Function at 0x4044f0
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46ef12
mov eax, dword fs:[0]
push eax
mov eax, 0x1eb4
call fcn.004601c0
mov eax, dword [0x48f310]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push ecx
mov dword [ebp - 0x1e80], eax
mov eax, esp
mov dword [ebp - 0x1e7c], esp
call fcn.00402a24
lea eax, [ebp - 0x1e08]
call fcn.00401f4d
push 0
push 0
lea edi, [ebp - 0x1e08]
call fcn.004012f5
push 0x3e8
lea ecx, [ebp - 0x1dec]
push ecx
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40458a
push 0x104
lea edx, [ebp - 0x41c]
push edx
lea eax, [ebp - 0x1dec]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea ecx, [ebp - 0x41c]
push ecx
lea edi, [ebp - 0x1e08]
call fcn.00401d13
push 0x110
lea edx, [ebp - 0x128]
push 0
push edx
mov dword [ebp - 0x12c], 0x114
call fcn.004579d0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
call esi
mov edi, 6
cmp dword [ebp - 0x128], edi
jae 0x4046da
lea ecx, [ebp - 0x161c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x161c]
push edx
push 0
push 0x4795d4
push 0x479208
call fcn.00405c30
add esp, 8
push eax
lea eax, [ebp - 0x161c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [ebp - 0x161c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [ebp - 0x161c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea esi, [ebp - 0x1e40]
call fcn.004057a0
lea eax, [ebp - 0x161c]
push eax
lea eax, [ebp - 0x1e78]
mov byte [ebp - 4], 1
call fcn.00401cc7
push 0x4793fc
lea ecx, [ebp - 0x1e78]
push ecx
mov byte [ebp - 4], 2
call fcn.00401cf8
push 0
mov edx, esi
mov edi, eax
push edx
or eax, 0xffffffff
call fcn.00401d62
lea eax, [ebp - 0x1e78]
call fcn.00401489
mov esi, eax
lea eax, [ebp - 0x1e08]
call fcn.00401489
push eax
mov ecx, esi
call fcn.00404420
add esp, 4
test al, al
je 0x4046b5
push 0xffffffffffffffff
lea eax, [ebp - 0x1e78]
push eax
xor eax, eax
lea ecx, [ebp - 0x1e08]
call fcn.00401e6a
lea ecx, [ebp - 0x1e78]
call fcn.004012b8
lea ecx, [ebp - 0x1e40]
mov byte [ebp - 4], 0
call fcn.004012b8
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edi, 6
push 0x110
lea ecx, [ebp - 0x128]
push 0
push ecx
mov dword [ebp - 0x12c], 0x114
call fcn.004579d0
add esp, 0xc
lea edx, [ebp - 0x12c]
push edx
call esi
cmp dword [ebp - 0x128], edi
jae 0x404733
call fcn.004042c0
test al, al
jne 0x404733
push 0x30
push 0
push 0x479400
push 0x479450
call fcn.00405c30
add esp, 8
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0x38
lea eax, [ebp - 0x1eb8]
push 0
push eax
mov dword [ebp - 0x1ebc], 0x3c
call fcn.004579d0
add esp, 0xc
push str.unas
push 0x479460
call fcn.00405c30
add esp, 8
push eax
lea eax, [ebp - 0x1e5c]
call fcn.00401cc7
push 0x110
lea ecx, [ebp - 0x128]
push 0
mov byte [ebp - 4], 3
push ecx
mov dword [ebp - 0x12c], 0x114
call fcn.004579d0
add esp, 0xc
lea edx, [ebp - 0x12c]
push edx
call esi
cmp dword [ebp - 0x128], edi
jae 0x4047ea
call fcn.004042c0
test al, al
je 0x4047ea
push 0x479274
push 0x47927c
call fcn.00405c30
add esp, 8
push eax
lea eax, [ebp - 0x1e40]
call fcn.00401cc7
mov esi, eax
lea eax, [ebp - 0x1e5c]
mov byte [ebp - 4], 4
call fcn.004079d0
lea ecx, [ebp - 0x1e40]
mov byte [ebp - 4], 3
call fcn.004012b8
lea eax, [ebp - 0x1e5c]
call fcn.00401489
mov dword [ebp - 0x1eb0], eax
lea eax, [ebp - 0x1e08]
call fcn.00401489
push ecx
mov dword [ebp - 0x1eac], eax
mov eax, esp
mov dword [ebp - 0x1eb4], 0
mov dword [ebp - 0x1ea0], 1
mov dword [ebp - 0x1e7c], esp
call fcn.00402a24
lea eax, [ebp - 0x1e24]
call fcn.00401f4d
push 0
push 0
lea edi, [ebp - 0x1e24]
call fcn.004012f5
mov eax, dword [ebp - 0x1e80]
push 0xffffffffffffffff
push eax
xor eax, eax
mov ecx, edi
call fcn.00401e6a
lea eax, [ebx + 0x18]
mov byte [ebp - 4], 5
call fcn.00401489
push 0x479484
push eax
push 0x47947c
push 0x479468
push 0x479464
mov ecx, edi
push ecx
call fcn.00401cf8
push eax
call fcn.00401cf8
push eax
call fcn.00401cf8
push eax
call fcn.00401cf8
push eax
call fcn.00401cf8
mov eax, edi
call fcn.00401489
push 0x479488
push 0x4794b0
mov dword [ebp - 0x1ea8], eax
mov dword [ebp - 0x1eb8], 0x40
call fcn.00405c30
add esp, 8
push eax
push str.INFO
mov ecx, ebx
call fcn.00414290
mov edx, dword [ebp - 0x1ea8]
push edx
push str.INFO
mov ecx, ebx
call fcn.00414290
lea eax, [ebp - 0x1ebc]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4049ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
jne 0x404938
push eax
push ecx
push str.ser_did_not_allow_elevation__error_code_d
push 0x479510
call fcn.00405c30
add esp, 0xc
push eax
lea ecx, [ebp - 0x61c]
push 0x100
push ecx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea edx, [ebp - 0x61c]
jmp 0x40497a
push eax
push ecx
push 0x479514
push 0x479270
call fcn.00405c30
add esp, 0xc
push eax
lea eax, [ebp - 0x214]
push 0x100
push eax
call fcn.004510a0
add esp, 0x10
push 0
push 0
lea ecx, [ebp - 0x214]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea edx, [ebp - 0x214]
push edx
push str.WARNING
mov ecx, ebx
call fcn.00414290
lea ecx, [ebp - 0x1e24]
call fcn.004012b8
lea ecx, [ebp - 0x1e5c]
call fcn.004012b8
lea ecx, [ebp - 0x1e08]
call fcn.004012b8
xor al, al
jmp 0x4049cf
lea ecx, [ebp - 0x1e24]
call fcn.004012b8
lea ecx, [ebp - 0x1e5c]
call fcn.004012b8
lea ecx, [ebp - 0x1e08]
call fcn.004012b8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045080d
mov esp, ebp
pop ebp
ret