Function at 0x489a3b
Capabilities:
Reference wmi statements
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
xor ebx, ebx
push 3
push 0x73fdd0
push edx
mov edi, ebx
mov dword [esp + 0x34], ebx
xor edx, edx
mov dword [esp + 0x28], ebx
mov esi, ebx
mov dword [esp + 0x24], edi
call fcn.00488caf
add esp, 0xc
mov dword [esp + 0x14], eax
mov ecx, dword [eax]
push 2
pop edx
mov eax, dword [ecx + 4]
sub eax, edx
je 0x489b03
sub eax, 1
je 0x489ae5
sub eax, 1
je 0x489ac7
sub eax, 1
jne 0x489b35
push 5
push str.https
push dword [ecx]
call fcn.005e88d0
add esp, 0xc
test eax, eax
je 0x489ac2
push 5
push str.HTTPS
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
push dword [eax]
call fcn.005e88d0
add esp, 0xc
test eax, eax
jne 0x489b39
push 2
pop edi
jmp 0x489b35
push 4
push 0x73fde4
push dword [ecx]
call fcn.005e88d0
add esp, 0xc
test eax, eax
je 0x489b32
push 4
push str.HTTP
jmp 0x489b1e
push 3
push 0x73fddc
push dword [ecx]
call fcn.005e88d0
add esp, 0xc
test eax, eax
je 0x489ac2
push 3
push 0x73fde0
jmp 0x489aae
push edx
push 0x73fdd4
push dword [ecx]
call fcn.005e88d0
add esp, 0xc
test eax, eax
je 0x489b32
push 2
push 0x73fdd8
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
push dword [eax]
call fcn.005e88d0
add esp, 0xc
test eax, eax
jne 0x489b39
xor edi, edi
inc edi
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x14]
xor edx, edx
push 1
push 0x73fe04
mov eax, dword [eax + 4]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x1c], eax
call fcn.00488caf
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov dword [esp + 0x20], eax
mov eax, dword [eax]
sub ecx, dword [eax + 4]
mov dword [esp + 0x10], ecx
cmp dword [ebp + 0x10], ebx
je 0x489bd5
push 0x1aff
push 0x73fe08
lea eax, [ecx + 2]
push 1
push eax
mov dword [esp + 0x34], eax
call fcn.005ed7c0
mov ecx, eax
add esp, 0x10
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
test ecx, ecx
je 0x489eed
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x489baf
mov word [ecx], 0x2f
jmp 0x489bd5
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov eax, dword [eax + 4]
add eax, dword [esp + 0x30]
push eax
call section..text
mov eax, dword [ebp + 0x10]
pop ecx
pop ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [eax]
mov byte [ecx + eax], bl
mov eax, dword [esp + 0x20]
xor edx, edx
push 1
push 0x73fe80
mov ecx, dword [eax]
push dword [ecx + 4]
mov ecx, dword [ecx]
call fcn.00488caf
add esp, 0xc
mov dword [esp + 0x24], eax
cmp dword [eax + 8], 1
je 0x489c0a
mov eax, dword [eax + 4]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
cmp byte [eax + ecx - 1], 0x5d
jne 0x489c28
cmp edi, 2
mov ecx, 0x1bb
push 0x50
pop eax
cmove eax, ecx
movzx edi, ax
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x24]
jmp 0x489cb2
mov edi, 0x1b1c
lea eax, [ecx + 1]
push edi
push 0x73fe84
push 1
push eax
call fcn.005ed7c0
mov ecx, eax
add esp, 0x10
mov dword [esp + 0x2c], ecx
test ecx, ecx
jne 0x489c78
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x73fea0
push esi
push edi
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push edi
push 0x73febc
push 0x73fed8
jmp 0x489f1a
mov edi, dword [esp + 0x24]
mov eax, dword [edi + 4]
mov edx, dword [eax + 4]
push edx
push dword [eax]
inc edx
call section..text
mov eax, dword [edi + 4]
mov ecx, dword [esp + 0x34]
mov eax, dword [eax + 4]
mov byte [ecx + eax], bl
call fcn.00484e03
push 1
push dword [esp + 0x38]
