Function at 0x4d9f44
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x6c
push 0
push 0
dec ecx
jne 0x4d9f4c
push ebx
push esi
push edi
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4da93e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b0]
mov edx, dword [eax]
call dword [edx + 0x5c]
test al, al
je 0x4da90b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3a8]
mov si, 0xffec
call fcn.004055e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3a0]
mov si, 0xffec
call fcn.004055e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b0]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x74]
lea eax, [ebp - 0x2fc]
mov ecx, 0x4da958
mov edx, dword [0x4ee3b8]
call fcn.00407434
mov eax, dword [ebp - 0x2fc]
call fcn.00407004
push eax
push 0
call sub.user32.dll_FindWindowW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x4da005
push 0
push 0
push 0x10
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_SendMessageW
xor eax, eax
push ebp
push 0x4da83c
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00415474
fstp qword [ebp - 0x20]
wait
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea eax, [ebp - 0x24]
mov edx, 0x4da974
call fcn.00416134
push dword [0x4ee3bc]
push 0x4da9a0
push dword [ebp - 0x24]
push 0x4da9c0
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00407518
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x2f8]
call fcn.00404a14
lea eax, [ebp - 0x2f8]
call fcn.004047ac
call fcn.004043cc
cmp byte [0x4e8714], 0
jne 0x4da5bc
push 0x4da9d8
mov eax, dword [ebp - 4]
push dword [eax + 0x3c8]
push 0x4da9f8
mov eax, dword [ebp - 4]
push dword [eax + 0x3e0]
push 0x4daa24
lea eax, [ebp - 8]
mov edx, 5
call fcn.00407518
push 0x4daa24
push dword [0x4ee3b8]
push 0x4daa34
push dword [ebp - 8]
lea eax, [ebp - 0x300]
mov edx, 4
call fcn.00407518
mov edx, dword [ebp - 0x300]
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
mov edx, 0x4daa54
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
push 0x4da9d8
mov eax, dword [ebp - 4]
push dword [eax + 0x3c4]
push 0x4da9f8
mov eax, dword [ebp - 4]
push dword [eax + 0x3e4]
push 0x4daa24
lea eax, [ebp - 8]
mov edx, 5
call fcn.00407518
push 0x4daa24
push dword [0x4ee3b8]
push 0x4daa34
push dword [ebp - 8]
lea eax, [ebp - 0x304]
mov edx, 4
call fcn.00407518
mov edx, dword [ebp - 0x304]
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
mov edx, 0x4daa54
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3d4]
lea eax, [ebp - 8]
mov edx, 0x4da9d8
call fcn.00407434
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
call fcn.004d9644
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1f4
jle 0x4da1d6
push dword [ebp - 8]
push 0x4daa74
mov eax, dword [ebp - 4]
push dword [eax + 0x3e4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00407518
jmp 0x4da228
call fcn.00415474
add esp, 0xfffffff8
fstp qword [esp]
wait
push 0x4daa90
push 0
lea edx, [ebp - 0x30c]
mov eax, dword [ebp - 0x14]
call fcn.0041243c
mov ecx, dword [ebp - 0x30c]
lea eax, [ebp - 0x308]
mov edx, 0x4daaa8
call fcn.00407434
mov eax, dword [ebp - 0x308]
push eax
mov ecx, 2
mov edx, 0x4daadc
mov eax, 0x4daaf8
call fcn.004d8ea8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c8]
call fcn.004d9644
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1f4
jle 0x4da262
push dword [ebp - 8]
