Function at 0x40f11c
Capabilities:
Accept command line arguments
Create process on windows
Delete file
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x10
push 0
push 0
dec ecx
jne 0x40f124
push ebx
push esi
push edi
mov eax, 0x40cbb4
call fcn.00405f60
xor eax, eax
push ebp
push 0x40fa7c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x414614], eax
xor eax, eax
mov dword [0x414644], eax
call fcn.0040cb04
or al, byte [0x40fa8c]
call fcn.0040cb14
xor eax, eax
mov dword [0x41463c], eax
xor eax, eax
mov dword [0x414640], eax
call sub.comctl32.dll_InitCommonControls_1
mov eax, 0x414634
call fcn.00404704
call fcn.004076fc
mov esi, eax
push 0xa
mov ecx, 0x40fa90
mov edx, dword [0x413b70]
mov eax, esi
call fcn.00407708
mov eax, esi
call fcn.00407470
test eax, eax
jne 0x40f1bd
mov eax, 2
call fcn.0040c7ec
mov eax, esi
call fcn.00406710
jmp 0x40fa39
call fcn.004076fc
mov edi, eax
mov edx, edi
mov eax, esi
call fcn.0040c478
test eax, eax
je 0x40f1ee
mov eax, 3
call fcn.0040c7ec
mov eax, edi
call fcn.00406710
mov eax, esi
call fcn.00406710
jmp 0x40fa39
call fcn.00409c44
mov ebx, eax
xor ecx, ecx
mov edx, edi
mov eax, ebx
call fcn.00409dd0
mov eax, esi
call fcn.00406710
mov eax, edi
call fcn.00406710
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, ebx
call fcn.00409ce0
cmp dword [ebp - 0x14], 0
jne 0x40f236
mov eax, 4
call fcn.0040c7ec
mov eax, ebx
call fcn.00406710
jmp 0x40fa39
lea ecx, [ebp - 0x18]
mov edx, 1
mov eax, ebx
call fcn.00409ce0
mov edx, dword [ebp - 0x18]
mov eax, 0x414618
call fcn.00404998
lea ecx, [ebp - 0x1c]
mov edx, 0xb
mov eax, ebx
call fcn.00409ce0
mov eax, dword [ebp - 0x1c]
mov edx, 0x40faa4
call fcn.00404e90
je 0x40f310
lea ecx, [ebp - 0x20]
mov edx, 0xb
mov eax, ebx
call fcn.00409ce0
mov eax, dword [ebp - 0x20]
call fcn.00404bf0
push eax
call sub.user32.dll_RegisterWindowMessageW
mov dword [0x414648], eax
lea ecx, [ebp - 0x24]
mov edx, 0xb
mov eax, ebx
call fcn.00409ce0
mov eax, dword [ebp - 0x24]
call fcn.00404bf0
mov ecx, eax
or edx, 0xffffffff
xor eax, eax
call fcn.00406538
mov dword [0x414644], eax
cmp dword [0x414644], 0
je 0x40f2d3
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x40f310
call sub.kernel32.dll_GetCommandLineW_1
mov esi, eax
push esi
call sub.kernel32.dll_GlobalAddAtomW
mov edi, eax
movzx eax, di
push eax
mov eax, esi
call fcn.00404a90
push eax
mov eax, dword [0x414648]
push eax
push 0xffff
call sub.user32.dll_SendMessageW
push edi
call sub.kernel32.dll_GlobalDeleteAtom
mov eax, ebx
call fcn.00406710
jmp 0x40fa39
lea ecx, [ebp - 0x28]
mov edx, 0xa
mov eax, ebx
call fcn.00409ce0
mov eax, dword [ebp - 0x28]
mov edx, 0x40faa4
call fcn.00404e90
je 0x40f372
lea ecx, [ebp - 0x2c]
mov edx, 0xa
mov eax, ebx
call fcn.00409ce0
mov edx, dword [ebp - 0x2c]
mov eax, 0x4109b0
