Function at 0x40d1c0
Capabilities:
Create process on windows
Delete directory
Delete file
Get file size
Read file on windows

Disassembly:
sub esp, 0x650
push ebx
push ebp
push esi
push edi
call fcn.0040e060
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
push 0x424cd0
lea edi, [ebx + 0x21f]
mov dword [esp + 0x30], ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4253c9
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040e280
mov ecx, dword [0x424cc8]
add esp, 4
push ebx
push 0x40c1d0
push 0
push 0x72
push ecx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
add ebx, 0xb16
mov dword [esp + 0x28], eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40d24c
push 1
push eax
push ebx
push str.iexplore.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, 0x425bc1
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x10], 0x4253c9
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x4253c9
mov ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov al, byte [ebp + 0x425bc0]
not ecx
dec ecx
cmp al, 0x5c
jne 0x40d27d
dec ebp
cmp byte [0x4253c9], 0x5c
jne 0x40d28f
mov dword [esp + 0x10], 0x4253ca
dec ecx
lea edx, [ecx + ebp + 2]
push edx
call fcn.00419c1d
mov ebx, eax
mov edi, 0x425bc1
or ecx, 0xffffffff
xor eax, eax
add esp, 4
lea edx, [ebx + ebp + 1]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x10]
or ecx, 0xffffffff
mov byte [ebx + ebp], 0x5c
mov dword [esp + 0x10], str.MUPINFO
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.MUPINFO
mov ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov al, byte [ebx + ebp - 1]
not ecx
dec ecx
cmp al, 0x5c
jne 0x40d315
dec ebp
cmp byte [str.MUPINFO], 0x5c
jne 0x40d327
mov dword [esp + 0x10], 0x4232bd
dec ecx
lea ecx, [ecx + ebp + 2]
push ecx
call fcn.00419c1d
mov edx, eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [esp + 0x24], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x14], str.mupdb
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x10]
or ecx, 0xffffffff
mov byte [edx + ebp], 0x5c
lea edx, [edx + ebp + 1]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x425bc1
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.mupdb
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov al, byte [edx + 0x425bc0]
mov dword [esp + 0x10], edx
not ecx
dec ecx
cmp al, 0x5c
jne 0x40d3bb
dec edx
mov dword [esp + 0x10], edx
cmp byte [str.mupdb], 0x5c
jne 0x40d3cd
mov dword [esp + 0x14], 0x4232b5
dec ecx
lea ecx, [ecx + edx + 2]
push ecx
call fcn.00419c1d
mov ebp, eax
mov edi, 0x425bc1
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x10]
mov edx, ecx
mov esi, edi
mov edi, ebp
mov dword [esp + 0x10], str..files
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [eax + ebp + 1]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x14]
mov byte [eax + ebp], 0x5c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str..files
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov al, byte [edx + ebp - 1]
mov dword [esp + 0x14], edx
not ecx
dec ecx
cmp al, 0x5c
jne 0x40d45f
dec edx
mov dword [esp + 0x14], edx
cmp byte [str..files], 0x5c
jne 0x40d471
mov dword [esp + 0x10], 0x4232ad
dec ecx
lea ecx, [ecx + edx + 2]
push ecx
call fcn.00419c1d
mov edx, eax
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [esp + 0x18], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x10]
mov byte [edx + eax], 0x5c
lea edx, [edx + eax + 1]
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x10], str..packages
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str..packages
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov al, byte [edx + ebp - 1]
mov dword [esp + 0x14], edx
not ecx
dec ecx
cmp al, 0x5c
jne 0x40d504
dec edx
mov dword [esp + 0x14], edx
cmp byte [str..packages], 0x5c
jne 0x40d516
mov dword [esp + 0x10], 0x4232a1
dec ecx
lea ecx, [ecx + edx + 2]
push ecx
call fcn.00419c1d
mov edx, eax
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [esp + 0x1c], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x1c]
and ecx, 3
