Function at 0x41d494
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x53
push 0
push 0
dec ecx
jne 0x41d49c
push ebx
push esi
push edi
lea ebx, [ebp - 0x1cc]
xor eax, eax
push ebp
push 0x41db1a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x434cb0]
cmp byte [eax + 0x1a0e], 0
je 0x41d521
push 1
lea edx, [ebp - 0x1d4]
mov eax, 0x41db30
call fcn.0041e5c0
mov eax, dword [ebp - 0x1d4]
call fcn.004027b0
mov edx, eax
lea eax, [ebp - 0x1d0]
call fcn.00402540
mov eax, dword [ebp - 0x1d0]
push eax
lea eax, [ebp - 0x1d8]
mov edx, dword [0x434cb0]
add edx, 0x300
call fcn.00402570
mov ecx, dword [ebp - 0x1d8]
mov eax, 0x80000001
pop edx
call fcn.0041f158
lea edx, [ebp - 0x1e4]
xor eax, eax
call fcn.004043a4
mov eax, dword [ebp - 0x1e4]
lea edx, [ebp - 0x1e0]
call fcn.004044bc
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x1e8]
mov edx, dword [0x4349ac]
call fcn.00402540
mov edx, dword [ebp - 0x1e8]
pop eax
call fcn.004025c0
mov eax, dword [ebp - 0x1e0]
lea edx, [ebp - 0x1dc]
call fcn.0041f88c
mov eax, dword [ebp - 0x1dc]
call fcn.0041f290
lea edx, [ebp - 0x1f4]
xor eax, eax
call fcn.004043a4
mov eax, dword [ebp - 0x1f4]
lea edx, [ebp - 0x1f0]
call fcn.004044bc
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp - 0x1f8]
mov edx, dword [0x4349a8]
call fcn.00402540
mov edx, dword [ebp - 0x1f8]
pop eax
call fcn.004025c0
mov eax, dword [ebp - 0x1f0]
lea edx, [ebp - 0x1ec]
call fcn.0041f88c
mov eax, dword [ebp - 0x1ec]
call fcn.0041f290
lea edx, [ebp - 0x204]
xor eax, eax
call fcn.004043a4
mov eax, dword [ebp - 0x204]
lea edx, [ebp - 0x200]
call fcn.004044bc
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x208]
mov edx, dword [0x4349b0]
call fcn.00402540
mov edx, dword [ebp - 0x208]
pop eax
call fcn.004025c0
mov eax, dword [ebp - 0x200]
lea edx, [ebp - 0x1fc]
call fcn.0041f88c
mov eax, dword [ebp - 0x1fc]
call fcn.0041f290
lea edx, [ebp - 0x214]
xor eax, eax
call fcn.004043a4
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x210]
call fcn.004044bc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
mov edx, dword [0x4349b4]
call fcn.00402540
mov edx, dword [ebp - 0x218]
pop eax
call fcn.004025c0
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x20c]
call fcn.0041f88c
mov eax, dword [ebp - 0x20c]
call fcn.0041f290
lea edx, [ebp - 0x224]
xor eax, eax
call fcn.004043a4
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x220]
call fcn.004044bc
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x228]
mov edx, dword [0x4349b8]
call fcn.00402540
mov edx, dword [ebp - 0x228]
pop eax
call fcn.004025c0
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.0041f88c
mov eax, dword [ebp - 0x21c]
call fcn.0041f290
lea edx, [ebp - 0x234]
xor eax, eax
call fcn.004043a4
mov eax, dword [ebp - 0x234]
lea edx, [ebp - 0x230]
call fcn.004044bc
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x238]
mov edx, dword [0x4349bc]
call fcn.00402540
mov edx, dword [ebp - 0x238]
pop eax
call fcn.004025c0
mov eax, dword [ebp - 0x230]
lea edx, [ebp - 0x22c]
call fcn.0041f88c
mov eax, dword [ebp - 0x22c]
call fcn.0041f290
cmp byte [0x4349c0], 0
jne 0x41d787
lea eax, [ebp - 0x23c]
mov edx, dword [0x4349ac]
call fcn.00402540
mov eax, dword [ebp - 0x23c]
call fcn.00425578
test al, al
je 0x41d787
mov eax, dword [0x434bf8]
mov eax, dword [eax]
call eax
mov eax, 0x41db68
call fcn.0041e6a8
xor eax, eax
push ebp
push 0x41daed
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x244]
xor eax, eax
call fcn.004043a4
