Function at 0x4b8920
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f81c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x150
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x13c]
mov dword [ebp - 0x24], ebx
test eax, eax
jne 0x4b8957
xor eax, eax
jmp 0x4b8ce5
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x15c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x15c]
mov ecx, ebx
push eax
call fcn.004b8e60
test eax, eax
je 0x4b8ce5
mov edi, dword [ebp + 8]
test edi, edi
jne 0x4b89b2
mov ecx, dword [ebx + 0x13c]
push edi
push edi
call fcn.00495b90
mov esi, eax
push esi
call fcn.004de48f
mov ecx, dword [ebx + 0x13c]
add esp, 4
mov edi, eax
push esi
push edi
mov dword [ebp - 0x18], edi
call fcn.00495b90
mov dword [ebp + 8], eax
jmp 0x4b89e1
push 0x268
call fcn.004de48f
mov ecx, dword [ebx + 0x13c]
add esp, 4
mov esi, eax
push 1
push 0x268
push esi
push edi
mov dword [ebp - 0x18], esi
call fcn.00495eb0
mov dword [ebp + 8], eax
mov byte [esi + eax], 0
mov edi, esi
push str.result.txt
lea ecx, [ebp - 0x10]
push 0x525768
push ecx
mov ebx, edi
call fcn.00402910
mov eax, dword [ebp - 0x10]
xor esi, esi
cmp eax, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], eax
je 0x4b8a3a
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.004ded50
mov edx, dword [ebp - 0x14]
mov esi, esp
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push edx
push 0
push 0
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, dword [ebp - 0x18]
push 0x519928
push esi
call fcn.004deb38
add esp, 8
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x4b8a90
test edi, edi
je 0x4b8a5c
push edi
call fcn.004de3a6
add esp, 4
mov eax, dword [ebp - 0x10]
mov edx, dword [0x50d0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4b8a89
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4b8a89
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff4
push edx
call fcn.004de3a6
add esp, 4
xor eax, eax
jmp 0x4b8ce5
mov ecx, dword [ebp + 8]
test ecx, ecx
jle 0x4b8b9d
lea esi, [ebx + 0x5f]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
mov al, byte [ebx + 0x5a]
not ecx
add ecx, 0x5f
cmp al, 1
mov dword [ebp - 0x1c], ecx
je 0x4b8abe
cmp al, 3
jne 0x4b8b85
mov ecx, 0xa
xor eax, eax
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x24]
stosb byte es:[edi], al
lea eax, [ebp - 0x58]
push eax
push ebx
call fcn.004b8d00
push 0x516ae0
push esi
call fcn.004df6d0
sub eax, ebx
sub eax, 0x5e
mov esi, eax
push esi
call fcn.004de48f
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebp - 0x20], edi
push 0x5c
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x20]
lea ecx, [esi - 1]
mov edx, ecx
lea esi, [ebx + 0x5f]
mov edi, eax
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004e0420
mov esi, eax
add esp, 0x14
test esi, esi
je 0x4b8b72
mov eax, dword [ebx + 0x34]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [ebx + 0x38]
xor edi, edi
push ecx
mov dword [ebp - 0x28], eax
call dword [sym.imp.WS2_32.dll_ntohl]
add edi, eax
mov eax, dword [ebp - 0x28]
adc eax, 0
mov ecx, dword [ebp - 0x14]
inc esi
lea edx, [ebp - 0x58]
push esi
push edx
push eax
lea eax, [ebp - 0x15c]
push edi
push eax
push str.http:___s:8031__I64d__s__s_r_n
push ecx
call fcn.004deacb
add esp, 0x1c
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4b8b82
push eax
call fcn.004de3a6
add esp, 4
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add ebx, ecx
sub eax, ecx
test eax, eax
mov dword [ebp + 8], eax
jg 0x4b8a9b
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
push eax
call fcn.004dea4e
add esp, 4
test edi, edi
je 0x4b8bb3
push edi
call fcn.004de3a6
add esp, 4
push str.result.txt
lea edx, [ebp + 8]
push 0x525768
push edx
call fcn.00402910
mov edi, eax
mov esi, dword [edi]
mov edx, dword [ebp - 0x10]
cmp edx, esi
mov byte [ebp - 4], 1
je 0x4b8c6f
mov ecx, dword [edx - 0xc]
lea eax, [edx - 0xc]
test ecx, ecx
mov ecx, dword [0x50d0e4]
jge 0x4b8bf0
lea ebx, [edx - 0xc]
cmp ebx, ecx
jne 0x4b8bf7
mov ebx, dword [esi - 0xc]
test ebx, ebx
jge 0x4b8c36
mov ebx, dword [esi - 8]
lea ecx, [ebp - 0x10]
push ebx
call fcn.004022b0
test eax, eax
je 0x4b8c6f
lea eax, [ebx + ebx]
lea ecx, [ebx + ebx + 2]
cmp ecx, eax
jb 0x4b8c25
mov edi, dword [ebp - 0x10]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x10]
mov dword [ecx - 8], ebx
mov edx, dword [ebp - 0x10]
mov word [eax + edx], 0
jmp 0x4b8c6f
add edx, 0xfffffff4
cmp edx, ecx
je 0x4b8c60
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4b8c57
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff4
push eax
call fcn.004de3a6
add esp, 4
mov ecx, dword [0x50d0e0]
mov dword [ebp - 0x10], ecx
mov edi, dword [edi]
mov dword [ebp - 0x10], edi
add edi, 0xfffffff4
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [ebp + 8]
mov ecx, dword [0x50d0e4]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x4b8c9c
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4b8c9c
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
push eax
call fcn.004de3a6
add esp, 4
mov ecx, dword [ebp - 0x10]
push 1
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x10]
mov ecx, dword [0x50d0e4]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x4b8ce0
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4b8ce0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff4
push eax
call fcn.004de3a6
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x168]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4