Function at 0x487fdc
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4882c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x498e10]
mov edx, 0x4882dc
call fcn.004056a8
jne 0x4882a9
lea eax, [ebp - 4]
call fcn.00487dfc
mov eax, dword [0x498e7c]
mov edx, 0x4882e8
call fcn.004056a8
jne 0x48802a
call fcn.0048756c
mov eax, 0x4882f4
call fcn.00409e94
test al, al
jne 0x488042
mov eax, 0x4882f4
call fcn.00409eb8
mov ecx, 0x48830c
mov edx, 0x488330
mov eax, 0x48833c
call fcn.00487ef4
mov eax, 0x48830c
call fcn.00409e70
test al, al
je 0x488114
mov eax, dword [0x498dd0]
mov eax, dword [eax + 0x384]
mov edx, 0x48830c
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [0x498dd0]
mov eax, dword [eax + 0x384]
mov edx, 0x48834c
call fcn.00480dc4
mov eax, dword [0x498dd0]
mov eax, dword [eax + 0x384]
mov byte [eax + 0x39], 1
mov byte [eax + 0x50], 1
mov byte [eax + 0x3a], 1
mov byte [eax + 0x40], 1
xor edx, edx
push ebp
push 0x4880ca
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.004816b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x488102
mov eax, dword [0x498dd0]
mov eax, dword [eax + 0x384]
call fcn.00404454
jmp 0x48812d
mov eax, 0x488394
call fcn.00442624
mov eax, dword [0x498dd0]
call fcn.0046ae38
jmp 0x4882a9
mov eax, 0x48830c
call fcn.00405710
push eax
call sub.kernel32.dll_DeleteFileA
lea edx, [ebp - 8]
mov eax, dword [0x4932c0]
mov eax, dword [eax]
call fcn.0046f38c
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov ecx, 0x4883c0
mov edx, dword [ebp - 4]
call fcn.00405598
mov edx, dword [ebp - 0xc]
pop eax
call fcn.00487a7c
mov dl, 1
mov eax, dword [0x4237f0]
call fcn.004238f0
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.00423990
xor ecx, ecx
mov edx, 0x4883d4
mov eax, ebx
call fcn.004239f4
test al, al
jne 0x4881cd
mov cl, 1
mov edx, 0x4883d4
mov eax, ebx
call fcn.004239f4
test al, al
je 0x4881cd
mov ecx, 1
mov edx, 0x488408
mov eax, ebx
call fcn.00423dd8
xor ecx, ecx
mov edx, 0x488420
mov eax, ebx
call fcn.00423dd8
mov eax, ebx
call fcn.00423960
mov eax, ebx
call fcn.00404454
lea eax, [ebp - 0x10]
mov ecx, 0x4883c0
mov edx, dword [ebp - 4]
call fcn.00405598
mov eax, dword [ebp - 0x10]
call fcn.00409e70
test al, al
je 0x488237
mov eax, dword [0x498ec0]
mov edx, 0x4882e8
call fcn.004056a8
je 0x48820d
push 0
push 0x488434
call sub.kernel32.dll_WinExec
push 1
push 0x488458
push dword [ebp - 4]
push 0x488480
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405614
mov eax, dword [ebp - 0x14]
call fcn.00405710
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x498dd0]
mov eax, dword [eax + 0x380]
mov dl, 1
call fcn.0043cd6c
cmp dword [0x498e90], 0
je 0x48827d
mov eax, dword [0x498e90]
mov edx, 0x488494
call fcn.004056a8
je 0x48827d
push 1
push 0
push 0
mov eax, dword [0x498e90]
call fcn.00405710
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
push ebp
push 0x48829f
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00443378
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4882a9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4882cb
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004052a4
ret