Function at 0x44cae0
Capabilities:
Check os version
Create process on windows
Delete file
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov edx, dword [ebp + 8]
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], ebx
mov eax, dword [edx]
test eax, eax
mov dword [ebp - 0xc], esi
mov edi, dword [ebp + 0xc]
je 0x44cb07
and byte [edi + 0x17a], 0xc7
mov eax, dword [edx]
cmp eax, 6
ja case.default.0x44cb14
mov byte [ebp - 4], 0xa
jmp dword [eax*4 + 0x4ee9b8]
test byte [edi + 0x17a], 4
je case.0x44cb14.2
mov eax, 0x2e
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
movzx eax, byte [edi + 0x17a]
test al, 4
jne 0x44cb24
or eax, 0x20
mov byte [edi + 0x17a], al
jmp 0x44cbd4
movzx eax, byte [edi + 0x17a]
test al, 4
jne 0x44cb24
or eax, 0x10
mov byte [edi + 0x17a], al
jmp 0x44cbd4
test byte [edi + 0x17f], 0x10
jne 0x44cb24
movzx ecx, byte [edi + 0x17a]
or ecx, 8
mov byte [edi + 0x17a], cl
mov eax, dword [edx]
cmp eax, 5
jne 0x44cb88
or byte [edi + 0x17a], 0x10
jmp 0x44cbd4
cmp eax, 6
jne 0x44cbd4
or ecx, 0x20
mov byte [edi + 0x17a], cl
jmp 0x44cbd4
test byte [edi + 0x17a], 4
je 0x44cbd4
mov eax, 0x2e
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
cmp dword [0x518340], 0
je 0x44cbd4
movzx eax, byte [edi + 0x180]
test eax, 0x80
je 0x44cbd4
mov eax, dword [0x512980]
test eax, eax
jne 0x44cbd4
or byte [edi + 0x17a], 8
and byte [edi + 0x17e], 0xfd
test byte [edi + 0x181], 0x10
jne 0x44cbe8
xor esi, esi
jmp 0x44cbfa
push edi
call fcn.0045f000
mov esi, eax
add esp, 4
and byte [edi + 0x181], 0xef
cmp byte [edi + 0x168], 1
je 0x44d1f0
test byte [edi + 0x17a], 0x40
je 0x44cc35
mov edx, dword [edi + 0x7c]
test edx, edx
je 0x44cc26
mov byte [edx + 0x1e], 0
mov edx, dword [edi + 0x7c]
test edx, edx
je 0x44cc26
mov byte [edx + 0x1f], 0
push edi
call fcn.0043a860
add esp, 4
test eax, eax
je 0x44cc35
mov esi, eax
cmp dword [0x518340], 0
je 0x44ccac
movzx ecx, byte [edi + 0x180]
test ecx, 0x80
je 0x44ccac
mov edx, dword [0x512980]
test edx, edx
jne 0x44cd43
mov edx, dword [edi + 0x14c]
test edx, 0xfffffffe
je 0x44cc6e
cmp edx, 2
jne 0x44cc80
test byte [edi + 0x181], 2
je 0x44d059
jmp 0x44cd43
movzx edx, byte [edi + 0x17a]
not edx
and edx, 8
shr edx, 3
push edx
push dword [edi + 0xec]
call fcn.004d26e0
add esp, 8
cmp eax, 0xffffffff
je 0x44d080
jmp 0x44cd32
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, dword [edi + 0xec]
je 0x44ccff
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, dword [edi + 0xec]
je 0x44ccff
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, dword [edi + 0xec]
je 0x44ccff
xor edx, edx
push edx
push edx
push edi
call fcn.00435640
add esp, 0xc
push dword [edi + 0xec]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x44d092
jmp 0x44cd32
cmp dword [edi + 0x98], 0
je 0x44cd1e
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, dword [edi + 0xec]
cmp ecx, eax
je 0x44d180
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, dword [edi + 0xec]
je 0x44d161
mov edx, dword [0x518340]
test edx, edx
je 0x44cd4f
movzx ecx, byte [edi + 0x180]
test ecx, 0x80
jne 0x44cf61
push 0x30c
push 0
lea edx, [ebp - 0x414]
push edx
call fcn.004cda30
add esp, 0xc
xor ecx, ecx
