Function at 0x41dad0
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov eax, ecx
sub eax, 0
je 0x41de0f
sub eax, 2
je 0x41dd24
sub eax, 2
je 0x41db37
test ecx, ecx
je 0x41db24
cmp ecx, 3
jne 0x41de1f
push 1
push 0
push 0
push dword [ebp + 0x14]
push str.open
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
mov dword [esi + 0xa4], eax
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 1
push 0
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0x102
je 0x41de1f
mov ecx, dword [esi + 0x18]
call fcn.00413c60
test eax, eax
je 0x41dbb7
mov ecx, esi
call fcn.0041c720
movzx eax, al
neg eax
sbb eax, eax
add eax, 3
cmp dword [esi + 0x24], 0
mov dword [esi + 0x9c], eax
je 0x41db8c
mov eax, dword [esi + 0x2c]
mov ecx, 0x5b3144
test eax, eax
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi + 0x18]
call fcn.00414650
mov ecx, dword [esi + 0x18]
call fcn.00413c70
mov ecx, dword [esi + 0x18]
push eax
call fcn.00413c60
push eax
mov ecx, esi
call fcn.0041faf0
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.ForcingDiagnostics
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call fcn.00420e00
add esp, 4
lea ecx, [ebp - 0x20]
push eax
push str.ForcingDiagnostics
call fcn.00403040
mov ecx, dword [esi + 0x14]
lea eax, [ebp - 0x20]
push str.True
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040f970
push eax
call fcn.0041a630
add esp, 8
lea ecx, [ebp - 0x10]
mov bl, al
call fcn.0041b940
lea ecx, [ebp - 0x20]
call fcn.0041b940
test bl, bl
je 0x41dc53
mov ecx, dword [esi + 0x18]
call fcn.004138e0
mov ecx, dword [esi + 0x18]
call fcn.00413b60
mov ecx, esi
call fcn.0041c720
movzx eax, al
mov ecx, esi
neg eax
sbb eax, eax
add eax, 3
mov dword [esi + 0x9c], eax
call fcn.004203d0
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, esi
call fcn.0041be80
mov ecx, esi
test al, al
jne 0x41dcc8
call fcn.0041c720
test al, al
je 0x41dcd7
mov ecx, dword [esi + 0x18]
call fcn.00414650
mov ecx, esi
call fcn.0041c810
mov ecx, esi
test al, al
je 0x41dc97
mov dword [esi + 0x9c], 2
call fcn.004203d0
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.0041c540
test al, al
je 0x41dcc6
mov ecx, esi
call fcn.0041c630
test al, al
je 0x41dcc6
mov ecx, esi
mov dword [esi + 0x9c], 3
call fcn.004203d0
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, esi
call fcn.0041f4c0
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, esi
call fcn.0041c540
test al, al
je 0x41dd05
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x9c], 3
call fcn.00414650
mov ecx, esi
call fcn.004203d0
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push 2
push 0x466
push dword [esi + 0xa4]
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.ForcingDiagnostics
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call fcn.00420e00
add esp, 4
lea ecx, [ebp - 0x10]
push eax
push str.ForcingDiagnostics
call fcn.00403040
mov ecx, dword [esi + 0x14]
lea eax, [ebp - 0x10]
push str.True
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040f970
push eax
call fcn.0041a630
mov ecx, dword [ebp - 0x1c]
add esp, 8
add ecx, ecx
mov bl, al
push ecx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
call fcn.00420bb0
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
add eax, eax
mov dword [ebp - 0x18], 0
push eax
push dword [ebp - 8]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
call fcn.00420bb0
test bl, bl
je 0x41dde3
mov ecx, dword [esi + 0x18]
call fcn.004138e0
mov ecx, dword [esi + 0x18]
call fcn.00413b60
cmp dword [esi + 0x24], 0
je 0x41de1f
mov eax, dword [esi + 0x2c]
mov ecx, 0x5b3144
test eax, eax
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esi + 0x24], 0
je 0x41ddfd
mov eax, dword [esi + 0x2c]
mov ecx, 0x5b3144
test eax, eax
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi + 0x18]
call fcn.00414650
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
mov ecx, esi
mov dword [esi + 0xa4], eax
call fcn.0041df80
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10