Function at 0x403330
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a8
mov eax, dword [0x419040]
xor eax, ebp
mov dword [ebp - 0x7c], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x3c], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00405860
add esp, 4
push 0
mov eax, dword [ebp + 8]
push eax
push 0
mov ecx, 0x4190a0
call fcn.00403300
mov dword [ebp - 0x3c], eax
push 0
lea ecx, [ebp - 0x38]
call fcn.004038a0
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x38]
call fcn.00403960
push 0x41644c
lea ecx, [ebp - 0x38]
call fcn.00403c00
test eax, eax
je 0x40368f
lea ecx, [ebp - 0x291]
call fcn.0040ce60
lea ecx, [ebp - 0x290]
call fcn.00403d20
lea ecx, [ebp - 0x2a4]
call fcn.0040ba70
lea edx, [ebp - 0x370]
push edx
push 0x416450
lea eax, [ebp - 0x36c]
push eax
lea ecx, [ebp - 0x38]
call fcn.00403ca0
mov ecx, eax
call fcn.00403920
lea ecx, [ebp - 0x370]
push ecx
lea ecx, [ebp - 0x298]
call fcn.00402890
lea ecx, [ebp - 0x370]
call fcn.004028f0
lea ecx, [ebp - 0x36c]
call fcn.004121e0
push 0xc0000000
push 0
lea ecx, [ebp - 0x290]
call fcn.00403d90
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0
jge 0x403470
mov dword [ebp - 0x374], 0xffffffff
lea ecx, [ebp - 0x298]
call fcn.004028f0
lea ecx, [ebp - 0x2a4]
call fcn.004028f0
lea ecx, [ebp - 0x290]
call fcn.00403d60
lea ecx, [ebp - 0x38]
call fcn.00403900
mov eax, dword [ebp - 0x374]
jmp 0x403885
mov dword [ebp - 0x2a8], 0
jmp 0x40348b
mov edx, dword [ebp - 0x2a8]
add edx, 1
mov dword [ebp - 0x2a8], edx
cmp dword [ebp - 0x2a8], 3
jge 0x40353c
mov dword [ebp - 0x2ac], 0
lea eax, [ebp - 0x380]
push eax
push 0x416454
lea ecx, [ebp - 0x37c]
push ecx
lea ecx, [ebp - 0x38]
call fcn.00403ca0
mov ecx, eax
call fcn.00403920
push 0
lea edx, [ebp - 0x2ac]
push edx
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x380]
push ecx
lea ecx, [ebp - 0x378]
call fcn.00402890
mov ecx, eax
call fcn.004098e0
push eax
lea ecx, [ebp - 0x291]
call fcn.00404140
mov dword [ebp - 0x29c], eax
lea ecx, [ebp - 0x378]
call fcn.004028f0
lea ecx, [ebp - 0x380]
call fcn.004028f0
lea ecx, [ebp - 0x37c]
call fcn.004121e0
cmp dword [ebp - 0x29c], 0
je 0x403535
cmp dword [ebp - 0x29c], 0x80004004
jne 0x403537
jmp 0x40353c
jmp 0x40347c
cmp dword [ebp - 0x29c], 0
jge 0x403583
mov dword [ebp - 0x384], 0xfffffffe
lea ecx, [ebp - 0x298]
call fcn.004028f0
lea ecx, [ebp - 0x2a4]
call fcn.004028f0
lea ecx, [ebp - 0x290]
call fcn.00403d60
lea ecx, [ebp - 0x38]
call fcn.00403900
mov eax, dword [ebp - 0x384]
jmp 0x403885
lea ecx, [ebp - 0x290]
call fcn.00405440
push eax
lea ecx, [ebp - 0x2a4]
call fcn.00402910
push 0x416458
lea ecx, [ebp - 0x2a4]
call fcn.00404990
lea ecx, [ebp - 0x2a4]
call fcn.004098e0
push eax
lea ecx, [ebp - 0x290]
call fcn.00403f50
mov dword [ebp - 0x78], 0x3c
push 0x38
push 0
lea edx, [ebp - 0x74]
push edx
call fcn.00413a40
add esp, 0xc
