Function at 0x45f668
Capabilities:
Create process on windows
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x53
push 0
push 0
dec ecx
jne 0x45f670
push ebx
push esi
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45fb5a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea edx, [ebp - 0x278]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x2ac]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov edx, dword [ebp - 0x278]
mov eax, dword [ebp - 8]
add eax, 0x490
call fcn.00404e6c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x490]
call fcn.0045da74
test al, al
jne 0x45f6d8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x490]
call fcn.0045da58
test al, al
je 0x45fa2a
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x490]
lea eax, [ebp - 0x20]
mov ecx, 0x45fb70
call fcn.0040510c
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x490]
lea eax, [ebp - 0x24]
mov ecx, 0x45fb90
call fcn.0040510c
lea eax, [ebp - 0x27c]
mov edx, dword [ebp - 0x20]
call fcn.0040493c
mov edx, dword [ebp - 0x27c]
mov eax, dword [ebp - 8]
add eax, 0x2c4
call fcn.00402ed4
mov eax, dword [ebp - 8]
add eax, 0x2c4
call fcn.00402c70
call fcn.004028a4
lea eax, [ebp - 0x274]
xor ecx, ecx
mov edx, 0x250
call fcn.00403140
lea eax, [ebp - 0x18]
mov ecx, 0x45fbb0
mov edx, dword [0x462bdc]
call fcn.0040510c
lea eax, [ebp - 0x274]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00405090
push eax
call sub.kernel32.dll_FindFirstFileW
mov esi, eax
test byte [ebp - 0x274], 0x18
sete bl
cmp esi, 0xffffffff
setne al
test al, bl
je 0x45f7e9
lea eax, [ebp - 0x280]
lea edx, [ebp - 0x248]
mov ecx, 0x104
call fcn.00404ff8
mov eax, dword [ebp - 0x280]
lea ecx, [ebp - 0x14]
mov dl, 1
call fcn.0045daa4
lea eax, [ebp - 4]
lea edx, [ebp - 0x248]
mov ecx, 0x104
call fcn.00404ff8
push ebp
lea eax, [ebp - 0x284]
mov edx, dword [ebp - 0x14]
call fcn.0040493c
mov eax, dword [ebp - 0x284]
xor edx, edx
call fcn.0045f488
pop ecx
mov byte [ebp - 9], 1
lea eax, [ebp - 0x274]
push eax
push esi
call sub.kernel32.dll_FindNextFileW
test eax, eax
je 0x45f80c
test bl, bl
je 0x45f77b
cmp byte [ebp - 9], 0
jne 0x45f77b
cmp byte [ebp - 9], 0
je 0x45fa2a
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28c]
mov edx, dword [eax]
call dword [edx + 0xe4]
test al, al
je 0x45f872
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x490]
lea eax, [ebp - 0x288]
mov ecx, dword [ebp - 0x10]
call fcn.0040510c
mov eax, dword [ebp - 0x288]
xor ecx, ecx
mov edx, 0x19
call fcn.0045ec10
mov eax, dword [ebp - 8]
add eax, 0x2c4
mov edx, dword [ebp - 0x1c]
call fcn.00404d8c
call fcn.00403348
call fcn.004028a4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x290]
mov edx, dword [eax]
call dword [edx + 0xe4]
test al, al
je 0x45f8ce
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x490]
lea eax, [ebp - 0x28c]
mov ecx, dword [ebp - 0x10]
call fcn.0040510c
mov eax, dword [ebp - 0x28c]
xor ecx, ecx
mov edx, 0x17
call fcn.0045ec10
mov eax, dword [ebp - 8]
add eax, 0x2c4
mov edx, dword [ebp - 0x1c]
call fcn.00404d8c
call fcn.00403348
call fcn.004028a4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x294]
mov edx, dword [eax]
call dword [edx + 0xe4]
test al, al
je 0x45f92a
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x490]
lea eax, [ebp - 0x290]
mov ecx, dword [ebp - 0x10]
call fcn.0040510c
mov eax, dword [ebp - 0x290]
xor ecx, ecx
mov edx, 0x16
call fcn.0045ec10
mov eax, dword [ebp - 8]
add eax, 0x2c4
mov edx, dword [ebp - 0x1c]
call fcn.00404d8c
call fcn.00403348
call fcn.004028a4
mov eax, dword [ebp - 8]
add eax, 0x2c4
mov edx, dword [ebp - 0x20]
call fcn.00404d8c
call fcn.00403348
call fcn.004028a4
mov dl, 1
mov eax, dword [0x43f740]
call fcn.0043f840
mov ebx, eax
mov cl, 1
mov edx, 0x45fbc0
mov eax, ebx
call fcn.0043f944
mov cl, 1
mov edx, 0x45fbd4
mov eax, ebx
call fcn.0043f944
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x490]
call fcn.004050a0
add eax, eax
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x490]
call fcn.00405090
mov ecx, eax
mov edx, 0x45fbe4
mov eax, ebx
call fcn.0043fd3c
mov eax, ebx
call fcn.0043f8b0
mov eax, ebx
call fcn.0043f8b0
mov edx, 0x80000002
mov eax, ebx
call fcn.0043f8e0
xor ecx, ecx
mov edx, 0x45fc04
mov eax, ebx
call fcn.0043f944
test al, al
je 0x45fa11
mov edx, 0x45fbd4
mov cl, 1
mov eax, ebx
call fcn.0043f944
test al, al
je 0x45fa11
mov ecx, 0x45fbd4
mov edx, 0x45fc40
mov eax, ebx
call fcn.0043fc98
lea eax, [ebp - 0x294]
mov edx, dword [ebp - 0x24]
call fcn.0040493c
mov ecx, dword [ebp - 0x294]
mov edx, 0x45fc54
mov eax, ebx
call fcn.0043fc98
mov eax, ebx
call fcn.0043f8b0
mov eax, ebx
call fcn.0043f8b0
mov eax, ebx
call fcn.0043f8b0
mov eax, ebx
call fcn.00403888
mov byte [ebp - 9], 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x2a0]
mov edx, 0x45fc68
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x2a0]
mov edx, dword [eax]
call dword [edx + 0x7c]
lea eax, [ebp - 4]
mov ecx, 0x45fc98
mov edx, dword [0x462be0]
call fcn.0040510c
lea eax, [ebp - 0x14]
mov edx, 0x45fc98
call fcn.00404e90
push ebp
lea eax, [ebp - 0x298]
mov edx, dword [ebp - 0x14]
call fcn.0040493c
mov eax, dword [ebp - 0x298]
mov edx, 0x64
call fcn.0045f488
pop ecx
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x490]
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
call fcn.0040510c
push 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x490]
call fcn.00405090
push eax
push 0
mov eax, dword [ebp - 0x14]
call fcn.00405090
push eax
push 0x45fcb0
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [ebp - 0x14]
call fcn.00405090
push eax
call sub.kernel32.dll_DeleteFileW
test eax, eax
je 0x45fac7
mov eax, dword [ebp - 8]
add eax, 0x2c4
call fcn.00402f9c
call fcn.004028a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45fb61
lea eax, [ebp - 0x298]
mov edx, 2
call fcn.004046d8
lea eax, [ebp - 0x290]
mov edx, 3
call fcn.00404e48
lea eax, [ebp - 0x284]
call fcn.004046b4
lea eax, [ebp - 0x280]
call fcn.00404e30
lea eax, [ebp - 0x27c]
call fcn.004046b4
lea eax, [ebp - 0x278]
call fcn.00404e30
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00404e48
lea eax, [ebp - 4]
call fcn.00404e30
ret