Function at 0x41a5d7
Capabilities:
Create process on windows
Resume thread
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2260
call fcn.00466c20
push ebx
push esi
mov dword [ebp - 4], ecx
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x25e]
mov word [ebp - 0x260], bx
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x260]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x41a7c6
lea eax, [ebp - 0x260]
push esi
push eax
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x41a7c6
mov esi, 0x3ff
xor eax, eax
mov ecx, esi
lea edi, [ebp - 0x225e]
mov word [ebp - 0x2260], bx
push 0x104
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 4]
stosw word es:[edi], ax
lea eax, [ebp - 0x2260]
push eax
push str.COMSPEC
call fcn.0041a5c2
test eax, eax
je 0x41a7c6
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x125e]
mov word [ebp - 0x1260], bx
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.__c_del__F__A__Q__
stosw word es:[edi], ax
lea eax, [ebp - 0x1260]
push eax
call esi
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x1260]
push eax
call esi
mov edi, str.____nul__if_exist__
lea eax, [ebp - 0x1260]
push edi
push eax
call esi
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x1260]
push eax
call esi
lea eax, [ebp - 0x1260]
push str.__ping_127.0.0.1__n_2___nul__del__F__A__Q__
push eax
call esi
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x1260]
push eax
call esi
lea eax, [ebp - 0x1260]
push edi
push eax
call esi
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x1260]
push eax
call esi
lea eax, [ebp - 0x1260]
push str.__ping_127.0.0.1__n_3___nul__del__F__A__Q__
push eax
call esi
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x1260]
push eax
call esi
lea eax, [ebp - 0x1260]
push str.____nul
push eax
call esi
lea eax, [ebp - 0x1260]
push eax
lea eax, [ebp - 0x2260]
push eax
call esi
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x100
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
mov word [ebp - 0x28], bx
call edi
mov ecx, dword [ebp - 4]
push eax
call fcn.0041a5b1
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push eax
call esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0xc
push ebx
push ebx
lea eax, [ebp - 0x2260]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x41a7cd
push 0x20
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
mov ecx, dword [ebp - 4]
push 0x40
push dword [ebp - 0x14]
call fcn.0041a5b1
push 0xfffffffffffffff1
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call fcn.00466cbd
call fcn.004d8300
test eax, eax
je 0x41a826
cmp dword [0x6a3388], 0
je 0x41a81b
push str.OEAViewer_check_os_failed__Unsupport_64bit_OS.__r_n
push str.oeaviewer
push 4
push 0x6a2af4
call fcn.004cdcb0
add esp, 0x10
push 0x22
call fcn.004296ed
pop ecx
xor eax, eax
ret
push 1
pop eax
ret