movzx eax, ax
mov dword [esp + 0x20], eax
call fcn.005ed680
add esp, 0x10
mov ecx, dword [edi]
mov eax, dword [ecx]
cmp byte [eax], 0x5b
jne 0x489d5b
mov eax, dword [esp + 0x20]
push 1
push 0x73fefc
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
call fcn.0048bd79
mov dword [esp + 0x34], eax
pop ecx
pop ecx
test eax, eax
je 0x489dd0
push 0x1b2b
push 0x73ff00
add eax, 2
push 1
push eax
mov dword [esp + 0x34], eax
call fcn.005ed7c0
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x489d38
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1b2b
push esi
push edi
mov edx, 0x73ff1c
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push edi
push 0x73ff38
push 0x73ff54
jmp 0x489f1a
mov eax, dword [esp + 0x2c]
mov ecx, esi
mov edx, dword [esp + 0x24]
inc eax
push eax
mov dword [esp + 0x20], eax
mov eax, dword [edi]
push dword [eax]
call section..text
mov eax, dword [esp + 0x34]
mov byte [eax + esi + 1], bl
jmp 0x489dce
mov eax, dword [ecx + 4]
push 0x1b35
push 0x73ff78
mov dword [esp + 0x24], eax
inc eax
push 1
push eax
mov dword [esp + 0x3c], eax
call fcn.005ed7c0
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x489db4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1b35
push esi
push edi
mov edx, 0x73ff94
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push edi
push 0x73ffb0
push 0x73ffcc
jmp 0x489f1a
mov eax, dword [edi]
mov ecx, esi
push dword [esp + 0x1c]
mov edx, dword [esp + 0x30]
push dword [eax]
call section..text
mov eax, dword [esp + 0x24]
mov byte [eax + esi], bl
pop ecx
pop ecx
mov ecx, edi
call fcn.00488e73
mov ecx, dword [esp + 0x20]
call fcn.00488e73
mov ecx, dword [esp + 0x14]
call fcn.00488e73
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x489ebb
push 7
xor eax, eax
mov edi, ebx
pop ecx
rep stosd dword es:[edi], eax
test esi, esi
je 0x489ebb
cmp byte [esi], 0x5b
jne 0x489e88
mov edi, dword [esp + 0x1c]
mov edx, edi
push ecx
push 0x73fff0
mov ecx, esi
call fcn.0048bdbe
pop ecx
pop ecx
mov ecx, eax
xor eax, eax
mov byte [edi + esi - 1], al
test ecx, ecx
jle 0x489e54
lea edi, [ecx + esi]
mov byte [ecx + esi], al
lea ecx, [edi + 1]
call fcn.00484daf
test edx, edx
ja 0x489e59
jb 0x489e46
cmp eax, 0x7fffffff
ja 0x489e59
lea ecx, [edi + 1]
call fcn.00484ddc
mov dword [esp + 0x28], eax
jmp 0x489e59
or dword [esp + 0x28], 0xffffffff
push 0x17
pop ecx
lea eax, [ebx + 8]
mov word [ebx], cx
push eax
lea edx, [esi + 1]
call fcn.0048c79c
mov eax, dword [esp + 0x2c]
pop ecx
test eax, eax
js 0x489e77
mov dword [ebx + 0x18], eax
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebx + 2], ax
jmp 0x489ebf
push 2
pop ecx
lea eax, [ebx + 4]
mov word [ebx], cx
push eax
mov edx, esi
call fcn.0048c79c
mov edi, dword [esp + 0x14]
pop ecx
test eax, eax
jne 0x489e7b
push 1
push ebx
mov edx, edi
mov ecx, esi
call fcn.0048ca34
pop ecx
pop ecx
test eax, eax
jg 0x489e7b
xor eax, eax
mov word [ebx], ax
jmp 0x489e7b
mov edi, dword [esp + 0x10]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x489ec9
mov word [eax], di
mov eax, dword [ebp + 8]
test eax, eax
je 0x489ed4
mov dword [eax], esi
jmp 0x489ee2
test esi, esi
je 0x489ee2
push 1
push esi
call fcn.005ed680
pop ecx
pop ecx
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1aff
push esi
push edi
mov edx, 0x73fe24
xor ecx, ecx
call fcn.0048cac3
add esp, 0xc
push edi
push 0x73fe40
push 0x73fe5c
call fcn.00401109
add esp, 0xc
push esi
call fcn.005c8390
int3