Function at 0x4918b8
Capabilities:
Create process on windows
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x30
push 0
push 0
dec ecx
jne 0x4918c0
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x49251a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x492534
mov eax, 0x49254c
call fcn.00491754
xor eax, eax
push ebp
push 0x4924a4
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
push 0
lea eax, [ebp - 4]
call fcn.00492c8c
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, dword [0x4ab72c]
call fcn.004061f0
mov edx, dword [ebp - 8]
pop eax
call fcn.00404468
mov eax, dword [ebp - 4]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0xc]
call fcn.00492c8c
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [0x4ab5f4]
call fcn.004061f0
mov edx, dword [ebp - 0x10]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0xc]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x14]
call fcn.00492c8c
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x4ab42c]
call fcn.004061f0
mov edx, dword [ebp - 0x18]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0x14]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x1c]
call fcn.00492c8c
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [0x4ab404]
call fcn.004061f0
mov edx, dword [ebp - 0x20]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0x1c]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x24]
call fcn.00492c8c
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [0x4ab7e4]
call fcn.004061f0
mov edx, dword [ebp - 0x28]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0x24]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x30]
call fcn.00491200
push dword [ebp - 0x30]
push 0x492564
lea edx, [ebp - 0x34]
mov eax, dword [0x4ab780]
call fcn.004061f0
push dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00404520
mov eax, dword [ebp - 0x2c]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x3c]
call fcn.00491200
push dword [ebp - 0x3c]
push 0x492564
lea edx, [ebp - 0x40]
mov eax, dword [0x4ab75c]
call fcn.004061f0
push dword [ebp - 0x40]
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.00404520
mov eax, dword [ebp - 0x38]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x48]
call fcn.00491200
push dword [ebp - 0x48]
push 0x492564
lea edx, [ebp - 0x4c]
mov eax, dword [0x4ab3a0]
call fcn.004061f0
push dword [ebp - 0x4c]
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.00404520
mov eax, dword [ebp - 0x44]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x50]
call fcn.00491200
lea eax, [ebp - 0x50]
mov edx, 0x492578
call fcn.00404468
mov eax, dword [ebp - 0x50]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x54]
call fcn.00491200
lea eax, [ebp - 0x54]
mov edx, 0x492594
call fcn.00404468
mov eax, dword [ebp - 0x54]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x58]
call fcn.00491200
lea eax, [ebp - 0x58]
mov edx, 0x4925b0
call fcn.00404468
mov eax, dword [ebp - 0x58]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x5c]
call fcn.00491200
lea eax, [ebp - 0x5c]
mov edx, 0x4925cc
call fcn.00404468
mov eax, dword [ebp - 0x5c]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x60]
call fcn.00491200
lea eax, [ebp - 0x60]
mov edx, 0x4925ec
call fcn.00404468
mov eax, dword [ebp - 0x60]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x64]
call fcn.00491200
lea eax, [ebp - 0x64]
mov edx, 0x49260c
call fcn.00404468
mov eax, dword [ebp - 0x64]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x68]
call fcn.00492c8c
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x6c]
mov eax, dword [0x4ab7d0]
call fcn.004061f0
mov edx, dword [ebp - 0x6c]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0x68]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x70]
call fcn.00492c8c
lea eax, [ebp - 0x70]
push eax
lea edx, [ebp - 0x74]
mov eax, dword [0x4ab8e4]
call fcn.004061f0
mov edx, dword [ebp - 0x74]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0x70]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x78]
call fcn.00492c8c
lea eax, [ebp - 0x78]
push eax
lea edx, [ebp - 0x7c]
mov eax, dword [0x4ab83c]
call fcn.004061f0
mov edx, dword [ebp - 0x7c]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0x78]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x80]
call fcn.00492c8c
