Function at 0x414e52
Capabilities:
Check if file exists
Create process on windows
Self delete

Disassembly:
push 0x15c
mov eax, 0x46bb2b
call fcn.00444285
xor ebx, ebx
lea eax, [ebp - 0x101]
push ebx
mov dword [ebp - 0x108], ebx
lea ecx, [ebp - 0x40]
mov edi, 0x48e948
mov dword [ebp - 0x18], 0x48e950
push eax
mov dword [ebp - 0x40], edi
call fcn.00406120
mov dword [ebp - 4], 2
mov esi, 0x400
lea eax, [ebp - 0x40]
mov byte [ebp - 0x110], bl
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x10c], ebx
cmp dword [ebp - 0x2c], esi
jae 0x414eb8
push ebx
push esi
lea ecx, [ebp - 0x3c]
call fcn.00408050
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x108], 1
mov byte [ebp - 0x110], 1
call fcn.004079b0
push esi
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ecx, ecx
mov esi, eax
inc ecx
mov dword [ebp - 0x108], ecx
and ecx, 0xfffffffe
mov dword [ebp - 0x108], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114]
call fcn.00406010
test esi, esi
je 0x4150bb
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4150bb
push ebx
push ebx
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x40]
call fcn.00406350
mov byte [ebp - 4], 5
lea eax, [ebp - 0x101]
push ebx
push eax
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x78], 0x48e950
call fcn.00406120
mov byte [ebp - 4], 7
lea eax, [ebp - 0x168]
push 0x44
pop esi
push esi
push ebx
push eax
call fcn.004523f0
xor eax, eax
lea edi, [ebp - 0x124]
stosd dword es:[edi], eax
push esi
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x168]
push eax
call fcn.004523f0
xor eax, eax
mov dword [ebp - 0x168], esi
mov word [ebp - 0x138], ax
lea eax, [ebp - 0x70]
push ebx
push eax
mov dword [ebp - 0x13c], 1
call fcn.004149b9
add esp, 0x20
mov byte [ebp - 4], 8
lea eax, [ebp - 0x101]
push ebx
push eax
push str.cmd.exe
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xd0], 0x48e948
mov dword [ebp - 0xa8], 0x48e950
call fcn.004105ca
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x70]
call fcn.00415203
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xd0]
call fcn.00404d40
cmp byte [ebp + 8], 0
lea eax, [ebp - 0x6c]
je 0x415020
cmp dword [ebp - 0xe8], 8
lea ecx, [ebp - 0xfc]
mov edx, str.__s___c_rmdir__s__q___s_
cmovae ecx, dword [ebp - 0xfc]
jmp 0x415030
cmp dword [ebp - 0x28], 8
lea ecx, [ebp - 0x3c]
mov edx, str.__s___c_del___s_
cmovae ecx, dword [ebp - 0x3c]
cmp dword [ebp - 0x58], 8
push ecx
cmovae eax, dword [ebp - 0x6c]
push eax
push edx
lea eax, [ebp - 0xa0]
push eax
call fcn.00406190
add esp, 0x10
lea ecx, [ebp - 0xa0]
call fcn.004079b0
lea ecx, [ebp - 0x124]
push ecx
lea ecx, [ebp - 0x168]
push ecx
push ebx
push ebx
push 0x40
push ebx
push ebx
push ebx
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x415091
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x70]
call fcn.00404d40
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xa0]
call fcn.00404d40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x100]
call fcn.00404d40
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00404d40
mov al, bl
call fcn.00444234
ret