Function at 0x10041a3
Capabilities:
Create process on windows
Delete file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7ac
push 0x200
lea eax, [ebp - 0x5ac]
push eax
push 0x41d
call fcn.010029f0
lea eax, [ebp - 0x5ac]
push eax
push 0x856
push dword [ebp + 8]
call fcn.01002e9b
push dword [ebp + 8]
call fcn.01003b6b
test eax, eax
je 0x100445c
push 0x10017c0
push dword [0x1013e38]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
lea eax, [ebp - 0x26c]
jne 0x1004208
push 0x10017b4
jmp 0x100420d
push 0x10017a8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.0100322e
test eax, eax
jne 0x1004254
xor esi, esi
push esi
push 0x10
push esi
lea eax, [ebp - 0x168]
push eax
push 0x46d
push dword [ebp + 8]
call fcn.01003267
xor eax, eax
jmp 0x1004459
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, 0x1012dc8
push edi
call esi
mov ebx, eax
lea eax, [ebp - 0x168]
push eax
call esi
lea eax, [ebx + eax + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
xor esi, esi
cmp ebx, esi
jne 0x1004288
push esi
jmp 0x10043bc
push edi
lea eax, [ebp - 0x168]
push eax
push 0x100179c
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x11
xor eax, eax
cmp word [0x1012414], si
pop ecx
lea edi, [ebp - 0x64]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x64], 0x44
je 0x10042c6
mov dword [ebp - 0x38], 1
mov word [ebp - 0x34], 6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1004307
push dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x18]
call fcn.01002851
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x18]
call edi
jmp 0x1004340
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push 0x200
lea ecx, [ebp - 0x7ac]
push ecx
push esi
push eax
push esi
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push esi
push 0x10
lea eax, [ebp - 0x7ac]
push eax
push ebx
push 0x46c
push dword [ebp + 8]
call fcn.01003267
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x1001794
push 0x856
push dword [ebp + 8]
call fcn.01002e9b
lea eax, [ebp - 0x3ac]
push eax
mov ebx, 0x10130d4
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, dword [ebp - 0x38c]
sub edi, dword [ebp - 0x390]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
push esi
push 3
push esi
push esi
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x10043a8
push esi
push 0x10
push esi
push ebx
push 0x466
jmp 0x1004245
lea eax, [edi + 1]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, esi
mov dword [ebp - 4], eax
push esi
jne 0x10043ca
push 0x10
push esi
push esi
push 0x44c
jmp 0x1004245
lea ecx, [ebp - 0x20]
push ecx
push edi
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10043ec
push esi
push 0x10
push esi
push ebx
push 0x467
jmp 0x1004245
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
mov edi, 0x856
push edi
push dword [ebp + 8]
call fcn.01002e9b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x1001794
push edi
push dword [ebp + 8]
call fcn.01002e9b
push 0x10143c0
push esi
push 0x1001788
push 0x1001454
call fcn.01002ab7
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
jne 0x1004443
push 0x1012dc8
call esi
test byte [0x1013e4e], 1
jne 0x1004453
push 0x1012fd0
call esi
push ebx
call esi
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4