Function at 0x421ce0
Capabilities:
Create process on windows
Delete file
Self delete
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x784
mov eax, dword [0x46304c]
xor eax, esp
mov dword [esp + 0x780], eax
push esi
mov esi, ecx
test esi, esi
jne 0x421d1a
push 0x57
call sub.Storm.dll_Ordinal_465
xor eax, eax
pop esi
mov ecx, dword [esp + 0x780]
xor ecx, esp
call fcn.00401d9e
add esp, 0x784
ret
mov edx, 0x104
lea ecx, [esp + 0x7c]
call sym.War3.exe_G5
lea eax, [esp + 0x7c]
push eax
call sub.Storm.dll_Ordinal_506
test eax, eax
je 0x421d44
cmp byte [esp + eax + 0x7b], 0x5c
lea eax, [esp + eax + 0x7b]
jne 0x421d44
mov byte [eax], 0
push ebx
push ebp
push edi
mov byte [esp + 0x390], 0
cmp byte [esi], 0
lea ebx, [esp + 0x390]
mov edi, esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x20], edi
je 0x422064
jmp 0x421d74
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push edi
call sub.Storm.dll_Ordinal_266
test eax, eax
je 0x422139
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x28]
push edx
push eax
call sub.Storm.dll_Ordinal_251
mov eax, dword [esp + 0x28]
test eax, eax
je 0x421dab
cmp eax, 5
jb 0x42212f
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
push 0
push str.Prepatch.lst
push edx
call sub.Storm.dll_Ordinal_268
test eax, eax
je 0x422036
mov eax, dword [esp + 0x1c]
push 0
push eax
call sub.Storm.dll_Ordinal_265
push 0
push 0x139
mov edi, eax
push str..W32OsBattleNet.cpp
push edi
mov dword [esp + 0x34], edi
call sub.Storm.dll_Ordinal_401
mov ecx, dword [esp + 0x1c]
push 0
push 0
mov ebp, eax
push edi
push ebp
push ecx
mov dword [esp + 0x40], ebp
call sub.Storm.dll_Ordinal_269
test eax, eax
je 0x422016
test edi, edi
mov ebx, ebp
jbe 0x422012
mov edx, ebx
sub edx, ebp
cmp edx, edi
mov byte [esp + 0x18c], 0
lea eax, [esp + 0x18c]
jae 0x421e5d
xor esi, esi
mov edi, edi
cmp esi, 0x100
jae 0x421e5d
mov cl, byte [ebx]
test cl, cl
je 0x421e5d
cmp cl, 0xd
je 0x421e5d
cmp cl, 0xa
je 0x421e5d
mov byte [eax], cl
add eax, 1
add edx, 1
add esi, 1
add ebx, 1
cmp edx, edi
mov byte [eax], 0
jb 0x421e30
mov eax, ebx
sub eax, ebp
cmp eax, edi
jae 0x421e7b
mov ecx, eax
mov al, byte [ebx]
cmp al, 0xd
je 0x421e71
cmp al, 0xa
jne 0x421e7b
add ecx, 1
add ebx, 1
cmp ecx, edi
jb 0x421e67
mov dl, 0x20
lea ecx, [esp + 0x18c]
mov byte [esp + 0x28c], 0
call sub.Storm.dll_Ordinal_569
mov esi, eax
test esi, esi
je 0x421ecb
cmp byte [esi], 0x20
jne 0x421ea8
lea esp, [esp]
add esi, 1
cmp byte [esi], 0x20
je 0x421ea0
push esi
lea edx, [esp + 0x8c]
push edx
push str._s_s
lea eax, [esp + 0x298]
push 0x104
push eax
call sub.Storm.dll_Ordinal_578
add esp, 0x14
push 7
push str.delete
lea ecx, [esp + 0x194]
push ecx
call sub.Storm.dll_Ordinal_509
test eax, eax
jne 0x421efa
test esi, esi
je 0x421efa
lea edx, [esp + 0x28c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x421fcf
push 8
push str.extract
lea eax, [esp + 0x194]
push eax
call sub.Storm.dll_Ordinal_509
test eax, eax
jne 0x421fcf
test esi, esi
je 0x421fcf
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push eax
push esi
push edx
call sub.Storm.dll_Ordinal_268
test eax, eax
je 0x421fcf
mov eax, dword [esp + 0x18]
push 0
push eax
call sub.Storm.dll_Ordinal_265
push 0
push 0x165
mov edi, eax
push str..W32OsBattleNet.cpp
push edi
call sub.Storm.dll_Ordinal_401
mov ecx, dword [esp + 0x18]
push 0
push 0
push edi
mov ebp, eax
push ebp
push ecx
call sub.Storm.dll_Ordinal_269
test eax, eax
je 0x421fab
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
lea edx, [esp + 0x2a4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x421fab
push 0
lea eax, [esp + 0x34]
push eax
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x176
push str..W32OsBattleNet.cpp
push ebp
call sub.Storm.dll_Ordinal_403
mov ecx, dword [esp + 0x18]
push ecx
call sub.Storm.dll_Ordinal_253
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x24]
push 8
push str.execute
lea edx, [esp + 0x194]
push edx
call sub.Storm.dll_Ordinal_509
test eax, eax
jne 0x422006
mov esi, dword [esp + 0x10]
push bind
lea eax, [esp + 0x290]
push eax
push esi
call sub.Storm.dll_Ordinal_501
lea ecx, [esi + eax + 1]
mov dword [esp + 0x10], ecx
mov edx, ebx
sub edx, ebp
cmp edx, edi
jb 0x421e15
mov ebx, dword [esp + 0x10]
push 0
push 0x183
push str..W32OsBattleNet.cpp
push ebp
call sub.Storm.dll_Ordinal_403
mov eax, dword [esp + 0x1c]
push eax
call sub.Storm.dll_Ordinal_253
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
push ecx
call sub.Storm.dll_Ordinal_252
push edi
call sub.Storm.dll_Ordinal_506
cmp byte [edi + eax + 1], 0
lea eax, [edi + eax + 1]
mov dword [esp + 0x20], eax
jne 0x421d70
lea eax, [esp + 0x390]
cmp ebx, eax
jne 0x422094
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0x794]
push str._s_bnupdate.exe
sub edx, ebx
push edx
push ebx
call sub.Storm.dll_Ordinal_578
add esp, 0x10
push ebx
call sub.Storm.dll_Ordinal_506
lea eax, [ebx + eax + 1]
mov dword [esp + 0x10], eax
mov ebx, eax
mov byte [ebx], 0
cmp byte [esp + 0x390], 0
lea esi, [esp + 0x390]
je 0x422111
mov ebx, dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebp, 0x44
push ebp
lea ecx, [esp + 0x48]
push 0
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x90]
push ecx
push 0
push 0x20
push 0
push 0
push 0
push esi
push 0
mov dword [esp + 0x6c], ebp
call ebx
test eax, eax
je 0x422140
mov edx, dword [esp + 0x38]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esp + 0x34]
push eax
call edi
push esi
call sub.Storm.dll_Ordinal_506
cmp byte [esi + eax + 1], 0
lea esi, [esi + eax + 1]
jne 0x4220b3
mov eax, 1
mov ecx, dword [esp + 0x790]
pop edi
pop ebp
pop ebx
pop esi
xor ecx, esp
call fcn.00401d9e
add esp, 0x784
ret
mov edx, dword [esp + 0x14]
push edx
call sub.Storm.dll_Ordinal_252
mov eax, 4
jmp 0x422116
mov eax, 2
jmp 0x422116