcn.0058d9e0
movzx eax, word [0x62c420]
add esp, 0x10
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, 0x4d5a
cmp ax, cx
jne 0x49af74
push 0
push 0x3c
push dword [ebp - 0x3c]
call fcn.005890ed
add esp, 0xc
push dword [ebp - 0x3c]
push 4
push 1
push 0x62c420
call fcn.0058d9e0
push 0
push dword [0x62c420]
push dword [ebp - 0x3c]
call fcn.005890ed
add esp, 0x1c
push dword [ebp - 0x3c]
push 0x18
push 1
push 0x62c420
call fcn.0058d9e0
add esp, 0x10
cmp dword [0x62c420], 0x4550
jne 0x49af74
movzx esi, word [0x62c434]
lea eax, [esi + 0x24]
call fcn.00585a60
mov ecx, esp
mov edx, esi
push 1
push 4
call fcn.004aec40
mov esi, eax
lea eax, [esi + 4]
mov dword [esi], eax
push dword [ebp - 0x3c]
push dword [esi - 0x10]
push 1
push esi
call fcn.0058d9e0
movzx eax, word [esi]
add esp, 0x18
cmp eax, 0x10b
je 0x49ae74
cmp eax, 0x20b
je 0x49ae62
push dword [ebp - 0x3c]
call fcn.00588cf7
add esp, 4
lea esp, [ebp - 0x5c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005852a8
mov esp, ebp
pop ebp
ret
test ecx, ecx
jle 0x49acaa
lea eax, [esi + 1]
add eax, ecx
push eax
push 0x61e730
jmp 0x49acb0
mov eax, dword [esi + 0x90]
test eax, eax
je 0x49ae86
push 0
add eax, 0xfffffff0
push eax
jmp 0x49ae8a
mov eax, dword [esi + 0x80]
test eax, eax
je 0x49ae86
push 0
add eax, 0xfffffff0
push eax
jmp 0x49ae8a
push 2
push 0xfffffffffffffff0
push dword [ebp - 0x3c]
call fcn.005890ed
add esp, 0xc
push dword [ebp - 0x3c]
push 0x10
push 1
push 0x62c420
call fcn.0058d9e0
add esp, 0x10
mov esi, str.B996015880544A19B7F7E9BE44914C18
xor edi, edi
mov ecx, esi
call fcn.004ad300
add esi, 2
mov byte [edi + 0x62d420], al
lea edi, [edi + 1]
cmp esi, 0x622820
jl 0x49aeb0
mov ecx, 0x62c420
mov edx, 0x62d420
mov esi, 0xc
nop word [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x49af74
add ecx, 4
add edx, 4
sub esi, 4
jae 0x49aee0
push 1
push 0xffffffffffffffec
push dword [ebp - 0x3c]
call fcn.005890ed
add esp, 0xc
lea eax, [ebp - 0x40]
push dword [ebp - 0x3c]
push 4
push 1
push eax
call fcn.0058d9e0
add esp, 0x10
push dword [ebp - 0x40]
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, eax
mov eax, 0xfffffffc
push 1
sub eax, ecx
mov dword [ebp - 0x40], ecx
push eax
push dword [ebp - 0x3c]
call fcn.005890ed
mov esi, dword [ebp - 0x40]
add esp, 0xc
inc esi
push esi
call fcn.0058db11
mov ebx, eax
add esp, 4
mov dword [ebp - 0x44], ebx
test ebx, ebx
je 0x49afa3
push esi
push 0
push ebx
call fcn.00587250
add esp, 0xc
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 1
push ebx
call fcn.0058d9e0
mov eax, dword [ebp - 0x40]
add esp, 0x10
mov byte [ebx + eax], 0
push dword [ebp - 0x3c]
call fcn.00588cf7
add esp, 4
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
mov dword [ecx], eax
lea esp, [ebp - 0x5c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005852a8
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x624148
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x4c4
push 0x624164
push 0x624180
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3