call fcn.00404998
push 0x40c9b8
mov edx, 0x40faa8
xor ecx, ecx
mov eax, dword [0x413b70]
call fcn.0040627c
mov dword [0x414614], eax
push 1
mov eax, dword [0x414614]
push eax
call sub.user32.dll_ShowWindow
lea ecx, [ebp - 0x30]
mov edx, 2
mov eax, ebx
call fcn.00409ce0
mov edx, dword [ebp - 0x30]
mov eax, 0x414620
call fcn.00404998
lea ecx, [ebp - 0x34]
mov edx, 3
mov eax, ebx
call fcn.00409ce0
mov edx, dword [ebp - 0x34]
mov eax, 0x41461c
call fcn.00404998
mov byte [0x414631], 0
lea ecx, [ebp - 0x38]
mov edx, 5
mov eax, ebx
call fcn.00409ce0
mov eax, dword [ebp - 0x38]
mov edx, 0x40fabc
call fcn.00404e90
sete byte [0x414632]
lea eax, [ebp - 0x3c]
mov ecx, dword [0x414620]
mov edx, 0x40facc
call fcn.00404d58
mov edx, dword [ebp - 0x3c]
mov eax, 0x80000002
call fcn.00407328
mov esi, eax
mov byte [0x414630], 0
test esi, esi
je 0x40f480
lea ecx, [ebp - 0x40]
mov edx, 0x40fb00
mov eax, esi
call fcn.004073e8
mov edx, dword [ebp - 0x40]
mov eax, 0x414634
call fcn.00404998
mov eax, dword [0x414634]
call fcn.00407144
test al, al
je 0x40f432
mov byte [0x414630], 1
mov edx, 0x40fb1c
mov eax, esi
call fcn.00407358
mov dword [0x41463c], eax
mov eax, esi
call fcn.00407450
cmp dword [0x41463c], 0x4e20
jge 0x40f467
mov eax, 0x414634
call fcn.00404704
mov byte [0x414630], 0
mov eax, dword [0x41461c]
call fcn.00406f18
cmp eax, dword [0x41463c]
jne 0x40f480
mov byte [0x414630], 1
cmp dword [0x414614], 0
je 0x40f493
mov eax, 0xa
call fcn.0040ca40
cmp byte [0x414630], 0
jne 0x40f588
cmp dword [0x41463c], 0
jne 0x40f508
lea ecx, [ebp - 0x44]
mov edx, 9
mov eax, ebx
call fcn.00409ce0
mov eax, dword [ebp - 0x44]
push eax
lea edx, [ebp - 0x50]
xor eax, eax
call fcn.00407030
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x4c]
call fcn.0040725c
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.00407244
mov edx, dword [ebp - 0x48]
mov eax, 0x414628
pop ecx
call fcn.00404d58
mov eax, dword [0x414628]
call fcn.00407144
test al, al
je 0x40f508
mov eax, 0x414634
mov edx, dword [0x414628]
call fcn.00404998
mov eax, dword [0x414634]
call fcn.00407144
test al, al
je 0x40f588
mov edx, 0x8000
mov eax, dword [0x414634]
call fcn.0040ca80
mov dword [0x414640], eax
cmp dword [0x414640], 0
je 0x40f588
push 0x40fb2c
mov eax, dword [0x414640]
push eax
call fcn.00405fe4
mov esi, eax
mov dword [0x4109b8], esi
test esi, esi
je 0x40f56d
push 0
mov eax, dword [0x41461c]
call fcn.00406f18
push eax
call dword [0x4109b8]
test al, al
je 0x40f56d
mov byte [0x414630], 1
cmp byte [0x414630], 0
jne 0x40f588
mov eax, dword [0x414640]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
mov dword [0x414640], eax
cmp byte [0x414630], 0
jne 0x40f650
cmp byte [0x414632], 0
je 0x40f650
lea ecx, [ebp - 0x54]
mov edx, 0xc
mov eax, ebx
call fcn.00409ce0