mov edx, 0x40
mov dword [ebp - 0x18], ecx
mov dword [ebp + edx - 0x5c], ecx
mov dword [ebp + edx - 0x60], ecx
mov dword [ebp + edx - 0x64], ecx
mov dword [ebp + edx - 0x68], ecx
sub edx, 0x10
jne 0x44cd6f
movzx edx, byte [edi + 0x17a]
test dl, 0x20
mov dword [ebp - 0x58], 0x44
je 0x44ce2f
test dl, 8
jne 0x44cdb6
push dword [edi + 0x60]
lea edx, [ebp - 0x414]
push edx
call fcn.0047c0e0
xor ecx, ecx
add esp, 8
jmp 0x44cdd9
push dword [edi + 0x60]
push dword [edi + 0x60]
push str._s__DEL__s
lea edx, [ebp - 0x414]
push edx
call fcn.0047c0e0
xor ecx, ecx
add esp, 0x10
and byte [edi + 0x17a], 0xf7
lea edx, [ebp - 0x6c]
push edx
lea ebx, [ebp - 0x58]
push ebx
push ecx
push ecx
push 0x4000000
push 1
push ecx
push ecx
lea edx, [ebp - 0x414]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor ecx, ecx
test eax, eax
je 0x44d0c6
mov ebx, ecx
push 0xffffffffffffffff
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor ecx, ecx
test eax, eax
je 0x44d0ae
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx edx, byte [edi + 0x17a]
xor ecx, ecx
jmp 0x44ce31
mov ebx, ecx
test dl, 0x10
jne 0x44ce43
mov ecx, edx
and ecx, 8
shr ecx, 3
jmp 0x44cf41
push str.FOR_DEFAULT_PRINT_DEVICE
call fcn.0047cbc0
xor ecx, ecx
add esp, 4
test eax, eax
mov edx, 0x4eea00
mov dword [ebp - 0x108], 0x94
je 0x44ce67
mov edx, eax
mov dword [ebp - 0x5c], edx
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor ecx, ecx
cmp dword [ebp - 0xf8], 1
jne 0x44ce9b
push dword [ebp - 0x5c]
push dword [edi + 0x60]
push str.Command.com__C_COPY___s___s
lea edx, [ebp - 0x414]
push edx
call fcn.0047c0e0
jmp 0x44ceb2
push dword [ebp - 0x5c]
push dword [edi + 0x60]
push str.Cmd.exe__C_COPY___s___s
lea edx, [ebp - 0x414]
push edx
call fcn.0047c0e0
xor ecx, ecx
add esp, 0x10
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x58]
push eax
push ecx
push ecx
push 0x4000000
push 1
push ecx
push ecx
lea edx, [ebp - 0x414]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor ecx, ecx
test eax, eax
je 0x44d13c
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
test eax, eax
je 0x44d124
push 0xffffffffffffffff
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x44d10c
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
test eax, eax
je 0x44d0f4
movzx edx, byte [edi + 0x17a]
test dl, 8
je 0x44cf5b
cmp dword [edi + 0xf0], 0
je 0x44cf45
and edx, 0xfffffff7
mov ebx, 5
mov byte [edi + 0x17a], dl
test ecx, ecx
je 0x44cf5b
test dl, 4
jne 0x44cf5b
push dword [edi + 0x60]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x44d0de
test ebx, ebx
je 0x44cf61
mov esi, ebx
push dword [edi + 0x60]
call fcn.00431ee0
add esp, 4
test eax, eax
je 0x44cf74
mov esi, eax
jmp 0x44cf84
xor edx, edx
mov dword [edi + 0x60], str._Unknown_
mov word [edi + 0x162], dx
push dword [edi + 0x38]
call fcn.00431ee0
add esp, 4
test eax, eax
je 0x44cf97
mov esi, eax
jmp 0x44cf9e
mov dword [edi + 0x38], 0
test byte [edi + 0x17a], 0x40
je 0x44cfc1
push dword [edi + 0x58]
call fcn.00431ee0
add esp, 4
test eax, eax
je 0x44cfba
mov esi, eax
jmp 0x44cfc1
mov dword [edi + 0x58], 0
movzx edx, byte [edi + 0x17d]
test edx, 0x80
jne 0x44d037
mov edx, dword [edi + 0x2c]