push 0x4daa74
mov eax, dword [ebp - 4]
push dword [eax + 0x3e0]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00407518
jmp 0x4da2b4
call fcn.00415474
add esp, 0xfffffff8
fstp qword [esp]
wait
push 0x4daa90
push 0
lea edx, [ebp - 0x314]
mov eax, dword [ebp - 0x14]
call fcn.0041243c
mov ecx, dword [ebp - 0x314]
lea eax, [ebp - 0x310]
mov edx, 0x4dab14
call fcn.00407434
mov eax, dword [ebp - 0x310]
push eax
mov ecx, 2
mov edx, 0x4daadc
mov eax, 0x4daaf8
call fcn.004d8ea8
push dword [ebp - 8]
push 0x4dab44
mov eax, dword [ebp - 4]
push dword [eax + 0x3d8]
push 0x4daa24
lea eax, [ebp - 8]
mov edx, 4
call fcn.00407518
push 0x4daa24
push dword [0x4ee3b8]
push 0x4daa34
push dword [ebp - 8]
lea eax, [ebp - 0x318]
mov edx, 4
call fcn.00407518
mov edx, dword [ebp - 0x318]
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
mov edx, 0x4daa54
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e8]
call fcn.00412ba4
test al, al
je 0x4da3fe
fld xword [0x4ee3c8]
fld xword [0x4dabd4]
fcompp
wait
fnstsw ax
sahf
ja 0x4da3fe
push 0x4daa24
mov eax, dword [ebp - 4]
push dword [eax + 0x3e8]
push 0x4dabec
mov eax, dword [ebp - 4]
push dword [eax + 0x3e0]
push 0x4dac08
mov eax, dword [ebp - 4]
push dword [eax + 0x3e4]
push 0x4dac24
mov eax, dword [ebp - 4]
push dword [eax + 0x3dc]
push 0x4dac40
lea edx, [ebp - 0x320]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e8]
call fcn.00412f18
push dword [ebp - 0x320]
push 0x4dac5c
lea eax, [ebp - 0x31c]
mov edx, 0xb
call fcn.00407518
mov edx, dword [ebp - 0x31c]
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
mov edx, 0x4daa54
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
push 0x4dac78
mov eax, dword [ebp - 4]
push dword [eax + 0x3dc]
push 0x4dac9c
lea eax, [ebp - 0x324]
mov edx, 3
call fcn.00407518
mov edx, dword [ebp - 0x324]
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
push 0x4daa24
push dword [0x4ee3b8]
push 0x4dacb0
push dword [0x4e872c]
push 0x4dacf0
push dword [0x4e8730]
push 0x4dad00
push dword [0x4e8710]
push 0x4dad54
mov eax, dword [ebp - 4]
push dword [eax + 0x3d8]
push 0x4dad80
lea edx, [ebp - 0x328]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d8]
call fcn.00413014
push dword [ebp - 0x328]
push 0x4dada4
mov eax, dword [ebp - 4]
push dword [eax + 0x3dc]
push 0x4dad80
lea edx, [ebp - 0x32c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
call fcn.00413014
push dword [ebp - 0x32c]
push 0x4dadd0
lea eax, [ebp - 8]
mov edx, 0x11
call fcn.00407518
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
mov edx, 0x4dae38
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
push 0x4daa24
push dword [0x4ee3b8]
push 0x4dacb0
push dword [0x4e872c]
push 0x4dacf0
push dword [0x4e8730]
push 0x4dad00
push dword [0x4e8710]
push 0x4dad54
mov eax, dword [ebp - 4]
push dword [eax + 0x3d8]
push 0x4dad80
lea edx, [ebp - 0x330]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d8]
call fcn.00413014
push dword [ebp - 0x330]
push 0x4dadd0
lea eax, [ebp - 8]
mov edx, 0xd
call fcn.00407518
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
mov dx, 0x29
lea eax, [ebp - 0x2f8]
call fcn.00406b5c
call fcn.00404e70
call fcn.004043cc
mov edx, 0x4daa54
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
push 0x4dae58
mov eax, dword [ebp - 4]
push dword [eax + 0x3c8]
push 0x4daa24
