Function at 0x4271d0
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x140]
push ebx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
xor eax, eax
push fcn.00427170
push ebp
push 0x4142a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x5d5670], 0x1ee400
push 0
lea eax, [ebp - 0x1c]
call fcn.00426e50
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov ecx, str.DirectY
call fcn.00408ac0
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.004149b0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0xc]
call fcn.004269b0
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x427277
mov eax, dword [eax - 4]
mov dword [0x5d5604], eax
mov eax, dword [ebp - 8]
call fcn.00412fb0
mov eax, dword [ebp - 8]
mov edx, 6
call fcn.004462b0
lea eax, [ebp - 0x20]
call fcn.00403b00
push 0xffff
mov edx, dword [ebp - 8]
mov ecx, str.php
lea eax, [ebp - 0x20]
call fcn.00408ac0
mov eax, dword [ebp - 0x20]
call fcn.00412fb0
lea eax, [ebp - 0x20]
call fcn.00403b00
push 0xffff
mov edx, dword [ebp - 8]
mov ecx, str.phpext
lea eax, [ebp - 0x20]
call fcn.00408ac0
mov eax, dword [ebp - 0x20]
call fcn.00412fb0
call fcn.0040ef70
test ax, ax
je 0x4272ec
push 1
call sub.kernel32.dll_Sleep
mov eax, 0xff
call fcn.0040eea0
add eax, 1
mov byte [ebp - 0x18], al
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [0x5d5670]
mov eax, dword [ebp - 0xc]
mov edx, 1
call fcn.004097e0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [0x5d5604]
mov eax, dword [0x5d5670]
sub ecx, eax
sub ecx, 1
mov eax, dword [0x5d5670]
lea edx, [eax + 1]
mov eax, dword [ebp - 0xc]
call fcn.004097e0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov edx, dword [0x5d5604]
mov dl, byte [ecx + edx - 1]
lea ecx, [ebp - 0x1c]
call fcn.00426d90
mov eax, dword [ebp - 0x1c]
mov dl, byte [ebp - 0x18]
lea ecx, [ebp - 0x30]
call fcn.00426cc0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov al, byte [ebp - 0x18]
lea ecx, [ebp - 0x38]
xor dx, dx
call fcn.004092b0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x10]
mov ecx, 2
call fcn.00408d50
lea eax, [ebp - 0x34]
call fcn.00403b00
push 0
mov ecx, dword [0x5d5600]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x34]
call fcn.00408ac0
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x10]
call fcn.00426a60
mov dword [ebp - 4], 0
lea esi, [esi]
add dword [ebp - 4], 1
lea eax, [ebp - 0x34]
call fcn.00403b00
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x5d5600]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x34]
call fcn.00408ac0
lea ebx, [ebp - 0x34]
mov eax, dword [ebx]
call fcn.00470ce0
mov ecx, dword [ebp - 4]
mov ebx, dword [ecx*8 + 0x5d5604]
mov ecx, ebx
sar ecx, 0x1f
cmp edx, ecx
jne 0x427404
cmp eax, ebx
je 0x42741c
mov eax, dword [ebp - 4]
mov eax, dword [eax*8 + 0x5d5600]
mov edx, str.ini
call fcn.00409580
test eax, eax
jne 0x42744c
lea eax, [ebp - 0x38]
call fcn.00403b00
push 0xffff
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x5d5600]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x38]
call fcn.00408ac0
mov eax, dword [ebp - 0x38]
mov dl, 1
call fcn.00446190
test al, al
jne 0x4274b0
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x5d5604]
mov eax, dword [0x5d5670]
lea edx, [eax + 1]
mov eax, dword [ebp - 0xc]
call fcn.004097e0
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0xc]
mov ecx, dword [0x5d5604]
mov dl, byte [edx + ecx - 1]
lea ecx, [ebp - 0x1c]
call fcn.00426d90
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp - 0x3c]
call fcn.00403b00
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x5d5600]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x3c]
call fcn.00408ac0
mov eax, dword [ebp - 0x3c]
mov edx, ebx
call fcn.00426a60
mov esi, esi
mov eax, dword [ebp - 4]
mov edx, dword [eax*8 + 0x5d5604]
add dword [0x5d5670], edx
cmp dword [ebp - 4], 0xd
jl 0x4273c0
call fcn.00426f00
lea edx, [ebp - 0x3c]
xor eax, eax
call fcn.004149b0
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.00409f10
mov edx, dword [ebp - 0x38]
mov ecx, 1
mov eax, str.DIRECTY
call fcn.00409890
test eax, eax
jne 0x42750c
lea eax, [ebp - 0x3c]
call fcn.00427010
mov eax, dword [ebp - 0x3c]
call fcn.0050dda0
mov esi, esi
mov eax, dword [ebp - 8]
call fcn.00413030
call fcn.0040ef20
push 0
mov ecx, 0x586f7c
mov edx, 1
mov eax, 0x5d2234
mov ebx, 0x5d2234
call dword [ebx + 0x68]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
lea esi, [esi]
add dword [ebp - 4], 1
push 0
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x1c]
call fcn.00403b00
push 0
push 0xff
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x140]
mov edx, 0xffffffff
call fcn.00404dd0
lea ecx, [ebp - 0x40]
xor dx, dx
lea eax, [ebp - 0x140]
call fcn.00409240
xor cl, cl
xor dx, dx
lea eax, [ebp - 0x40]
call fcn.0040a010
mov ecx, dword [ebp - 0x40]
mov edx, 0x586f8c
lea eax, [ebp - 0x1c]
call fcn.00408ac0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov ecx, str.Path
mov ebx, dword [ebp - 0x14]
mov ebx, dword [ebx]
call dword [ebx + 0x74]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
lea eax, [eax*8 + 0x5d5678]
call fcn.004089c0
push 0
push 0
lea eax, [ebp - 0x40]
call fcn.00403b00
push 0
push 0xff
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x140]
mov edx, 0xffffffff
call fcn.00404dd0
lea ecx, [ebp - 0x3c]
xor dx, dx
lea eax, [ebp - 0x140]
call fcn.00409240
xor cl, cl
xor dx, dx
lea eax, [ebp - 0x3c]
call fcn.0040a010
mov ecx, dword [ebp - 0x3c]
mov edx, 0x586f8c
lea eax, [ebp - 0x40]
call fcn.00408ac0
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov ecx, str.Delay
mov ebx, dword [ebp - 0x14]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
mov edx, dword [ebp - 4]
mov dword [edx*8 + 0x5d567c], eax
mov eax, dword [ebp - 4]
push dword [eax*8 + 0x5d567c]
call sub.kernel32.dll_Sleep
push 0
push 0
lea eax, [ebp - 0x40]
call fcn.00403b00
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x5d5678]
mov edx, 0x586fc4
lea eax, [ebp - 0x40]
call fcn.00408ac0
mov eax, dword [ebp - 0x40]
test eax, eax
jne 0x427673
mov eax, 0x5d42f0
push eax
mov eax, str.cmd.exe
push eax
mov eax, str.open
push eax
mov eax, 0x7530
call fcn.0040eea0
add eax, 0x3e8
push eax
call sub.shell32.dll_ShellExecuteA
cmp dword [ebp - 4], 5
jl 0x427540
mov eax, dword [ebp - 0x14]
call fcn.0040cf90
mov eax, dword [0x5670c0]
mov edx, dword [0x5670c0]
mov edx, dword [edx]
call dword [edx + 0xfc]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00427170
pop ebx
mov esp, ebp
pop ebp
ret