mov eax, dword [ebp - 0x54]
push eax
lea eax, [ebp - 0x5c]
call fcn.004072b0
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x58]
call fcn.00407244
mov edx, dword [ebp - 0x58]
mov eax, 0x414628
pop ecx
call fcn.00404d58
mov eax, dword [0x414628]
call fcn.00407144
test al, al
je 0x40f5f4
mov eax, dword [0x414628]
call fcn.00404bf0
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [0x414628]
call fcn.00407144
test al, al
jne 0x40f624
mov edx, 0x40fb54
mov eax, dword [0x414628]
call fcn.0040c3c8
test al, al
jne 0x40f624
mov eax, 5
call fcn.0040c7ec
jmp 0x40fa39
mov eax, dword [0x414628]
call fcn.00407144
test al, al
je 0x40f650
mov eax, 0x414634
mov edx, dword [0x414628]
call fcn.00404998
mov byte [0x414630], 1
mov byte [0x414631], 1
cmp dword [0x414614], 0
je 0x40f663
mov eax, 0x19
call fcn.0040ca40
cmp byte [0x414630], 0
jne 0x40f7c3
mov eax, dword [0x414618]
call fcn.00407aac
mov edx, dword [0x4109bc]
mov dword [edx], eax
mov edx, dword [0x4109bc]
mov edx, dword [edx]
mov eax, 0x414638
call fcn.0040c4ac
mov eax, dword [0x4109c0]
mov edx, dword [0x414638]
mov dword [eax], edx
mov eax, dword [0x414638]
mov eax, dword [eax + 0x18]
mov edx, dword [0x414618]
call fcn.00408c88
lea ecx, [ebp - 0x60]
mov edx, 6
mov eax, ebx
call fcn.00409ce0
mov edx, dword [ebp - 0x60]
mov eax, dword [0x414638]
mov eax, dword [eax + 0x28]
call fcn.00408c88
lea ecx, [ebp - 0x64]
mov edx, 7
mov eax, ebx
call fcn.00409ce0
mov edx, dword [ebp - 0x64]
mov eax, dword [0x414638]
mov eax, dword [eax + 0x2c]
call fcn.00408c88
call fcn.004076fc
mov esi, eax
call fcn.004076fc
mov edi, eax
push 0xa
mov ecx, 0x40fb5c
mov edx, dword [0x413b70]
mov eax, esi
call fcn.00407708
mov edx, edi
mov eax, esi
call fcn.0040c478
test eax, eax
je 0x40f730
mov eax, 6
call fcn.0040c7ec
jmp 0x40fa39
push 0
push 0
mov eax, dword [0x414638]
mov eax, dword [eax + 0x24]
or ecx, 0xffffffff
mov edx, edi
call fcn.0040a55c
mov eax, esi
call fcn.00406710
mov eax, edi
call fcn.00406710
cmp dword [0x414614], 0
je 0x40f768
mov eax, dword [0x414614]
push eax
call sub.user32.dll_DestroyWindow
mov eax, dword [0x414638]
mov eax, dword [eax + 0x18]
call fcn.0040a080
mov esi, eax
mov eax, dword [0x414638]
mov eax, dword [eax + 0x18]
call fcn.00406710
dec esi
jne 0x40f7b7
push 1
push 0x40fb68
push 0x40fb68
lea ecx, [ebp - 0x68]
mov edx, 8
mov eax, ebx
call fcn.00409ce0
mov eax, dword [ebp - 0x68]
call fcn.00404bf0
push eax
push 0x40fb6c
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, ebx
call fcn.00406710
jmp 0x40fa39
cmp byte [0x414630], 0
je 0x40fa32
push 0x40fb84
lea edx, [ebp - 0x6c]
xor eax, eax
call fcn.00407030
push dword [ebp - 0x6c]
push 0x40fb9c
mov eax, 0x41462c
mov edx, 3
call fcn.00404de0
call fcn.004070bc
mov edi, eax
test edi, edi
jle 0x40f89c
mov esi, 1
lea edx, [ebp - 0x70]
