Function at 0x422ed0
Capabilities:
Create process on windows
Delete file
Get file size
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50b3ee
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1e24
call fcn.00508c20
mov eax, dword [0x72400c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1d2c], edx
mov edx, ecx
mov dword [ebp - 0x1d20], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1d00], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1d24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1d30], eax
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1d28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1d18], eax
mov dword [ebp - 0x1d04], ebx
mov dword [eax], 0
mov eax, 0x92492493
mov ecx, dword [edx + 4]
sub ecx, dword [edx]
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x423617
mov ecx, dword [ebx + 4]
mov eax, 0x2aaaaaab
sub ecx, dword [ebx]
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x423617
push 0x410
lea eax, [ebp - 0x828]
push 0
push eax
call fcn.004e7b30
add esp, 0xc
lea eax, [ebp - 0x828]
push 0x208
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x423617
lea eax, [ebp - 0x828]
push eax
lea ecx, [ebp - 0x840]
call fcn.0040f910
push 1
push ecx
push 0x70fec0
lea ecx, [ebp - 0x840]
mov dword [ebp - 4], 0
call fcn.00417bf0
mov edx, eax
lea ecx, [ebp - 0x840]
cmp edx, 0xffffffff
je 0x423612
mov edi, dword [ebp - 0x82c]
cmp edi, 8
mov esi, dword [ebp - 0x840]
mov eax, dword [ebp - 0x830]
cmovae ecx, esi
lea ecx, [ecx + eax*2]
lea eax, [ebp - 0x840]
cmovae eax, esi
lea eax, [eax + edx*2]
add eax, 2
lea edx, [ebp - 0x840]
cmp edi, 8
cmovae edx, esi
sub ecx, eax
mov esi, eax
sar ecx, 1
sub esi, edx
push ecx
sar esi, 1
lea ecx, [ebp - 0x840]
push esi
call fcn.0040f510
lea ecx, [ebp - 0x1ce8]
call fcn.004c52a0
xor eax, eax
mov dword [ebp - 0x85c], 7
mov dword [ebp - 0x860], 0
mov word [ebp - 0x870], ax
lea eax, [ebp - 0x870]
mov byte [ebp - 4], 1
push eax
push 6
push 3
lea ecx, [ebp - 0x1ce8]
call fcn.004c5190
mov dword [ebp - 0x874], 0xf
mov dword [ebp - 0x878], 0
mov byte [ebp - 0x888], 0
lea eax, [ebp - 0x888]
mov byte [ebp - 4], 2
push eax
sub esp, 8
lea ecx, [ebp - 0x1ce8]
call fcn.004c5220
mov dword [ebp - 0x1cf8], 0
mov dword [ebp - 0x1cf4], 0
mov dword [ebp - 0x1cf0], 0
push 0xbd800
lea ecx, [ebp - 0x1cf8]
mov byte [ebp - 4], 3
call fcn.0041bd90
mov ecx, dword [ebp - 0x1cf8]
mov eax, dword [ebp - 0x1cf4]
sub eax, ecx
push eax
push 0x522e68
push ecx
mov dword [ebp - 0x1cec], eax
call fcn.004e80a0
xor esi, esi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x1d14], esi
mov dword [ebp - 0x1d10], ebx
mov dword [ebp - 0x1d0c], edi
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x8ac]
push dword [ebp - 0x1cec]
mov edx, dword [ebp - 0x1cf8]
call fcn.00423c70
lea ecx, [ebp - 0x1d14]
add esp, 0x10
cmp ecx, eax
je 0x42317c
mov esi, dword [eax]
mov ebx, dword [eax + 4]
mov edi, dword [eax + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [ebp - 0x1d14], esi
mov dword [ebp - 0x1d10], ebx
mov dword [ebp - 0x1d0c], edi
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0x8ac]
test ecx, ecx
je 0x423198
mov eax, dword [ebp - 0x8a4]
sub eax, ecx
sar eax, 2
push eax
push ecx
call fcn.00408ce0
sub ebx, esi
mov dword [ebp - 0x1d08], ebx
cmp ebx, 4
jb 0x4235db
mov eax, dword [ebp - 0x1d08]
xor ebx, ebx