lea ecx, [edi + 0x18]
mov ebx, dword [edi + 0x28]
mov dword [ebp - 0x14], edx
test byte [edi + 0x179], 0x18
je 0x44d01c
push 0x178
push 0
mov edx, dword [edi + 0x108]
push ecx
mov dword [ebp - 0x5c], edx
call fcn.004cda30
add esp, 0xc
movzx edx, byte [edi + 0x179]
and edx, 0xffffffe7
mov ecx, dword [ebp - 0x5c]
or edx, 8
mov byte [edi + 0x179], dl
mov dword [edi + 0x108], ecx
jmp 0x44d02c
push 0x178
push 0
push ecx
call fcn.004cda30
add esp, 0xc
mov edx, dword [ebp - 0x14]
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], edx
jmp 0x44d03e
and byte [edi + 0x179], 0xdf
mov eax, esi
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov eax, 0x30
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
call fcn.004d2990
movzx edx, byte [edi + 0x17a]
not edx
and edx, 8
shr edx, 3
push edx
push eax
call fcn.004d26e0
add esp, 8
cmp eax, 0xffffffff
jne 0x44cd32
and byte [edi + 0x17a], 0xf7
mov edx, dword [0x518340]
jmp 0x44cd38
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0xf0], eax
mov esi, 0x1c
mov edx, dword [0x518340]
jmp 0x44cd38
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov dword [edi + 0xf0], eax
mov ebx, 0x1c
jmp 0x44ce1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov dword [edi + 0xf0], eax
mov ebx, 0x1c
jmp 0x44ce06
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0xf0], eax
mov ebx, 0x1c
jmp 0x44cf5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov dword [edi + 0xf0], eax
mov ebx, 0x1c
jmp 0x44cf1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov dword [edi + 0xf0], eax
mov ebx, 0x1c
jmp 0x44cf0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov dword [edi + 0xf0], eax
mov ebx, 0x1c
jmp 0x44cef5
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, byte [edi + 0x17a]
mov ecx, edx
and ecx, 8
mov ebx, 0x1c
mov dword [edi + 0xf0], eax
shr ecx, 3
jmp 0x44cf41
test byte [edi + 0x181], 0x40
je 0x44cd32
xor edx, edx
push edx
push edx
push edi
call fcn.00435640
add esp, 0xc
jmp 0x44cd32
push 1
mov eax, dword [edi + 0x98]
lea ebx, [ebp - 0x70]
push ebx
neg eax
cdq
push eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], edx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x74], eax
cmp eax, 0xffffffff
je 0x44d1ce
mov ecx, dword [ebp - 0x70]
mov edx, 0xffffffff
sub eax, edx
sub ecx, edx
or eax, ecx
je 0x44d092
mov dword [edi + 0x98], 0
mov edx, dword [0x518340]
jmp 0x44cd38
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44d1e8
mov eax, 0xffffffff
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
jmp 0x44d092
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x70]
jmp 0x44d1a8
mov edx, dword [edi + 0x7c]
test edx, edx
je 0x44cc07
cmp byte [edx + 0x1c], 0
jne 0x44d20b
cmp byte [edx + 0x1d], 0
je 0x44cc07
mov ecx, dword [edx + 0x10]
test ecx, ecx
push 1
jne 0x44d216
mov ecx, edi
lea edx, [ebp - 4]
push edx
push ecx
call fcn.00435640
add esp, 0xc
cmp eax, 0xffffffff
je 0x44d24b
mov edx, dword [edi + 0x7c]
test edx, edx
je 0x44cc07
mov byte [edx + 0x1c], 0
mov edx, dword [edi + 0x7c]
test edx, edx
je 0x44cc07
mov byte [edx + 0x1d], 0
jmp 0x44cc07
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0xf0], eax
mov esi, 0x1c
jmp 0x44d228