Function at 0x408b50
Capabilities:
Create process on windows
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4183bd
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x42000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [ecx], 0
jne 0x40922e
call fcn.004087e0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0xf
mov byte [ebp - 0x148], 0
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x148]
push eax
push ecx
lea ecx, [ebp - 0x130]
call fcn.004080e0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x134]
cmp edx, 0x10
jb 0x408c2a
mov ecx, dword [ebp - 0x148]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x408c20
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408c5d
push edx
push ecx
call fcn.00416d22
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x408c6d
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x408c63
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x408c63
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00416d22
add esp, 8
mov dword [ebp - 4], 2
lea eax, [ebp - 0x158]
xorps xmm0, xmm0
mov dword [ebp - method.std::_Func_impl_no_alloc_class__lambda_d380a65dfca7f095beaa4c26b785e412___bool__unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64__.virtual_0], vtable.std::_Func_impl_no_alloc_class__lambda_d380a65dfca7f095beaa4c26b785e412___bool__unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64__.0
movups xmmword [ebp - 0x168], xmm0
mov dword [ebp - 0x134], eax
sub esp, 0x28
mov byte [ebp - 4], 3
mov edi, dword [ebp - 0x130]
mov esi, esp
mov dword [esi + 0x24], 0
mov ecx, dword [ebp - 0x134]
test ecx, ecx
je 0x408cef
cmp ecx, eax
jne 0x408ce2
mov eax, dword [ecx]
push esi
mov eax, dword [eax + 4]
call eax
mov dword [esi + 0x24], eax
mov ecx, dword [ebp - 0x134]
test ecx, ecx
je 0x408cef
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea eax, [ebp - 0x158]
cmp ecx, eax
setne al
push eax
call edx
jmp 0x408ce5
mov dword [esi + 0x24], ecx
mov dword [ebp - 0x134], 0
push ecx
lea eax, [ebp - 0x168]
mov ecx, edi
push eax
call fcn.00407ed0
mov ecx, dword [ebp - 0x134]
test ecx, ecx
je 0x408d25
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea eax, [ebp - 0x158]
cmp ecx, eax
setne al
push eax
call edx
mov dword [ebp - 0x134], 0
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov eax, dword [ebp - 0x168]
test eax, eax
je 0x4091be
mov eax, dword [eax + 0x18]
cmp eax, 0xc8
jne 0x4091c0
xor eax, eax
mov dword [ebp - 0x11c], 0
push 0x108
mov dword [ebp - 0x118], 7
mov word [ebp - 0x12c], ax
call fcn.0040b4a0
mov edx, eax
mov dword [ebp - 0x11c], 0x104
xor eax, eax
mov dword [ebp - 0x118], 0x107
mov ecx, 0x82
mov edi, edx
rep stosd dword es:[edi], eax
mov word [edx + 0x208], ax
mov dword [ebp - 0x12c], edx
mov byte [ebp - 4], 5
lea eax, [ebp - 0x12c]
cmp dword [ebp - 0x118], 8
push dword [ebp - 0x11c]
cmovae eax, edx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, eax
test ecx, ecx
je 0x409151
cmp dword [ebp - 0x11c], ecx
jb 0x4092a3
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x11c], ecx
cmovae eax, dword [ebp - 0x12c]
xor edx, edx
mov word [eax + ecx*2], dx
lea eax, [ebp - 0x12c]
cmp dword [ebp - 0x118], 8
mov edi, dword [ebp - 0x11c]
cmovae eax, dword [ebp - 0x12c]
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x16c], eax
cmp edi, 8
jae 0x408e40
movups xmm0, xmmword [eax]
mov dword [ebp - 0x134], 7
movups xmmword [ebp - 0x148], xmm0
jmp 0x408e7b
mov esi, edi
mov eax, 0x7ffffffe
or esi, 7
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.0040b4a0
lea ecx, [edi*2 + 2]
mov dword [ebp - 0x148], eax
push ecx
push dword [ebp - 0x16c]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [ebp - 0x134], esi
mov dword [ebp - 0x138], edi
push 4
push ecx
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 6
call fcn.0040b230
cmp dword [ebp - 0x134], 8
lea eax, [ebp - 0x148]
push 2
cmovae eax, dword [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 0x134], 8