sar eax, 2
mov dword [ebp - 0x1d08], eax
test eax, eax
je 0x42327d
mov ecx, dword [ebp - 0x878]
nop dword [eax + eax]
cmp dword [ebp - 0x860], 0x80
mov eax, dword [esi + ebx*4]
mov dword [ebp - 0x1d1c], eax
ja 0x4235db
cmp ecx, 0x80
ja 0x4235db
push 0x188
push 0
push eax
call fcn.004e7b30
mov eax, dword [ebp - 0x860]
lea ecx, [ebp - 0x870]
add esp, 0xc
cmp dword [ebp - 0x85c], 8
cmovae ecx, dword [ebp - 0x870]
test eax, eax
je 0x423235
add eax, eax
push eax
push ecx
push dword [ebp - 0x1d1c]
call fcn.004e80a0
add esp, 0xc
mov edx, dword [ebp - 0x1d1c]
lea eax, [ebp - 0x888]
mov ecx, dword [ebp - 0x878]
add edx, 0x100
cmp dword [ebp - 0x874], 0x10
cmovae eax, dword [ebp - 0x888]
test ecx, ecx
je 0x423270
push ecx
push eax
push edx
call fcn.004e80a0
mov ecx, dword [ebp - 0x878]
add esp, 0xc
inc ebx
cmp ebx, dword [ebp - 0x1d08]
jb 0x4231d0
xor eax, eax
mov dword [ebp - 0x8d4], 7
mov dword [ebp - 0x8d8], 0
mov word [ebp - 0x8e8], ax
lea eax, [ebp - 0x8e8]
mov byte [ebp - 4], 5
push eax
push 7
push 3
lea ecx, [ebp - 0x1ce8]
call fcn.004c5190
xor eax, eax
mov dword [ebp - 0x8bc], 7
mov dword [ebp - 0x8c0], 0
mov word [ebp - 0x8d0], ax
push 0x70fec0
lea edx, [ebp - 0x840]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x858]
call fcn.0041c210
lea ecx, [ebp - 0x8e8]
mov byte [ebp - 4], 7
push ecx
mov edx, eax
lea ecx, [ebp - 0x8b8]
call fcn.0041c150
add esp, 8
lea ecx, [ebp - 0x8d0]
push eax
call fcn.0040f890
lea ecx, [ebp - 0x8b8]
call fcn.0040f850
lea ecx, [ebp - 0x858]
call fcn.0040f850
push dword [ebp - 0x1d28]
mov dword [ebp - 0x8ac], 0
push dword [ebp - 0x1d30]
mov dword [ebp - 0x8a8], 0
push dword [ebp - 0x1d24]
mov dword [ebp - 0x8a4], 0
lea eax, [ebp - 0x8ac]
mov dword [ebp - 0x84c], 0
push eax
mov dword [ebp - 0x848], 0
mov dword [ebp - 0x844], 0
lea eax, [ebp - 0x84c]
mov byte [ebp - 4], 9
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1d24], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 7
cmp dword [ecx + 0x14], 8
mov dword [ecx + 0x10], 0
jb 0x4233b9
mov eax, dword [ecx]
jmp 0x4233bb
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp - 0x8d0]
push edx
push eax
call fcn.0040f6c0
push dword [ebp + 0x10]
mov byte [ebp - 4], 0xa
push dword [ebp - 0x1d2c]
push dword [ebp - 0x1d20]
push dword [ebp - 0x1d00]
push dword [ebp - 0x1d04]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1d04], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x42341f
mov eax, dword [ecx]
jmp 0x423421
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x888]
push 0
push eax
call fcn.00408060
sub esp, 0x18
mov byte [ebp - 4], 0xb
mov ecx, esp
mov dword [ebp - 0x1d00], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 7
cmp dword [ecx + 0x14], 8
mov dword [ecx + 0x10], 0
jb 0x423469
mov eax, dword [ecx]
jmp 0x42346b
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp - 0x870]
push edx
push eax
call fcn.0040f6c0
sub esp, 0x18
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 7
cmp dword [ecx + 0x14], 8
mov dword [ecx + 0x10], 0
jb 0x4234ae
mov eax, dword [ecx]
jmp 0x4234b0
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp - 0x840]
push edx
push eax
call fcn.0040f6c0
mov byte [ebp - 4], 9
call fcn.0042aa50
cmp al, 1
lea ecx, [ebp - 0x84c]
sete bl
call fcn.004073e0
lea ecx, [ebp - 0x8ac]
mov byte [ebp - 4], 6
call fcn.004073e0
test bl, bl
