Function at 0x407ef4
Capabilities:
Create process on windows
Delete file
Get common file path
Get file size
Read file on windows
Self delete
Timestomp file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x5a
push 0
push 0
dec ecx
jne 0x407efc
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x40834b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0x298]
xor eax, eax
call fcn.0040271c
mov eax, dword [ebp - 0x298]
mov edx, 0x40
call fcn.00404a84
mov esi, eax
cmp esi, 0xffffffff
je 0x408320
push 0
push esi
call sub.KERNEL32.DLL_GetFileSize
cmp eax, dword [0x4129a0]
setg bl
test bl, bl
je 0x40831a
lea edx, [ebp - 0x29c]
mov eax, 0x408364
call fcn.00404cc0
mov eax, dword [ebp - 0x29c]
push eax
lea edx, [ebp - 0x2a0]
xor eax, eax
call fcn.0040271c
mov edx, dword [ebp - 0x2a0]
lea eax, [ebp - 0x14]
pop ecx
call fcn.00403354
mov eax, dword [ebp - 0x14]
call fcn.00403508
push eax
call sub.KERNEL32.DLL_DeleteFileA
mov eax, dword [ebp - 0x14]
call fcn.00404a74
test al, al
jne 0x40831a
mov eax, dword [ebp - 0x14]
call fcn.004048d4
mov edi, eax
cmp edi, 0xffffffff
je 0x40831a
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
call sub.KERNEL32.DLL_GetFileTime
lea eax, [ebp - 0x1c]
mov edx, 0x408374
call fcn.0040320c
lea eax, [ebp - 0x2a8]
mov ecx, 0x408384
mov edx, dword [ebp - 0x1c]
call fcn.00403354
mov eax, dword [ebp - 0x2a8]
lea edx, [ebp - 0x2a4]
call fcn.00404cc0
mov eax, dword [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x2ac]
call fcn.00407ea4
mov edx, dword [ebp - 0x2ac]
lea eax, [ebp - 0x10]
pop ecx
call fcn.00403354
mov eax, dword [ebp - 0x10]
call fcn.004048d4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x408091
mov eax, dword [0x4129a0]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x408082
push 0
lea eax, [ebp - 8]
push eax
mov edx, 0x1000000
mov eax, dword [ebp - 0xc]
call fcn.00407e9c
push eax
mov eax, dword [0x412990]
push eax
push esi
call sub.KERNEL32.DLL_ReadFile
cmp dword [ebp - 8], 0
je 0x408082
mov eax, dword [ebp - 8]
sub dword [ebp - 0xc], eax
mov edx, dword [0x412990]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004048f8
cmp dword [ebp - 0xc], 0
ja 0x40803f
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov byte [ebp - 0x35], 1
jmp 0x408095
mov byte [ebp - 0x35], 0
push 0
push 0
mov eax, dword [0x4129a0]
push eax
push esi
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [ebp - 8]
push eax
push 0x1000000
mov eax, dword [0x412990]
push eax
push esi
call sub.KERNEL32.DLL_ReadFile
cmp dword [ebp - 8], 0
je 0x4080d4
mov edx, dword [0x412990]
mov ecx, dword [ebp - 8]
mov eax, edi
call fcn.004048f8
jmp 0x4080a5
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
push edi
call sub.KERNEL32.DLL_SetFileTime
push edi
call sub.KERNEL32.DLL_CloseHandle
mov byte [ebp - 0x13a], 0
lea eax, [ebp - 0x13a]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
mov byte [ebp - 0x23f], 0
lea eax, [ebp - 0x23f]
push eax
push 0
lea edx, [ebp - 0x2b0]
mov eax, 0x408394
call fcn.00404cc0
mov eax, dword [ebp - 0x2b0]
call fcn.00403508
push eax
lea eax, [ebp - 0x13a]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
lea edx, [ebp - 0x2b4]
mov eax, 0x4083a4
call fcn.00404cc0
mov eax, dword [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2b8]
lea edx, [ebp - 0x23f]
mov ecx, 0x105
call fcn.004032f0
mov eax, dword [ebp - 0x2b8]
lea ecx, [ebp - 0x18]
pop edx
call fcn.0040492c
mov eax, dword [ebp - 0x18]
call fcn.00403508
push eax
call sub.KERNEL32.DLL_DeleteFileA
mov eax, dword [ebp - 0x18]
call fcn.004048d4
mov edi, eax
cmp edi, 0xffffffff
je 0x40831a
push 0x4083b4
lea edx, [ebp - 0x2bc]
xor eax, eax
call fcn.0040271c
push dword [ebp - 0x2bc]
push 0x4083cc
push 0x4083d8
lea edx, [ebp - 0x2c0]
xor eax, eax
call fcn.0040271c
push dword [ebp - 0x2c0]
push 0x4083ec
push 0x4083f8
push 0x408410
push dword [ebp - 0x14]
push 0x408420
lea edx, [ebp - 0x2c8]
xor eax, eax
call fcn.0040271c
mov eax, dword [ebp - 0x2c8]
lea edx, [ebp - 0x2c4]
call fcn.004046f4
push dword [ebp - 0x2c4]
push 0x4083cc
push 0x4083d8
push dword [ebp - 0x14]
push 0x4083ec
push 0x40842c
push 0x4083ec
lea edx, [ebp - 0x2cc]
xor eax, eax
call fcn.0040271c
push dword [ebp - 0x2cc]
push 0x4083cc
push 0x408444
push 0x408454
push dword [ebp - 0x18]
push 0x4083cc
lea eax, [ebp - 0x1c]
mov edx, 0x17
call fcn.004033c8
mov eax, dword [ebp - 0x1c]
call fcn.00403308
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00403508
mov edx, eax
mov eax, edi
pop ecx
call fcn.004048f8
push edi
call sub.KERNEL32.DLL_CloseHandle
lea eax, [ebp - 0x294]
xor ecx, ecx
mov edx, 0x44
call fcn.004027ec
mov dword [ebp - 0x268], 1
mov word [ebp - 0x264], 0
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x294]
push eax
lea edx, [ebp - 0x2d4]
xor eax, eax
call fcn.0040271c
mov eax, dword [ebp - 0x2d4]
lea edx, [ebp - 0x2d0]
call fcn.00404640
mov eax, dword [ebp - 0x2d0]
call fcn.00403508
push eax
push 0
push 0x20
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.00403508
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x40831a
cmp byte [ebp - 0x35], 0
je 0x408313
mov eax, dword [0x412998]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.0040e3d4
push 0
call sub.KERNEL32.DLL_ExitProcess
push esi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408352
lea eax, [ebp - 0x2d4]
mov edx, 0x10
call fcn.00403198
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00403198
ret