Function at 0x4d6ff4
Capabilities:
Copy file
Create process on windows
Delete file
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xc
push 0
push 0
dec ecx
jne 0x4d6ffc
push ecx
push ebx
push esi
push edi
mov eax, 0x4d56b4
call fcn.00406fec
xor eax, eax
push ebp
push 0x4d7467
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.004d1514
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x4d7480
call fcn.0040502c
mov eax, dword [ebp - 0x14]
call fcn.004d0bd0
mov eax, dword [0x4dc508]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov edx, 1
call fcn.004d542c
test al, al
jne 0x4d743f
mov eax, dword [0x4dc508]
mov eax, dword [eax]
call fcn.00469efc
mov edx, 0x4e2d64
xor eax, eax
call fcn.004033a0
jmp 0x4d7098
mov edx, dword [0x4e2d64]
mov eax, 0x4d7494
call fcn.004052f0
mov ecx, eax
mov eax, 0x4e2d64
mov edx, 1
call fcn.0040524c
mov edx, dword [0x4e2d64]
mov eax, 0x4d7494
call fcn.004052f0
test eax, eax
jne 0x4d7077
jmp 0x4d70cf
mov edx, dword [0x4e2d64]
mov eax, 0x4d74a0
call fcn.004052f0
mov ecx, eax
mov eax, 0x4e2d64
mov edx, 1
call fcn.0040524c
mov edx, dword [0x4e2d64]
mov eax, 0x4d74a0
call fcn.004052f0
test eax, eax
jne 0x4d70ae
mov edx, dword [0x4e2d64]
mov eax, 0x4d74ac
call fcn.004052f0
test eax, eax
je 0x4d7118
mov edx, dword [0x4e2d64]
mov eax, 0x4d74ac
call fcn.004052f0
mov edx, eax
mov eax, 0x4e2d64
mov ecx, 0x7fffffff
call fcn.0040524c
mov eax, dword [0x4dc508]
mov eax, dword [eax]
mov edx, dword [0x4e2d64]
call fcn.004699b4
xor eax, eax
push ebp
push 0x4d71f1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, 1
call fcn.004033a0
mov eax, dword [ebp - 0x1c]
mov edx, 0x4d74b8
call fcn.0040513c
jne 0x4d71e7
push 0x4d74c8
lea edx, [ebp - 0x24]
mov eax, 2
call fcn.004033a0
push dword [ebp - 0x24]
push 0x4d74dc
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004050a8
mov eax, dword [ebp - 0x20]
call fcn.004d0bd0
call fcn.0040be84
fstp qword [0x4e2d68]
wait
mov eax, dword [0x4dc508]
mov eax, dword [eax]
call fcn.00469de8
lea edx, [ebp - 0x28]
mov eax, 2
call fcn.004033a0
mov eax, dword [ebp - 0x28]
call fcn.004051a4
push eax
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x4d71e7
push 0
mov cx, 0xa
xor edx, edx
xor eax, eax
call fcn.0040bb1c
fadd qword [0x4e2d68]
fstp xword [ebp - 0x34]
wait
call fcn.0040be84
fld xword [ebp - 0x34]
fcompp
wait
fnstsw ax
sahf
jae 0x4d7193
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d71fb
xor eax, eax
push ebp
push 0x4d73ce
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x38]
mov eax, 1
call fcn.004033a0
mov eax, dword [ebp - 0x38]
mov edx, 0x4d74e8
call fcn.0040513c
jne 0x4d73c4
push 0x4d74f8
lea edx, [ebp - 0x40]
mov eax, 2
call fcn.004033a0
push dword [ebp - 0x40]
push 0x4d74dc
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.004050a8
mov eax, dword [ebp - 0x3c]
call fcn.004d0bd0
call fcn.0040be84
fstp qword [0x4e2d68]
wait
mov eax, dword [0x4dc508]
mov eax, dword [eax]
call fcn.00469de8
lea edx, [ebp - 0x44]
mov eax, 2
call fcn.004033a0
mov eax, dword [ebp - 0x44]
call fcn.004051a4
push eax
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x4d72b8
push 0
mov cx, 0xa
xor edx, edx
xor eax, eax
call fcn.0040bb1c
fadd qword [0x4e2d68]
fstp xword [ebp - 0x34]
wait
call fcn.0040be84
fld xword [ebp - 0x34]
fcompp
wait
fnstsw ax
sahf
jae 0x4d7264
xor eax, eax
push ebp
push 0x4d73ba
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4d750c
lea edx, [ebp - 0x4c]
xor eax, eax
call fcn.004033a0
push dword [ebp - 0x4c]
push 0x4d751c
lea edx, [ebp - 0x50]
mov eax, 2
call fcn.004033a0
push dword [ebp - 0x50]
push 0x4d74dc
lea eax, [ebp - 0x48]
mov edx, 5
call fcn.004050a8
mov eax, dword [ebp - 0x48]
call fcn.004d0bd0
push 0xffffffffffffffff
lea edx, [ebp - 0x54]
mov eax, 2
call fcn.004033a0
mov eax, dword [ebp - 0x54]
call fcn.004051a4
push eax
lea edx, [ebp - 0x58]
xor eax, eax
call fcn.004033a0
mov eax, dword [ebp - 0x58]
call fcn.004051a4
push eax
call sub.kernel32.dll_CopyFileA
lea edx, [ebp - 0x5c]
mov eax, 2
call fcn.004033a0
push dword [ebp - 0x5c]
push 0x4d752c
lea edx, [ebp - 0x60]
xor eax, eax
call fcn.004033a0
push dword [ebp - 0x60]
push 0x4d7540
mov eax, 0x4e2d64
mov edx, 4
call fcn.004050a8
push 0x4d754c
push dword [0x4e2d64]
push 0x4d74dc
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.004050a8
mov eax, dword [ebp - 0x64]
call fcn.004d0bd0
push 0
mov eax, dword [0x4e2d64]
call fcn.004051a4
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x4dc508]
mov eax, dword [eax]
call fcn.0046a154
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d73c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d73d8
call fcn.004d1bd8
call fcn.004d1f48
test al, al
je 0x4d740c
mov ecx, dword [0x4dc388]
mov eax, dword [0x4dc508]
mov eax, dword [eax]
mov edx, dword [0x4d1760]
call fcn.00469f14
mov eax, dword [0x4dc508]
mov eax, dword [eax]
call fcn.0046a04c
jmp 0x4d743f
mov eax, dword [0x4dc1c8]
mov edx, 0x4d7560
call fcn.00404d68
mov ecx, dword [0x4dc6d4]
mov eax, dword [0x4dc508]
mov eax, dword [eax]
mov edx, dword [0x4d0e64]
call fcn.00469f14
mov eax, dword [0x4dc508]
mov eax, dword [eax]
call fcn.0046a04c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d746e
lea eax, [ebp - 0x64]
mov edx, 0xc
call fcn.00404d38
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.00404d38
ret