lea eax, [ebp - 0x148]
cmovae eax, dword [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x409100
cmp dword [ebp - 0x134], 8
lea ecx, [ebp - 0x148]
lea eax, [ebp - 0x12c]
cmovae ecx, dword [ebp - 0x148]
cmp dword [ebp - 0x118], 8
push ecx
cmovae eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xb0
lea eax, [ebp - 0xc0]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
lea ecx, [ebp - 0xc0]
cmovae eax, dword [ebp - 0x12c]
push eax
call fcn.00409370
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0xb4], 6
jne 0x4090bc
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax + 0x4c]
add eax, 0x3c
cmp dword [eax + 0x14], 0x10
jb 0x408f6c
mov eax, dword [eax]
push 0
push ecx
push eax
lea ecx, [ebp - 0xc0]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const___long_long___int64__]
lea ecx, [ebp - 0xbc]
call fcn.0040b010
test eax, eax
jne 0x408fa5
push eax
mov eax, dword [ebp - 0xc0]
lea ecx, [ebp - 0xc0]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
push 5
cmovae eax, dword [ebp - 0x12c]
push 0
push 0x41aa40
push eax
push 0x41aa44
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jbe 0x4090a1
lea ecx, [ebp - 0xc0]
call fcn.004092b0
mov edx, dword [ebp - 0x134]
cmp edx, 8
jb 0x409020
mov ecx, dword [ebp - 0x148]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409016
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40906f
push edx
push ecx
call fcn.00416d22
add esp, 8
mov edx, dword [ebp - 0x118]
xor eax, eax
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 7
mov word [ebp - 0x148], ax
cmp edx, 8
jb 0x40907f
mov ecx, dword [ebp - 0x12c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409075
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x409075
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00416d22
add esp, 8
xor eax, eax
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 7
mov word [ebp - 0x12c], ax
jmp 0x4091d4
push eax
push 0x41aa50
call fcn.00408ae0
add esp, 8
lea ecx, [ebp - 0xc0]
call fcn.004092b0
jmp 0x40910d
cmp dword [ebp - 0x134], 8
lea ecx, [ebp - 0x148]
lea eax, [ebp - 0x12c]
cmovae ecx, dword [ebp - 0x148]
cmp dword [ebp - 0x118], 8
push ecx
cmovae eax, dword [ebp - 0x12c]
push eax
push 0x41abb0
call fcn.00408ae0
add esp, 0xc
lea ecx, [ebp - 0xc0]
call fcn.004092b0
jmp 0x40910d
push 0x41ad70
call fcn.00408ae0
add esp, 4
mov edx, dword [ebp - 0x134]
cmp edx, 8
jb 0x40917a
mov ecx, dword [ebp - 0x148]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409145
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x409145
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00416d22
add esp, 8
jmp 0x40917a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x118], 8
lea ecx, [ebp - 0x12c]
push eax
cmovae ecx, dword [ebp - 0x12c]
push ecx
push 0x41aeb8
call fcn.00408ae0
add esp, 0xc
mov edx, dword [ebp - 0x118]
cmp edx, 8
jb 0x4091d4
mov ecx, dword [ebp - 0x12c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4091b2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4091b2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00416d22
add esp, 8
jmp 0x4091d4
xor eax, eax
push dword [ebp - 0x164]
push eax
push 0x41b050
call fcn.00408ae0
add esp, 0xc
lea eax, [ebp - 0x160]
push eax
mov ecx, eax
call fcn.0040dc10
mov esi, dword [ebp - 0x168]
test esi, esi
je 0x409201
mov ecx, esi
call fcn.004019d0
push 0xc8
push esi
call fcn.00416d22
add esp, 8
mov ecx, dword [ebp - 0x130]
test ecx, ecx
je 0x409211
mov eax, dword [ecx]
push 1
call dword [eax]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416887
mov esp, ebp
pop ebp
ret
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, eax
test ecx, ecx
je 0x409211
mov eax, dword [str..old]
mov dword [ebp + ecx - 0x114], eax
mov al, byte [0x41b0f0]
push 4
mov byte [ebp + ecx - 0x110], al
lea eax, [ebp - 0x114]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, 1
jmp 0x409213
call fcn.0040b490
int3