push 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x1c]
mov byte [edx + eax], 0x5c
lea edx, [edx + eax + 1]
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov eax, ecx
mov esi, edi
mov edi, edx
push SysReAllocStringLen
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x30]
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x30], esi
je 0x40d70f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov dword [esp + 0x34], eax
jbe 0x40d708
lea edi, [eax + 1]
push edi
call fcn.00419c1d
mov edx, eax
mov ecx, edi
mov dword [esp + 0x18], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x10]
push 0
push eax
push ecx
push edi
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea ecx, [esp + 0x3c]
call fcn.00408710
lea ecx, [esp + 0x38]
call fcn.00408e90
mov esi, eax
test esi, esi
je 0x40d6ea
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40d6ea
mov ecx, 0x40
lea edi, [esp + 0x5d]
mov byte [esp + 0x5c], al
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x425bc1
lea edx, [esp + 0x64]
push str._s_s
push edx
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x5c]
push ecx
call fcn.0040cef0
mov edi, str.systemcomponents
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
push str.systemcomponents
call fcn.0041e410
add esp, 0x10
test eax, eax
jne 0x40d6ca
mov edi, str.systemcomponents
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x5c]
add ecx, esi
push ecx
push 0x425bc1
push str._s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x5c]
push ecx
call fcn.0040cef0
add esp, 4
mov edx, dword [esp + 0x28]
push edx
call fcn.0040d150
add esp, 4
lea ecx, [esp + 0x38]
call fcn.00408eb0
mov esi, eax
test esi, esi
jne 0x40d616
mov eax, dword [esp + 0x14]
push eax
call fcn.00419c12
add esp, 4
lea ecx, [esp + 0x38]
call fcn.00408790
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x30]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call esi
mov ecx, dword [esp + 0x1c]
push ecx
call esi
push edi
call fcn.0040cef0
mov edx, dword [esp + 0x20]
push edx
call fcn.00419c12
push edi
call fcn.00419c12
push ebp
call fcn.00419c12
mov eax, dword [esp + 0x34]
add esp, 0x10
push eax
call esi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x18], str.systemcomponents
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.systemcomponents
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov al, byte [edx + ebx - 1]
mov dword [esp + 0x1c], edx
not ecx
dec ecx
cmp al, 0x5c
jne 0x40d779
dec edx
mov dword [esp + 0x1c], edx
cmp byte [str.systemcomponents], 0x5c
jne 0x40d78b
mov dword [esp + 0x18], 0x423285
dec ecx
lea ecx, [ecx + edx + 2]
push ecx
call fcn.00419c1d
mov ebp, eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x1c]
mov edx, ecx
mov esi, edi
mov edi, ebp
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [eax + ebp + 1]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x1c]
mov byte [eax + ebp], 0x5c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call esi
push ebx
call esi
push 0x425bc1
call esi
mov esi, dword [esp + 0x28]
push esi
call fcn.0040d150
call fcn.0040cf30
call fcn.0040c650
push 0x424cd0
call fcn.0040e840
push esi
call fcn.0040d150
mov ecx, dword [esp + 0x30]
push ecx
call fcn.00419c12
push ebx
call fcn.00419c12
push ebp
call fcn.00419c12
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x279]
mov byte [esp + 0x278], 0
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x44]
mov ecx, 0x3f
stosw word es:[edi], ax
stosb byte es:[edi], al
add edx, 0x120
xor eax, eax
lea edi, [esp + 0x179]
mov byte [esp + 0x178], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x38]
lea ecx, [esp + 0x278]
push eax
push 0x3ff
mov dword [esp + 0x40], edx
push ecx
mov edx, dword [0x424cc8]
push 0x10b
push edx
call fcn.0040dd20
mov edx, dword [0x424cc8]
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x190]
push 0xff
push ecx
push 0x10c
push edx
call fcn.0040dd20
add esp, 0x40
lea eax, [esp + 0x160]
lea ecx, [esp + 0x260]
push 0
push eax
push ecx
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x650
ret