lea eax, [ebp - 0x80]
push eax
lea edx, [ebp - 0x84]
mov eax, dword [0x4ab788]
call fcn.004061f0
mov edx, dword [ebp - 0x84]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0x80]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x88]
call fcn.00492c8c
lea eax, [ebp - 0x88]
push eax
lea edx, [ebp - 0x8c]
mov eax, dword [0x4ab498]
call fcn.004061f0
mov edx, dword [ebp - 0x8c]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0x88]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x90]
call fcn.00492c8c
lea eax, [ebp - 0x90]
push eax
lea edx, [ebp - 0x94]
mov eax, dword [0x4ab570]
call fcn.004061f0
mov edx, dword [ebp - 0x94]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0x90]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x98]
call fcn.00492c8c
lea eax, [ebp - 0x98]
push eax
lea edx, [ebp - 0x9c]
mov eax, dword [0x4ab478]
call fcn.004061f0
mov edx, dword [ebp - 0x9c]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0x98]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0xa0]
call fcn.00492c8c
lea eax, [ebp - 0xa0]
push eax
lea edx, [ebp - 0xa4]
mov eax, dword [0x4ab414]
call fcn.004061f0
mov edx, dword [ebp - 0xa4]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0xa0]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0xa8]
call fcn.00492c8c
lea eax, [ebp - 0xa8]
push eax
lea edx, [ebp - 0xac]
mov eax, dword [0x4ab924]
call fcn.004061f0
mov edx, dword [ebp - 0xac]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0xa8]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0xb0]
call fcn.00492c8c
lea eax, [ebp - 0xb0]
push eax
lea edx, [ebp - 0xb4]
mov eax, dword [0x4ab8a0]
call fcn.004061f0
mov edx, dword [ebp - 0xb4]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0xb0]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0xb8]
call fcn.00492c8c
lea eax, [ebp - 0xb8]
push eax
lea edx, [ebp - 0xbc]
mov eax, dword [0x4ab6fc]
call fcn.004061f0
mov edx, dword [ebp - 0xbc]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0xb8]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0xc0]
call fcn.00492c8c
lea eax, [ebp - 0xc0]
push eax
lea edx, [ebp - 0xc4]
mov eax, dword [0x4ab7d4]
call fcn.004061f0
mov edx, dword [ebp - 0xc4]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0xc0]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0xc8]
call fcn.00492c8c
lea eax, [ebp - 0xc8]
push eax
lea edx, [ebp - 0xcc]
mov eax, dword [0x4ab81c]
call fcn.004061f0
mov edx, dword [ebp - 0xcc]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0xc8]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0xd0]
call fcn.00492c8c
lea eax, [ebp - 0xd0]
push eax
lea edx, [ebp - 0xd4]
mov eax, dword [0x4ab7ec]
call fcn.004061f0
mov edx, dword [ebp - 0xd4]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0xd0]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0xd8]
call fcn.00492c8c
lea eax, [ebp - 0xd8]
push eax
lea edx, [ebp - 0xdc]
mov eax, dword [0x4ab5c8]
call fcn.004061f0
mov edx, dword [ebp - 0xdc]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0xd8]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0xe0]
call fcn.00492c8c
lea eax, [ebp - 0xe0]
push eax
lea edx, [ebp - 0xe4]
mov eax, dword [0x4ab944]
call fcn.004061f0
mov edx, dword [ebp - 0xe4]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0xe0]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0xe8]
call fcn.00492c8c
lea eax, [ebp - 0xe8]
push eax
lea edx, [ebp - 0xec]
mov eax, dword [0x4ab6d4]
call fcn.004061f0
mov edx, dword [ebp - 0xec]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0xe8]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0xf0]
call fcn.00492c8c
lea eax, [ebp - 0xf0]
push eax
lea edx, [ebp - 0xf4]
mov eax, dword [0x4ab66c]
call fcn.004061f0
mov edx, dword [ebp - 0xf4]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0xf0]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0xf8]
call fcn.00492c8c
lea eax, [ebp - 0xf8]
push eax
lea edx, [ebp - 0xfc]
mov eax, dword [0x4ab62c]
call fcn.004061f0
mov edx, dword [ebp - 0xfc]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0xf8]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x100]
call fcn.00492c8c
lea eax, [ebp - 0x100]
push eax
lea edx, [ebp - 0x104]
mov eax, dword [0x4ab3e4]
call fcn.004061f0