mov eax, esi
call fcn.00407030
cmp dword [ebp - 0x70], 0
je 0x40f894
lea edx, [ebp - 0x74]
mov eax, esi
call fcn.00407030
mov edx, dword [ebp - 0x74]
mov eax, 0x40fbac
call fcn.00404f10
test eax, eax
jle 0x40f85d
push 0x40fb9c
lea edx, [ebp - 0x78]
mov eax, esi
call fcn.00407030
push dword [ebp - 0x78]
push 0x40fb9c
mov eax, 0x414628
mov edx, 3
call fcn.00404de0
jmp 0x40f874
lea edx, [ebp - 0x7c]
mov eax, esi
call fcn.00407030
mov edx, dword [ebp - 0x7c]
mov eax, 0x414628
call fcn.00404998
push dword [0x41462c]
push 0x40fbac
push dword [0x414628]
mov eax, 0x41462c
mov edx, 3
call fcn.00404de0
inc esi
dec edi
jne 0x40f80a
call fcn.0040c928
cmp dword [0x414640], 0
jne 0x40f8be
mov edx, 0x8000
mov eax, dword [0x414634]
call fcn.0040ca80
mov dword [0x414640], eax
cmp dword [0x414640], 0
jne 0x40f8f3
mov eax, 7
call fcn.0040c7ec
cmp byte [0x414631], 0
je 0x40fa39
mov eax, dword [0x414634]
call fcn.00404bf0
push eax
call sub.kernel32.dll_DeleteFileW
jmp 0x40fa39
cmp dword [0x414614], 0
je 0x40f906
mov eax, 0x28
call fcn.0040ca40
call fcn.0040c928
push 0x40fbb0
mov eax, dword [0x414640]
push eax
call fcn.00405fe4
mov esi, eax
mov dword [0x4109b4], esi
test esi, esi
jne 0x40f967
mov eax, 8
call fcn.0040c7ec
cmp dword [0x414640], 0
je 0x40f945
mov eax, dword [0x414640]
push eax
call sub.kernel32.dll_FreeLibrary_1
cmp byte [0x414631], 0
je 0x40fa39
mov eax, dword [0x414634]
call fcn.00404bf0
push eax
call sub.kernel32.dll_DeleteFileW
jmp 0x40fa39
push 0x40fb9c
lea edx, [ebp - 0x80]
xor eax, eax
call fcn.00407030
push dword [ebp - 0x80]
push 0x40fb9c
push dword [0x41462c]
mov eax, 0x41462c
mov edx, 4
call fcn.00404de0
mov eax, dword [0x413b70]
push eax
mov eax, dword [0x414614]
push eax
mov eax, dword [0x41462c]
call fcn.00404bf0
push eax
call dword [0x4109b4]
xor eax, eax
mov dword [0x4109b4], eax
cmp dword [0x414640], 0
je 0x40f9cb
mov eax, dword [0x414640]
push eax
call sub.kernel32.dll_FreeLibrary_1
push 0
mov eax, dword [0x414614]
push eax
call sub.user32.dll_ShowWindow
call fcn.0040c928
cmp dword [0x414614], 0
je 0x40f9f1
mov eax, dword [0x414614]
push eax
call sub.user32.dll_DestroyWindow
cmp byte [0x414631], 0
je 0x40fa32
mov eax, dword [0x414634]
call fcn.00404bf0
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [0x414634]
call fcn.00407144
test al, al
je 0x40fa32
push 0xbb8
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x414634]
call fcn.00404bf0
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, ebx
call fcn.00406710
cmp dword [0x414614], 0
je 0x40fa4d
mov eax, dword [0x414614]
push eax
call sub.user32.dll_DestroyWindow
cmp dword [0x414644], 0
je 0x40fa61
mov eax, dword [0x414644]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fa83
lea eax, [ebp - 0x80]
mov edx, 0x1c
call fcn.00404764
ret