je 0x4235c5
xor eax, eax
mov dword [ebp - 0x8a4], 7
mov dword [ebp - 0x8a8], 0
mov word [ebp - 0x8b8], ax
lea eax, [ebp - 0x8b8]
mov byte [ebp - 4], 0xd
push eax
push 6
push 3
lea ecx, [ebp - 0x1ce8]
call fcn.004c5190
xor eax, eax
mov dword [ebp - 0x88c], 7
mov dword [ebp - 0x890], 0
mov word [ebp - 0x8a0], ax
lea eax, [ebp - 0x8b8]
mov byte [ebp - 4], 0xe
push eax
lea edx, [ebp - 0x840]
lea ecx, [ebp - 0x858]
call fcn.00428400
add esp, 4
lea ecx, [ebp - 0x8a0]
push eax
call fcn.0040f890
lea ecx, [ebp - 0x858]
call fcn.0040f850
sub esp, 0xc
lea eax, [ebp - 0x8a0]
lea ecx, [ebp - 0x1df0]
push eax
call fcn.00424fc0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1df0]
cmp dword [ebp - 0x1da0], 0
jne 0x423635
call fcn.00422390
lea ecx, [ebp - 0x8a0]
call fcn.0040f850
lea ecx, [ebp - 0x8b8]
call fcn.0040f850
lea ecx, [ebp - 0x8d0]
call fcn.0040f850
lea ecx, [ebp - 0x8e8]
call fcn.0040f850
test esi, esi
je 0x4235eb
sub edi, esi
sar edi, 2
push edi
push esi
call fcn.00408ce0
lea ecx, [ebp - 0x1cf8]
call fcn.0040fff0
lea ecx, [ebp - 0x888]
call fcn.00406f20
lea ecx, [ebp - 0x870]
call fcn.0040f850
lea ecx, [ebp - 0x840]
call fcn.0040f850
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ce564
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp - 0x1cec]
push dword [ebp - 0x1cf8]
call fcn.00425900
lea ecx, [ebp - 0x1df0]
call fcn.00424f80
push 0x710adc
lea ecx, [ebp - 0x960]
call fcn.0040f910
mov esi, eax
push 0x710adc
lea ecx, [ebp - 0x948]
mov byte [ebp - 4], 0x10
call fcn.0040f910
lea ecx, [ebp - 0x8a0]
mov byte [ebp - 4], 0x11
push ecx
mov edx, eax
lea ecx, [ebp - 0x930]
call fcn.0041c150
push esi
mov edx, eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x900]
call fcn.0041c0e0
add esp, 8
lea ecx, [ebp - 0x930]
call fcn.0040f850
lea ecx, [ebp - 0x948]
call fcn.0040f850
lea ecx, [ebp - 0x960]
mov byte [ebp - 4], 0x16
call fcn.0040f850
lea eax, [ebp - 0x1e34]
mov dword [ebp - 0x1e34], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x402
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.004e7b30
mov eax, dword [ebp - 0x8f0]
add esp, 0xc
cmp eax, 0x200
jbe 0x4237d4
cmp dword [ebp - 0x88c], 8
lea eax, [ebp - 0x8a0]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmovae eax, dword [ebp - 0x8a0]
push eax
call esi
push 0x70fec0
lea edx, [ebp - 0x840]
lea ecx, [ebp - 0x918]
call fcn.0041c210
lea ecx, [ebp - 0x870]
mov byte [ebp - 4], 0x17
push ecx
mov edx, eax
lea ecx, [ebp - 0x858]
call fcn.0041c150
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x42375f
mov eax, dword [eax]
push eax
call esi
lea ecx, [ebp - 0x858]
call fcn.0040f850
lea ecx, [ebp - 0x918]
call fcn.0040f850
lea ecx, [ebp - 0x900]
call fcn.0040f850
lea ecx, [ebp - 0x1df0]
call fcn.00422390
lea ecx, [ebp - 0x8a0]
call fcn.0040f850
lea ecx, [ebp - 0x8b8]
call fcn.0040f850
lea ecx, [ebp - 0x8d0]
call fcn.0040f850
lea ecx, [ebp - 0x8e8]
call fcn.0040f850
mov eax, dword [ebp - 0x1d14]
test eax, eax
je 0x4235eb
sub edi, eax
sar edi, 2
push edi
push eax
jmp 0x4235e6
cmp dword [ebp - 0x8ec], 8
lea ecx, [ebp - 0x900]
cmovae ecx, dword [ebp - 0x900]
test eax, eax
je 0x4237ff
add eax, eax
push eax
push ecx
lea eax, [ebp - 0x418]
push eax
call fcn.004e80a0
add esp, 0xc
lea eax, [ebp - 0x1d40]
push eax
lea eax, [ebp - 0x1e34]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x418]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x42389f
