Function at 0x4090d4
Capabilities:
Create process on windows
Schedule task via at

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4090dc
push ebx
push esi
push edi
mov eax, 0x406854
call fcn.00405e10
mov edi, 0x40dbac
xor eax, eax
push ebp
push 0x40942b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x406790
call fcn.0040458c
mov eax, 0x40de88
mov edx, dword [0x406768]
call fcn.00405990
mov eax, 0x40dba4
mov edx, dword [0x40a828]
call fcn.00404b7c
mov eax, 0x40dba8
call fcn.004048f8
xor eax, eax
push ebp
push 0x40921d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, 0x409448
mov eax, edi
call fcn.004032a4
call fcn.00402d8c
mov eax, edi
call fcn.00402f64
call fcn.00402dbc
test eax, eax
jne 0x409213
jmp 0x4091d2
mov edx, 0x40de8c
mov eax, edi
call fcn.00403d78
mov eax, edi
call fcn.00403e84
call fcn.00402d8c
mov ebx, dword [0x40de88]
test ebx, ebx
je 0x409195
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
push ebx
mov eax, 0x40de88
mov ecx, 1
mov edx, dword [0x406768]
call fcn.0040586c
add esp, 4
mov esi, dword [0x40de88]
test esi, esi
je 0x4091be
sub esi, 4
mov esi, dword [esi]
mov eax, dword [0x40de88]
lea eax, [eax + esi*4 - 4]
mov edx, dword [0x40de8c]
call fcn.00404b7c
mov eax, edi
call fcn.004033a4
call fcn.00402d8c
test al, al
je 0x40916e
mov eax, edi
call fcn.0040334c
call fcn.00402d8c
mov eax, 0x40dba4
mov edx, dword [0x40de88]
mov edx, dword [edx]
call fcn.00404b7c
mov eax, 0x40dba8
mov edx, dword [0x40de88]
mov edx, dword [edx + 4]
call fcn.00404b7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x409227
mov eax, 0x40de8c
call fcn.004048f8
mov eax, dword [0x40dba4]
test eax, eax
je 0x40923f
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x40927d
mov ebx, 1
mov eax, dword [0x40dba4]
movzx edi, word [eax + ebx*2 - 2]
mov eax, edi
cmp ax, 0x1f
jbe 0x409279
cmp ax, 0x80
jae 0x409279
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00404f0c
mov edx, dword [ebp - 0x14]
mov eax, 0x40de8c
call fcn.00404fd0
inc ebx
dec esi
jne 0x40924a
mov eax, 0x40dba4
mov edx, dword [0x40de8c]
call fcn.00404b7c
mov eax, 0x40de8c
call fcn.004048f8
mov eax, dword [0x40dba8]
test eax, eax
je 0x4092a5
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x4092e3
mov ebx, 1
mov eax, dword [0x40dba8]
movzx edi, word [eax + ebx*2 - 2]
mov eax, edi
cmp ax, 0x1f
jbe 0x4092df
cmp ax, 0x80
jae 0x4092df
lea eax, [ebp - 0x18]
mov edx, edi
call fcn.00404f0c
mov edx, dword [ebp - 0x18]
mov eax, 0x40de8c
call fcn.00404fd0
inc ebx
dec esi
jne 0x4092b0
mov eax, 0x40dba8
mov edx, dword [0x40de8c]
call fcn.00404b7c
mov eax, 0x40de8c
call fcn.004048f8
mov eax, dword [0x40dba4]
test eax, eax
je 0x40930b
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x409352
mov ebx, 1
mov eax, dword [0x40dba4]
movzx edi, word [eax + ebx*2 - 2]
cmp di, 0x20
jne 0x409337
mov eax, 0x40de8c
mov edx, 0x409470
call fcn.00404fd0
jmp 0x40934e
lea eax, [ebp - 0x1c]
mov edx, edi
call fcn.00404f0c
mov edx, dword [ebp - 0x1c]
mov eax, 0x40de8c
call fcn.00404fd0
inc ebx
dec esi
jne 0x409316
mov eax, 0x40dba4
mov edx, dword [0x40de8c]
call fcn.00404b7c
mov eax, dword [0x40dba4]
mov edx, dword [0x40a828]
call fcn.004050d8
je 0x409408
cmp dword [0x40dba8], 0
je 0x409408
push dword [0x40a82c]
push dword [0x40a834]
push dword [0x40a83c]
push dword [0x40a844]
push dword [0x40a84c]
push dword [0x40a854]
push 0x40947c
lea eax, [ebp - 0x28]
mov edx, 7
call fcn.00404eac
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.00404f3c
push dword [ebp - 0x24]
push dword [0x40dba8]
push 0x40949c
push dword [0x40dba4]
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00405028
mov eax, dword [ebp - 0x20]
call fcn.00404ef4
push 9
push 0x4094bc
push 0x4094bc
push eax
push 0x4094c0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409432
lea eax, [ebp - 0x28]
call fcn.00404940
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00404958
ret