Function at 0x41d384
Capabilities:
Create process on windows
Delete file
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x14
push 0
push 0
dec ecx
jne 0x41d38c
push ebx
push esi
mov eax, dword [0x41f720]
mov byte [eax], 1
mov eax, 0x41aaa0
call fcn.00408a94
xor eax, eax
push ebp
push 0x41d66b
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x424fc4
mov eax, 0x41a4f4
call fcn.004087b0
mov eax, dword [0x41f5c8]
xor edx, edx
mov dword [eax], edx
mov dl, 1
mov eax, dword [0x41a514]
call fcn.0041a7a4
mov esi, eax
mov edx, 0x41d688
mov eax, esi
call fcn.0041a8c8
test al, al
je 0x41d614
mov edx, 0x424f94
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x48]
call fcn.00403de8
mov eax, esi
call fcn.0041a7f8
mov edx, 0x41d6a0
mov eax, esi
call fcn.0041a8c8
test al, al
je 0x41d5e8
lea eax, [ebp - 0x80]
call fcn.004096c0
mov eax, dword [ebp - 0x80]
lea edx, [ebp - 0x7c]
call fcn.00409610
mov edx, dword [ebp - 0x7c]
mov eax, 0x424fb8
call fcn.00406160
lea eax, [ebp - 0x88]
mov edx, 0x424f94
call fcn.00406650
mov edx, dword [ebp - 0x88]
lea ecx, [ebp - 0x84]
mov eax, dword [0x424fb8]
call fcn.004093bc
mov edx, dword [ebp - 0x84]
mov eax, 0x424fbc
call fcn.00406160
mov edx, dword [0x424fbc]
mov eax, esi
call fcn.0041a80c
lea eax, [ebp - 0x8c]
call fcn.004097f0
mov eax, dword [ebp - 0x8c]
call fcn.00406570
push eax
lea edx, [ebp - 0x90]
mov eax, 0x41a4ec
call fcn.004087b0
mov eax, dword [ebp - 0x90]
call fcn.00406570
push eax
call sub.kernel32.dll_SetEnvironmentVariableW
push 0x41d6bc
push dword [0x424fbc]
push 0x41d6e4
lea eax, [ebp - 0x94]
mov edx, dword [0x41f6dc]
mov edx, dword [edx]
call fcn.004065c8
push dword [ebp - 0x94]
push 0x41d6f8
mov eax, 0x424fc4
mov edx, 5
call fcn.004067bc
lea eax, [ebp - 0x14]
mov edx, dword [0x424fc4]
call fcn.004061a8
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0xc
call fcn.004043ac
lea eax, [ebp - 0x68]
xor ecx, ecx
mov edx, 0x44
call fcn.004043ac
mov dword [ebp - 0x24], 0xc
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x38], 0
xor eax, eax
mov dword [ebp - 0x1c], eax
xor ebx, ebx
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0x20
cmp bl, 1
cmc
sbb eax, eax
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00406570
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x41d5a2
lea edx, [ebp - 0x98]
mov eax, 0x41a504
call fcn.004087b0
mov edx, dword [ebp - 0x98]
mov eax, dword [0x41f644]
call fcn.00404908
call fcn.00404a08
call fcn.00403d98
jmp 0x41d5cc
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x78]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x78]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x41f5c8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [0x424fbc]
call fcn.00406570
push eax
call sub.kernel32.dll_DeleteFileW
jmp 0x41d63e
push 0x30
push 0x41d6fc
lea edx, [ebp - 0x9c]
mov eax, 0x41a4fc
call fcn.004087b0
mov eax, dword [ebp - 0x9c]
call fcn.00406570
push eax
push 0
call sub.user32.dll_MessageBoxW
jmp 0x41d63e
lea edx, [ebp - 0xa0]
mov eax, 0x41a50c
call fcn.004087b0
mov edx, dword [ebp - 0xa0]
mov eax, dword [0x41f644]
call fcn.00404908
call fcn.00404a08
call fcn.00403d98
mov eax, esi
call fcn.00404cf4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d672
lea eax, [ebp - 0xa0]
mov edx, 0xa
call fcn.00405eb4
lea eax, [ebp - 0x14]
call fcn.00405e54
ret