lea eax, [ebp - 0x334]
mov edx, 3
call fcn.00407518
mov edx, dword [ebp - 0x334]
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
push 0x4dae58
mov eax, dword [ebp - 4]
push dword [eax + 0x3c4]
push 0x4daa24
lea eax, [ebp - 0x338]
mov edx, 3
call fcn.00407518
mov edx, dword [ebp - 0x338]
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
push 0x4dae58
mov eax, dword [ebp - 4]
push dword [eax + 0x3d4]
push 0x4daa24
lea eax, [ebp - 0x33c]
mov edx, 3
call fcn.00407518
mov edx, dword [ebp - 0x33c]
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
push 0x4dae58
mov eax, dword [ebp - 4]
push dword [eax + 0x3e0]
push 0x4daa24
lea eax, [ebp - 0x340]
mov edx, 3
call fcn.00407518
mov edx, dword [ebp - 0x340]
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
push 0x4dae58
mov eax, dword [ebp - 4]
push dword [eax + 0x3e4]
push 0x4daa24
lea eax, [ebp - 0x344]
mov edx, 3
call fcn.00407518
mov edx, dword [ebp - 0x344]
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
push 0x4dae58
mov eax, dword [ebp - 4]
push dword [eax + 0x3d8]
push 0x4daa24
lea eax, [ebp - 0x348]
mov edx, 3
call fcn.00407518
mov edx, dword [ebp - 0x348]
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
push 0x4dae58
mov eax, dword [ebp - 4]
push dword [eax + 0x3dc]
push 0x4daa24
lea eax, [ebp - 0x34c]
mov edx, 3
call fcn.00407518
mov edx, dword [ebp - 0x34c]
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
push 0x4dae58
mov eax, dword [ebp - 4]
push dword [eax + 0x3ec]
push 0x4dae70
lea eax, [ebp - 0x350]
mov edx, 3
call fcn.00407518
mov edx, dword [ebp - 0x350]
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
push 0x4dae58
mov eax, dword [ebp - 4]
push dword [eax + 0x3ec]
push 0x4dae94
lea eax, [ebp - 0x354]
mov edx, 3
call fcn.00407518
mov edx, dword [ebp - 0x354]
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
push 0x4dae58
push dword [ebp - 0xc]
push 0x4daa24
lea eax, [ebp - 0x358]
mov edx, 3
call fcn.00407518
mov edx, dword [ebp - 0x358]
lea eax, [ebp - 0x2f8]
call fcn.00407910
call fcn.00404e70
call fcn.004043cc
lea eax, [ebp - 0x2f8]
call fcn.00404ad8
call fcn.004043cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4da846
mov eax, dword [0x4e8b9c]
mov eax, dword [eax]
cmp byte [eax + 0x5b], 0
je 0x4da893
push 1
lea eax, [ebp - 0x35c]
mov ecx, 0x4daeb8
mov edx, dword [0x4ee3bc]
call fcn.00407434
mov eax, dword [ebp - 0x35c]
call fcn.00407004
push eax
push 0x4daec4
mov eax, dword [ebp - 0xc]
call fcn.00407004
push eax
push 0x4daec4
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x4da8d1
push 0
lea eax, [ebp - 0x360]
mov ecx, 0x4daeb8
mov edx, dword [0x4ee3bc]
call fcn.00407434
mov eax, dword [ebp - 0x360]
call fcn.00407004
push eax
push 0x4daec4
mov eax, dword [ebp - 0xc]
call fcn.00407004
push eax
push 0x4daec4
push 0
call sub.shell32.dll_ShellExecuteW
call fcn.00415474
add esp, 0xfffffff8
fstp qword [esp]
wait
push 0x4daed4
mov eax, dword [0x4ee3c0]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d8]
push eax
xor ecx, ecx
mov edx, 0x4daadc
mov eax, 0x4daaf8
call fcn.004d8ea8
mov eax, dword [ebp - 4]
call fcn.004ad9a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da945
lea eax, [ebp - 0x360]
mov edx, 0x1a
call fcn.00406f70
lea eax, [ebp - 0x24]
call fcn.00406f68
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00406f70
ret