mov eax, dword [ebp - 0x244]
lea edx, [ebp - 0x240]
call fcn.0041a51c
lea eax, [ebp - 0x240]
mov edx, 0x41db80
call fcn.004025c0
mov edx, dword [ebp - 0x240]
mov eax, ebx
call fcn.00401644
mov eax, ebx
call fcn.004013e0
call fcn.00401288
mov edx, 0x41db98
mov eax, ebx
call fcn.00402940
call fcn.00401a38
call fcn.00401288
mov edx, 0x41dbac
mov eax, ebx
call fcn.00402940
call fcn.00401a38
call fcn.00401288
lea eax, [ebp - 0x24c]
mov edx, dword [0x4349ac]
call fcn.00402540
mov ecx, dword [ebp - 0x24c]
lea eax, [ebp - 0x248]
mov edx, 0x41dbbc
call fcn.00402604
mov edx, dword [ebp - 0x248]
mov eax, ebx
call fcn.00402940
call fcn.00401a38
call fcn.00401288
lea eax, [ebp - 0x254]
mov edx, dword [0x4349a8]
call fcn.00402540
mov ecx, dword [ebp - 0x254]
lea eax, [ebp - 0x250]
mov edx, 0x41dbbc
call fcn.00402604
mov edx, dword [ebp - 0x250]
mov eax, ebx
call fcn.00402940
call fcn.00401a38
call fcn.00401288
lea eax, [ebp - 0x25c]
mov edx, dword [0x4349b0]
call fcn.00402540
mov ecx, dword [ebp - 0x25c]
lea eax, [ebp - 0x258]
mov edx, 0x41dbbc
call fcn.00402604
mov edx, dword [ebp - 0x258]
mov eax, ebx
call fcn.00402940
call fcn.00401a38
call fcn.00401288
lea eax, [ebp - 0x264]
mov edx, dword [0x4349b4]
call fcn.00402540
mov ecx, dword [ebp - 0x264]
lea eax, [ebp - 0x260]
mov edx, 0x41dbbc
call fcn.00402604
mov edx, dword [ebp - 0x260]
mov eax, ebx
call fcn.00402940
call fcn.00401a38
call fcn.00401288
lea eax, [ebp - 0x26c]
mov edx, dword [0x4349b8]
call fcn.00402540
mov ecx, dword [ebp - 0x26c]
lea eax, [ebp - 0x268]
mov edx, 0x41dbbc
call fcn.00402604
mov edx, dword [ebp - 0x268]
mov eax, ebx
call fcn.00402940
call fcn.00401a38
call fcn.00401288
lea eax, [ebp - 0x274]
mov edx, dword [0x434cb0]
add edx, 0x200
call fcn.00402570
mov ecx, dword [ebp - 0x274]
lea eax, [ebp - 0x270]
mov edx, 0x41dbbc
call fcn.00402604
mov edx, dword [ebp - 0x270]
mov eax, ebx
call fcn.00402940
call fcn.00401a38
call fcn.00401288
push 0x41dbcc
lea eax, [ebp - 0x27c]
mov edx, dword [0x4349ac]
call fcn.00402540
push dword [ebp - 0x27c]
push 0x41dbe0
lea eax, [ebp - 0x278]
mov edx, 3
call fcn.00402678
mov edx, dword [ebp - 0x278]
mov eax, ebx
call fcn.00402940
call fcn.00401a38
call fcn.00401288
push 0x41dbcc
lea eax, [ebp - 0x284]
mov edx, dword [0x4349a8]
call fcn.00402540
push dword [ebp - 0x284]
push 0x41dbe0
lea eax, [ebp - 0x280]
mov edx, 3
call fcn.00402678
mov edx, dword [ebp - 0x280]
mov eax, ebx
call fcn.00402940
call fcn.00401a38
call fcn.00401288
mov edx, 0x41dbf4
mov eax, ebx
call fcn.00402940
call fcn.00401a38
call fcn.00401288
mov edx, 0x41dc04
mov eax, ebx
call fcn.00402940
call fcn.00401a38
call fcn.00401288
mov eax, ebx
call fcn.00401700
call fcn.00401288
push 0
lea edx, [ebp - 0x28c]
xor eax, eax
call fcn.004043a4
mov eax, dword [ebp - 0x28c]
lea edx, [ebp - 0x288]
call fcn.0041a51c
mov eax, dword [ebp - 0x288]
call fcn.004027b0
push eax
lea edx, [ebp - 0x290]
xor eax, eax
call fcn.004043a4
mov eax, dword [ebp - 0x290]
call fcn.004027b0
push eax
lea edx, [ebp - 0x298]
xor eax, eax
call fcn.004043a4
mov eax, dword [ebp - 0x298]
lea edx, [ebp - 0x294]
call fcn.0041a51c
lea eax, [ebp - 0x294]
mov edx, 0x41db80
call fcn.004025c0
mov eax, dword [ebp - 0x294]
call fcn.004027b0
push eax
push 0x41dc0c
call sub.user32.dll_GetForegroundWindow
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41daf7
call fcn.00402288
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41db21
lea eax, [ebp - 0x298]
mov edx, 0x33
call fcn.00402438
ret