Function at 0x414f92
Capabilities:
Check if file exists
Create process on windows
Self delete

Disassembly:
push 0x15c
mov eax, 0x48ae0b
call fcn.00459b85
xor ebx, ebx
lea eax, [ebp - 0x101]
push ebx
mov dword [ebp - 0x108], ebx
lea ecx, [ebp - 0x40]
mov edi, 0x4b6748
mov dword [ebp - 0x18], 0x4b6750
push eax
mov dword [ebp - 0x40], edi
call fcn.004060a0
mov dword [ebp - 4], 2
mov esi, 0x400
lea eax, [ebp - 0x40]
mov byte [ebp - 0x110], bl
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x10c], ebx
cmp dword [ebp - 0x2c], esi
jae 0x414ff8
push ebx
push esi
lea ecx, [ebp - 0x3c]
call fcn.00408100
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x108], 1
mov byte [ebp - 0x110], 1
call fcn.00407930
push esi
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ecx, ecx
mov esi, eax
inc ecx
mov dword [ebp - 0x108], ecx
and ecx, 0xfffffffe
mov dword [ebp - 0x108], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114]
call fcn.00405f90
test esi, esi
je 0x4151fb
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4151fb
push ebx
push ebx
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x40]
call fcn.004062d0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x101]
push ebx
push eax
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x78], 0x4b6750
call fcn.004060a0
mov byte [ebp - 4], 7
lea eax, [ebp - 0x168]
push 0x44
pop esi
push esi
push ebx
push eax
call fcn.004714b0
xor eax, eax
lea edi, [ebp - 0x124]
stosd dword es:[edi], eax
push esi
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x168]
push eax
call fcn.004714b0
xor eax, eax
mov dword [ebp - 0x168], esi
mov word [ebp - 0x138], ax
lea eax, [ebp - 0x70]
push ebx
push eax
mov dword [ebp - 0x13c], 1
call fcn.00414af9
add esp, 0x20
mov byte [ebp - 4], 8
lea eax, [ebp - 0x101]
push ebx
push eax
push str.cmd.exe
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xd0], 0x4b6748
mov dword [ebp - 0xa8], 0x4b6750
call fcn.0041070a
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x70]
call fcn.00415343
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xd0]
call fcn.00404cc0
cmp byte [ebp + 8], 0
lea eax, [ebp - 0x6c]
je 0x415160
cmp dword [ebp - 0xe8], 8
lea ecx, [ebp - 0xfc]
mov edx, str.__s___c_rmdir__s__q___s_
cmovae ecx, dword [ebp - 0xfc]
jmp 0x415170
cmp dword [ebp - 0x28], 8
lea ecx, [ebp - 0x3c]
mov edx, str.__s___c_del___s_
cmovae ecx, dword [ebp - 0x3c]
cmp dword [ebp - 0x58], 8
push ecx
cmovae eax, dword [ebp - 0x6c]
push eax
push edx
lea eax, [ebp - 0xa0]
push eax
call fcn.00406110
add esp, 0x10
lea ecx, [ebp - 0xa0]
call fcn.00407930
lea ecx, [ebp - 0x124]
push ecx
lea ecx, [ebp - 0x168]
push ecx
push ebx
push ebx
push 0x40
push ebx
push ebx
push ebx
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4151d1
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x70]
call fcn.00404cc0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xa0]
call fcn.00404cc0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x100]
call fcn.00404cc0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00404cc0
mov al, bl
call fcn.00459b34
ret