mov edx, dword [ebp - 0x104]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0x100]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x108]
call fcn.00492c8c
lea eax, [ebp - 0x108]
push eax
lea edx, [ebp - 0x10c]
mov eax, dword [0x4ab47c]
call fcn.004061f0
mov edx, dword [ebp - 0x10c]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0x108]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x110]
call fcn.00492c8c
lea eax, [ebp - 0x110]
mov edx, 0x49262c
call fcn.00404468
mov eax, dword [ebp - 0x110]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x114]
call fcn.00492c8c
lea eax, [ebp - 0x114]
push eax
lea edx, [ebp - 0x118]
mov eax, dword [0x4ab7e4]
call fcn.004061f0
mov edx, dword [ebp - 0x118]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0x114]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x11c]
call fcn.00492c8c
lea eax, [ebp - 0x11c]
push eax
lea edx, [ebp - 0x120]
mov eax, dword [0x4ab36c]
call fcn.004061f0
mov edx, dword [ebp - 0x120]
pop eax
call fcn.00404468
mov eax, dword [ebp - 0x11c]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x124]
call fcn.00492c8c
lea eax, [ebp - 0x124]
mov edx, 0x492644
call fcn.00404468
mov eax, dword [ebp - 0x124]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x128]
call fcn.00492c8c
lea eax, [ebp - 0x128]
mov edx, 0x492658
call fcn.00404468
mov eax, dword [ebp - 0x128]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x12c]
call fcn.00492c8c
lea eax, [ebp - 0x12c]
mov edx, 0x492670
call fcn.00404468
mov eax, dword [ebp - 0x12c]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x130]
call fcn.00492c8c
lea eax, [ebp - 0x130]
mov edx, 0x492684
call fcn.00404468
mov eax, dword [ebp - 0x130]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
call fcn.00492c38
test al, al
je 0x4923f8
xor eax, eax
call fcn.00491834
push 4
push 0
lea eax, [ebp - 0x138]
call fcn.00492c8c
push dword [ebp - 0x138]
lea edx, [ebp - 0x13c]
mov eax, dword [0x4ab44c]
call fcn.004061f0
push dword [ebp - 0x13c]
push 0x49269c
lea eax, [ebp - 0x134]
mov edx, 3
call fcn.00404520
mov eax, dword [ebp - 0x134]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x144]
call fcn.00491200
push dword [ebp - 0x144]
push 0x492564
push 0x4926b4
lea eax, [ebp - 0x140]
mov edx, 3
call fcn.00404520
mov eax, dword [ebp - 0x140]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x14c]
call fcn.00492c8c
push dword [ebp - 0x14c]
lea edx, [ebp - 0x150]
mov eax, dword [0x4ab44c]
call fcn.004061f0
push dword [ebp - 0x150]
push 0x4926cc
lea eax, [ebp - 0x148]
mov edx, 3
call fcn.00404520
mov eax, dword [ebp - 0x148]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x158]
call fcn.00492c8c
push dword [ebp - 0x158]
lea edx, [ebp - 0x15c]
mov eax, dword [0x4ab44c]
call fcn.004061f0
push dword [ebp - 0x15c]
push 0x4926e4
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.00404520
mov eax, dword [ebp - 0x154]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x164]
call fcn.00490d6c
push dword [ebp - 0x164]
push 0x4926fc
lea edx, [ebp - 0x168]
mov eax, dword [0x4ab7d4]
call fcn.004061f0
push dword [ebp - 0x168]
lea eax, [ebp - 0x160]
mov edx, 3
call fcn.00404520
mov eax, dword [ebp - 0x160]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x170]
call fcn.00492c8c
push dword [ebp - 0x170]
lea edx, [ebp - 0x174]
mov eax, dword [0x4ab44c]
call fcn.004061f0
push dword [ebp - 0x174]
push 0x4926cc
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00404520
mov eax, dword [ebp - 0x16c]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
push 4
push 0
lea eax, [ebp - 0x17c]
call fcn.00492c8c
push dword [ebp - 0x17c]
lea edx, [ebp - 0x180]
mov eax, dword [0x4ab44c]
call fcn.004061f0
push dword [ebp - 0x180]
push 0x4926e4
lea eax, [ebp - 0x178]
mov edx, 3
call fcn.00404520
mov eax, dword [ebp - 0x178]
call fcn.00404660
push eax
call sub.kernel32.dll_MoveFileExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4924bd
mov edx, 0x492720
mov eax, 0x49254c
call fcn.00491754
push 1
lea eax, [ebp - 0x184]
call fcn.00492c8c
lea eax, [ebp - 0x184]
mov edx, 0x492734
call fcn.00404468
mov eax, dword [ebp - 0x184]
call fcn.00404660
push eax
call sub.kernel32.dll_WinExec
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492521
lea eax, [ebp - 0x184]
mov edx, 0x61
call fcn.004041c4
ret