cmp dword [ebp - 0x88c], 8
lea ecx, [ebp - 0x8a0]
cmovae ecx, dword [ebp - 0x8a0]
call fcn.004218f0
push 0x70fec0
lea edx, [ebp - 0x840]
lea ecx, [ebp - 0x858]
call fcn.0041c210
lea ecx, [ebp - 0x870]
mov byte [ebp - 4], 0x18
push ecx
mov edx, eax
lea ecx, [ebp - 0x918]
call fcn.0041c150
add esp, 8
mov byte [ebp - 4], 0x19
cmp dword [eax + 0x14], 8
jb 0x423882
mov eax, dword [eax]
mov ecx, eax
call fcn.004218f0
lea ecx, [ebp - 0x918]
call fcn.0040f850
lea ecx, [ebp - 0x858]
jmp 0x423773
push 0x1b77400
push dword [ebp - 0x1d40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x1cfc], 0
test eax, eax
jne 0x4238dd
lea eax, [ebp - 0x1cfc]
push eax
push dword [ebp - 0x1d40]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x4238f2
mov dword [ebp - 0x1cfc], eax
jmp 0x4238f2
cmp eax, 0x102
jne 0x4238f2
push 0
push dword [ebp - 0x1d40]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x1d3c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0x1d40]
call ebx
cmp dword [ebp - 0x8bc], 8
lea eax, [ebp - 0x8d0]
push 0
cmovae eax, dword [ebp - 0x8d0]
push 0x8000080
push 3
push 0
push 0
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
xor ebx, ebx
mov dword [ebp - 0x1d04], esi
mov dword [ebp - 0x1d00], ebx
cmp esi, 0xffffffff
je 0x423a31
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea ecx, [ebx - 4]
cmp ecx, 0x3fb
ja 0x423a28
mov dword [ebp - 0x84c], 0
mov dword [ebp - 0x848], 0
mov dword [ebp - 0x844], 0
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x84c]
push ebx
mov dword [ebp - 0x1cec], 0
call fcn.0041bd90
push 0
lea eax, [ebp - 0x1cec]
push eax
push ebx
push dword [ebp - 0x84c]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x1cec], ebx
jne 0x4239de
mov eax, dword [ebp - 0x84c]
lea ecx, [ebp - 0x84c]
mov ebx, dword [eax]
mov dword [ebp - 4], 0x1a
mov byte [ebp - 4], 0x16
call fcn.0040fff0
jmp 0x423a2a
mov dword [ebp - 4], 0x1a
lea ecx, [ebp - 0x84c]
xor ebx, ebx
mov byte [ebp - 4], 0x16
call fcn.0040fff0
jmp 0x423a2a
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x88c], 8
lea ecx, [ebp - 0x8a0]
cmovae ecx, dword [ebp - 0x8a0]
call fcn.004218f0
push 0x70fec0
lea edx, [ebp - 0x840]
lea ecx, [ebp - 0x858]
call fcn.0041c210
lea ecx, [ebp - 0x870]
mov byte [ebp - 4], 0x1d
push ecx
mov edx, eax
lea ecx, [ebp - 0x918]
call fcn.0041c150
add esp, 8
mov byte [ebp - 4], 0x1e
cmp dword [eax + 0x14], 8
jb 0x423a87
mov eax, dword [eax]
mov ecx, eax
call fcn.004218f0
lea ecx, [ebp - 0x918]
call fcn.0040f850
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], 0x16
call fcn.0040f850
cmp dword [ebp - 0x8bc], 8
lea ecx, [ebp - 0x8d0]
cmovae ecx, dword [ebp - 0x8d0]
call fcn.004218f0
mov eax, dword [ebp - 0x1d18]
lea ecx, [ebp - 0x900]
mov dword [eax], ebx
call fcn.0040f850
lea ecx, [ebp - 0x1df0]
call fcn.00422390
lea ecx, [ebp - 0x8a0]
call fcn.0040f850
lea ecx, [ebp - 0x8b8]
call fcn.0040f850
lea ecx, [ebp - 0x8d0]
call fcn.0040f850
lea ecx, [ebp - 0x8e8]
call fcn.0040f850
mov eax, dword [ebp - 0x1d14]
test eax, eax
je 0x423b21
sub edi, eax
sar edi, 2
push edi
push eax
call fcn.00408ce0
lea ecx, [ebp - 0x1cf8]
call fcn.0040fff0
lea ecx, [ebp - 0x888]
call fcn.00406f20
lea ecx, [ebp - 0x870]
call fcn.0040f850
lea ecx, [ebp - 0x840]
call fcn.0040f850
mov al, 1
jmp 0x423619