mov dword [ebp - 0x74], 0x40
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0x416464
lea ecx, [ebp - 0x2a4]
call fcn.004098e0
mov dword [ebp - 0x68], eax
lea ecx, [ebp - 0x298]
call fcn.004098e0
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], 1
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
je 0x40363f
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2a4]
call fcn.004098e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x388], 0
lea ecx, [ebp - 0x298]
call fcn.004028f0
lea ecx, [ebp - 0x2a4]
call fcn.004028f0
lea ecx, [ebp - 0x290]
call fcn.00403d60
lea ecx, [ebp - 0x38]
call fcn.00403900
mov eax, dword [ebp - 0x388]
jmp 0x403885
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x2c0]
call fcn.00404ea0
lea ecx, [ebp - 0x368]
call fcn.00409bd0
push 0x416470
lea ecx, [ebp - 0x38]
call fcn.00403c00
test eax, eax
jne 0x403769
lea eax, [ebp - 0x394]
push eax
push 0x41647c
lea ecx, [ebp - 0x390]
push ecx
lea ecx, [ebp - 0x38]
call fcn.00403ca0
mov ecx, eax
call fcn.00403920
lea edx, [ebp - 0x394]
push edx
lea ecx, [ebp - 0x38c]
call fcn.00402890
mov ecx, eax
call fcn.004098e0
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
push eax
lea ecx, [ebp - 0x2c0]
call fcn.00404ea0
lea ecx, [ebp - 0x38c]
call fcn.004028f0
lea ecx, [ebp - 0x394]
call fcn.004028f0
lea ecx, [ebp - 0x390]
call fcn.004121e0
lea ecx, [ebp - 0x2c0]
call fcn.004057a0
test eax, eax
jne 0x403769
mov dword [ebp - 0x398], 0xffffffff
lea ecx, [ebp - 0x368]
call fcn.004048d0
lea ecx, [ebp - 0x38]
call fcn.00403900
mov eax, dword [ebp - 0x398]
jmp 0x403885
lea eax, [ebp - 0x3a4]
push eax
push 0x416484
lea ecx, [ebp - 0x3a0]
push ecx
lea ecx, [ebp - 0x38]
call fcn.00403ca0
mov ecx, eax
call fcn.00403920
push 0x416480
lea edx, [ebp - 0x39c]
push edx
lea ecx, [ebp - 0x38]
call fcn.00403ca0
mov ecx, eax
call fcn.00403940
push eax
lea eax, [ebp - 0x3a4]
push eax
lea ecx, [ebp - 0x368]
call fcn.0040ae60
lea ecx, [ebp - 0x39c]
call fcn.004121e0
lea ecx, [ebp - 0x3a4]
call fcn.004028f0
lea ecx, [ebp - 0x3a0]
call fcn.004121e0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2bc]
call fcn.00405d70
lea ecx, [ebp - 0x2c0]
call fcn.004057a0
test eax, eax
je 0x403825
lea ecx, [ebp - 0x2c0]
call fcn.00404fb0
and eax, 0x20000000
jne 0x403825
lea ecx, [ebp - 0x2bc]
call fcn.0040ce60
push eax
lea ecx, [ebp - 0x2c0]
call fcn.004056b0
lea ecx, [ebp - 0x2bc]
call fcn.0040ce60
push eax
lea ecx, [ebp - 0x368]
call fcn.0040ae90
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x368]
call fcn.0040a3e0
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x368]
call fcn.004048d0
mov ecx, 0x4190a0
call fcn.004059e0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x3a8], ecx
lea ecx, [ebp - 0x38]
call fcn.00403900
mov eax, dword [ebp - 0x3a8]
mov ecx, dword [ebp - 0x7c]
xor ecx, ebp
call fcn.00413a25
mov esp, ebp
pop ebp
ret 0x10