Function at 0x476fec
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x42
push 0
push 0
dec ecx
jne 0x476ff4
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x477385
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x47739c
call fcn.00409eac
test al, al
jne 0x477025
mov eax, 0x47739c
call fcn.0040a39c
mov eax, dword [0x4f5eb0]
mov edx, 0x4773b4
call fcn.004055ec
jne 0x47733a
mov eax, 0x4f5ef8
mov ecx, dword [0x4f5f0c]
mov edx, dword [0x4f5f08]
call fcn.004054dc
mov edx, dword [0x4f5ef8]
mov eax, dword [0x4f5ed0]
call fcn.00476e44
mov eax, dword [0x4f5eb0]
mov edx, 0x4773b4
call fcn.004055ec
jne 0x47733a
movzx eax, byte [0x4773b8]
push eax
lea eax, [ebp - 0x1e0]
push eax
lea edx, [ebp - 0x1e4]
mov eax, dword [0x4f5f34]
call fcn.00476c48
mov eax, dword [ebp - 0x1e4]
xor ecx, ecx
mov edx, dword [0x4f5f30]
call fcn.0040e9fc
mov ecx, dword [ebp - 0x1e0]
lea eax, [ebp - 0x1dc]
mov edx, dword [0x4f5ef8]
call fcn.004054dc
mov eax, dword [ebp - 0x1dc]
call fcn.00409e88
test al, al
je 0x4770f1
push 5
mov eax, dword [0x4f5ef8]
call fcn.00405654
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x4f5eac]
mov eax, dword [eax + 0x360]
mov dl, 1
call fcn.004374a4
push 0x4773c4
lea edx, [ebp - 0x1f8]
mov eax, 0x4773e8
call fcn.004708e4
lea eax, [ebp - 0x1f8]
lea edx, [ebp - 0x1e8]
call fcn.0047095c
push dword [ebp - 0x1e8]
push 0x4773f4
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405558
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.00409e88
test al, al
je 0x4771e2
xor eax, eax
push ebp
push 0x4771d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1d8]
call fcn.00403684
lea eax, [ebp - 0x1d8]
call fcn.00403414
call fcn.0040305c
lea eax, [ebp - 0x1d8]
call fcn.004038b4
call fcn.0040305c
test al, al
jne 0x4771a2
lea edx, [ebp - 4]
lea eax, [ebp - 0x1d8]
call fcn.00403abc
lea eax, [ebp - 0x1d8]
call fcn.00403b28
call fcn.0040305c
lea eax, [ebp - 0x1d8]
call fcn.0040374c
call fcn.0040305c
lea edx, [ebp - 0x1fc]
mov eax, dword [ebp - 4]
call fcn.00476c48
mov eax, dword [ebp - 0x1fc]
call fcn.00409af8
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4771e2
cmp dword [ebp - 0xc], 0x14
jl 0x477214
lea edx, [ebp - 0x200]
mov eax, 0x477404
call fcn.00476c48
mov eax, dword [ebp - 0x200]
call fcn.004392b4
mov eax, dword [0x4f016c]
mov eax, dword [eax]
call fcn.00465100
jmp 0x47733a
lea edx, [ebp - 0x204]
mov eax, dword [0x4f5f38]
call fcn.00476c48
mov eax, dword [ebp - 0x204]
call fcn.0040cc18
fstp qword [ebp - 0x20c]
wait
call fcn.0040b73c
fcomp qword [ebp - 0x20c]
wait
fnstsw ax
sahf
jbe 0x47733a
mov eax, dword [ebp - 8]
call fcn.00405654
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
push ebx
call sub.kernel32.dll_DeleteFileA
cmp dword [ebp - 0xc], 0x14
jl 0x477276
mov eax, dword [0x4f5eac]
call fcn.00461214
jmp 0x47733a
inc dword [ebp - 0xc]
xor edx, edx
push ebp
push 0x477323
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
call fcn.00409e88
test al, al
jne 0x4772b1
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1d8]
call fcn.00403684
lea eax, [ebp - 0x1d8]
call fcn.00403420
call fcn.0040305c
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 0xc]
call fcn.004099bc
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x210]
call fcn.00476b90
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 0x1d8]
call fcn.00405974
call fcn.00403d40
call fcn.0040305c
lea eax, [ebp - 0x1d8]
call fcn.0040374c
call fcn.0040305c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47732d
mov edx, 6
mov eax, dword [ebp - 8]
call fcn.00409fc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47738c
lea eax, [ebp - 0x214]
mov edx, 2
call fcn.004051e8
lea eax, [ebp - 0x204]
mov edx, 3
call fcn.004051e8
lea eax, [ebp - 0x1e8]
mov edx, 4
call fcn.004051e8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004051e8
ret