Function at 0x4a9340
Capabilities:
Create process on windows
Delete file
Get common file path
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xbcc]
mov ecx, 0x2f3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x5ddc34]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], 0
push 0
call fcn.004b8390
add esp, 4
push edx
push eax
push 0x5d874b
push str._s_t_d
lea eax, [ebp - 0x42c]
push eax
call fcn.004016fe
add esp, 0x14
lea eax, [ebp - 0x24]
push eax
push 0x591458
lea ecx, [ebp - 0x42c]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.0040197e
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4a93ce
mov ecx, dword [ebp - 0xc]
call fcn.00401523
jmp 0x4a96b0
mov esi, esp
lea eax, [ebp - 0x63c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp esi, esp
call fcn.004f4cf0
push 0
call fcn.004b8390
add esp, 4
push edx
push eax
lea eax, [ebp - 0x63c]
push eax
push str._supdate__d.txt
lea ecx, [ebp - 0x84c]
push ecx
call fcn.00401bd6
add esp, 0x14
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x84c]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.0040180c
mov byte [ebp - 0x855], al
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xbc8], eax
mov ecx, dword [ebp - 0xbc8]
push ecx
call fcn.004f9cb0
add esp, 4
movzx eax, byte [ebp - 0x855]
test eax, eax
jne 0x4a949e
mov esi, esp
push 0x40
push 0x590d58
push 0x59148c
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.004f4cf0
mov esi, esp
push 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x4c8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x4c8]
mov edx, dword [eax + 0xd8]
call edx
cmp esi, esp
call fcn.004f4cf0
jmp 0x4a96b0
lea eax, [ebp - 0x84c]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.004017ee
mov esi, esp
lea eax, [ebp - 0x84c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, esp
call fcn.004f4cf0
mov esi, esp
push 4
push 0
lea eax, [ebp - 0x84c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp esi, esp
call fcn.004f4cf0
mov ecx, dword [ebp - 0xc]
call fcn.004010e6
mov dword [ebp - 0x864], eax
cmp dword [ebp - 0x864], 0
jne 0x4a9501
mov ecx, dword [ebp - 0xc]
call fcn.00401523
jmp 0x4a96b0
mov ecx, dword [ebp - 0xc]
call fcn.00401195
movzx eax, al
test eax, eax
je 0x4a9667
mov esi, esp
push 0
push str.Lineage
call dword [sym.imp.USER32.dll_FindWindowA]
cmp esi, esp
call fcn.004f4cf0
mov dword [ebp - 0x870], eax
mov esi, esp
mov eax, dword [ebp - 0x870]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
cmp esi, esp
call fcn.004f4cf0
test eax, eax
jne 0x4a954c
jmp 0x4a95c3
mov esi, esp
lea eax, [ebp - 0x87c]
push eax
mov ecx, dword [ebp - 0x870]
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp esi, esp
call fcn.004f4cf0
mov esi, esp
mov eax, dword [ebp - 0x87c]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp esi, esp
call fcn.004f4cf0
mov dword [ebp - 0x888], eax
cmp dword [ebp - 0x888], 0xffffffff
jne 0x4a959b
cmp dword [ebp - 0x888], 0
je 0x4a95b6
mov esi, esp
push 0xdc
mov eax, dword [ebp - 0x888]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp esi, esp
call fcn.004f4cf0
mov eax, 1
test eax, eax
jne 0x4a9514
push 0x44
push 0
lea eax, [ebp - 0x8d4]
push eax
call fcn.004f6010
add esp, 0xc
mov dword [ebp - 0x8d4], 0x44
mov esi, esp
lea eax, [ebp - 0xafc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp esi, esp
call fcn.004f4cf0
push str.eat.exe
lea eax, [ebp - 0xafc]
push eax
call fcn.004018e3
add esp, 8
mov esi, esp
lea eax, [ebp - 0x8ec]
push eax
lea ecx, [ebp - 0x8d4]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0xafc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp esi, esp
call fcn.004f4cf0
test eax, eax
je 0x4a965d
mov esi, esp
push 0xffffffffffffffff
mov eax, dword [ebp - 0x8ec]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, esp
call fcn.004f4cf0
mov ecx, dword [ebp - 0xc]
call fcn.00401523
jmp 0x4a96b0
mov esi, esp
push 0x40
push 0x590d58
push 0x5914cc
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.004f4cf0
mov esi, esp
push 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x4c8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x4c8]
mov edx, dword [eax + 0xd8]
call edx
cmp esi, esp
call fcn.004f4cf0
push edx
mov ecx, ebp
push eax
lea edx, [0x4a96e0]
call fcn.004f4c90
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f4d70
add esp, 0xbcc
cmp ebp, esp
call fcn.004f4cf0
mov esp, ebp
pop ebp
ret