Function at 0x45681b
Capabilities:
Create process on windows
Delete file
Get common file path
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4f4
mov eax, dword [0x501344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x44
pop esi
mov dword [ebp - 0x414], eax
mov eax, dword [ebp + 0xc]
push 0x40
mov dword [ebp - 0x428], eax
xor ebx, ebx
lea eax, [ebp - 0x4ec]
push ebx
push eax
mov dword [ebp - 0x4f0], esi
call fcn.0049cb00
push 0x40
lea eax, [ebp - 0x4a4]
push ebx
push eax
mov dword [ebp - 0x4a8], esi
call fcn.0049cb00
or dword [ebp - 0x438], 0xffffffff
mov dword [ebp - 0x460], ebx
xor eax, eax
lea edi, [ebp - 0x45c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x104
push edi
call fcn.0049afc0
or dword [ebp - 0x41c], 0xffffffff
push edi
mov dword [ebp - 0x434], eax
call fcn.0049afc0
or dword [ebp - 0x430], 0xffffffff
mov esi, 0x208
push esi
mov dword [ebp - 0x418], eax
call fcn.0049afc0
or dword [ebp - 0x424], 0xffffffff
push esi
mov dword [ebp - 0x42c], eax
call fcn.0049afc0
add esp, 0x28
mov dword [ebp - 0x420], eax
call fcn.0044e990
test al, al
je 0x456939
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x456b2f
push dword [ebp - 0x420]
push ebx
push 0x4d9d68
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x456b2f
push ebx
mov esi, 0x80
push esi
push 2
push ebx
push 3
push 0x10000000
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x45698f
push dword [ebp - 0x434]
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x456b2f
push dword [ebp - 0x418]
push ebx
push 0x4d9d70
push dword [ebp - 0x434]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x456b2f
push ebx
push 0x80
push 2
push ebx
push 3
push 0x10000000
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, 0x80
mov dword [ebp - 0x40c], eax
cmp eax, 0xffffffff
je 0x456a2e
call fcn.0044e990
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebx
push 1
push 2
test al, al
je 0x4569f1
lea eax, [ebp - 0x46c]
push eax
mov dword [ebp - 0x47c], 0x100
call edi
push eax
push dword [ebp - 0x40c]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x468], eax
jmp 0x456a2e
lea eax, [ebp - 0x4b4]
push eax
mov dword [ebp - 0x4c4], 0x100
call edi
push eax
push dword [ebp - 0x40c]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x4b0], eax
call fcn.0044e990
test al, al
je 0x456a6e
mov edi, dword [ebp - 0x46c]
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x4a8]
push eax
push ebx
push ebx
push 0x8000020
push 1
push ebx
push ebx
push dword [ebp - 0x414]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x414], eax
jmp 0x456b22
mov eax, dword [ebp - 0x4b4]
mov ebx, dword [ebp - 0x414]
mov ecx, ebx
mov dword [ebp - 0x444], eax
call fcn.0044ebb0
mov esi, eax
inc esi
push esi
call fcn.0049afc0
lea edi, [ebp - 0x440]
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x440], esi
call fcn.0044e8f0
xor ecx, ecx
call fcn.0044ebb0
mov esi, eax
inc esi
push esi
call fcn.0049afc0
pop ecx
pop ecx
lea edi, [ebp - 0x44c]
xor ebx, ebx
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x44c], esi
call fcn.0044e8f0
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x4f0]
push eax
push dword [ebp - 0x448]
xor eax, eax
push eax
push 0x8000020
push 1
push eax
push eax
push dword [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, edi
mov dword [ebp - 0x414], eax
call fcn.0044eb50
lea esi, [ebp - 0x440]
call fcn.0044eb50
mov edi, dword [ebp - 0x444]
mov esi, 0x80
cmp dword [ebp - 0x414], ebx
jne 0x456b6f
call fcn.0044e990
lea esi, [ebp - 0x424]
call fcn.0044eb50
lea esi, [ebp - 0x430]
call fcn.0044eb50
lea esi, [ebp - 0x41c]
call fcn.0044eb50
lea esi, [ebp - 0x438]
call fcn.0044eb50
mov eax, 0x643
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049c07b
leave
ret
push 0xffffffffffffffff
push dword [ebp - 0x460]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x40c]
call edi
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0x460]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 0x414], eax
call fcn.0044e990
push ebx
push esi
push 3
push ebx
push 3
push SysReAllocStringLen
test al, al
je 0x456bca
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x456bd6
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor edi, edi
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x428], ebx
je 0x456c6a
call fcn.0044e990
test al, al
je 0x456c0f
push ebx
push esi
push 4
push ebx
push 3
push 0x10000004
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
jmp 0x456c6a
mov ecx, dword [ebp - 0x428]
call fcn.0044ebb0
mov edi, eax
inc edi
push edi
call fcn.0049afc0
mov ebx, dword [ebp - 0x428]
mov dword [ebp - 0x440], edi
pop ecx
lea edi, [ebp - 0x440]
mov dword [ebp - 0x43c], eax
call fcn.0044e8f0
push 0
push esi
push 4
push 0
push 3
push 0x10000004
push dword [ebp - 0x43c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea esi, [ebp - 0x440]
mov edi, eax
call fcn.0044eb50
xor ebx, ebx
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x410], ebx
jmp 0x456cdb
mov eax, dword [ebp - 0x410]
mov byte [ebp + eax - 0x408], bl
cmp edi, ebx
je 0x456cdb
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push dword [ebp - 0x410]
mov dword [ebp - 0x444], eax
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockFile]
push ebx
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 0x410]
lea eax, [ebp - 0x408]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
push dword [ebp - 0x410]
push ebx
push dword [ebp - 0x444]
push edi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push ebx
lea eax, [ebp - 0x410]
push eax
push 0x3ff
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x40c]
call esi
cmp dword [ebp - 0x410], ebx
jne 0x456c78
cmp edi, ebx
je 0x456d0e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0044e990
test al, al
je 0x456d31
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x456d3d
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x414], ebx
je 0x456b2f
cmp dword [ebp - 0x450], ebx
jne 0x456b2f
lea esi, [ebp - 0x424]
call fcn.0044eb50
lea esi, [ebp - 0x430]
call fcn.0044eb50
lea esi, [ebp - 0x41c]
call fcn.0044eb50
lea esi, [ebp - 0x438]
call fcn.0044eb50
xor eax, eax
jmp 0x456b60