Function at 0x4a8770
Capabilities:
Create process on windows
Delete file
Get common file path
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2820
call fcn.005010b0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x2820]
mov ecx, 0xa08
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x5ddc34]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], 0
push 0
call fcn.004b8390
add esp, 4
push edx
push eax
push 0x5d854a
push str._s_t_d
lea eax, [ebp - 0x42c]
push eax
call fcn.004016fe
add esp, 0x14
lea eax, [ebp - 0x24]
push eax
push 0x591188
lea ecx, [ebp - 0x42c]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.0040197e
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4a8863
mov esi, esp
push 0x40
push 0x590d58
push 0x591198
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.004f4cf0
mov esi, esp
lea eax, [ebp - 0x63c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp esi, esp
call fcn.004f4cf0
lea eax, [ebp - 0x63c]
push eax
push str._slist_000.txt
lea ecx, [ebp - 0x84c]
push ecx
call fcn.00401bd6
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x84c]
push ecx
call fcn.0040194c
add esp, 8
mov dword [ebp - 0x18], eax
mov esi, esp
push 0x800
lea eax, [ebp - 0x1854]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp esi, esp
call fcn.004f4cf0
push str.Login.exe
lea eax, [ebp - 0x1854]
push eax
call fcn.00401cad
add esp, 8
test eax, eax
jne 0x4a88cd
mov esi, esp
push 0x40
push 0x590d58
push str.veQhV
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.004f4cf0
push 0
push 0
push 0x12
mov ecx, dword [ebp - 0xc]
call fcn.00410c30
jmp 0x4a8e07
cmp dword [ebp - 0x18], 0
jne 0x4a893f
push 0x64
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x504]
call fcn.004195a0
mov esi, esp
push 0x591208
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x504]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x504]
mov edx, dword [eax + 0x2c]
call edx
cmp esi, esp
call fcn.004f4cf0
mov esi, esp
push 0x40
push 0x590d58
push 0x591224
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.004f4cf0
push 0
push 0
push 0x12
mov ecx, dword [ebp - 0xc]
call fcn.00410c30
jmp 0x4a8e07
mov esi, esp
lea eax, [ebp - 0x1a64]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp esi, esp
call fcn.004f4cf0
push 0
call fcn.004b8390
add esp, 4
push edx
push eax
lea eax, [ebp - 0x1a64]
push eax
push str._slist__d.txt
lea ecx, [ebp - 0x1c74]
push ecx
call fcn.00401bd6
add esp, 0x14
lea eax, [ebp - 0x1a64]
push eax
push str._slist_000.txt
lea ecx, [ebp - 0x1e84]
push ecx
call fcn.00401bd6
add esp, 0xc
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1e84]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.0040180c
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c74]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.0040180c
mov byte [ebp - 0x1e8d], al
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x281c], eax
mov ecx, dword [ebp - 0x281c]
push ecx
call fcn.004f9cb0
add esp, 4
movzx eax, byte [ebp - 0x1e8d]
test eax, eax
jne 0x4a8a28
mov esi, esp
push 0x40
push 0x590d58
push 0x591274
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.004f4cf0
push 0
push 0
push 0x12
mov ecx, dword [ebp - 0xc]
call fcn.00410c30
jmp 0x4a8e07
lea eax, [ebp - 0x1c74]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00401857
mov esi, esp
lea eax, [ebp - 0x1c74]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, esp
call fcn.004f4cf0
mov esi, esp
push 4
push 0
lea eax, [ebp - 0x1c74]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp esi, esp
call fcn.004f4cf0
push 0x5d812a
call fcn.004f7f90
add esp, 4
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ecx + 0x514]
jge 0x4a8cc0
mov dword [ebp - 0x24], 0
push 0
call fcn.004b8390
add esp, 4
push edx
push eax
mov eax, dword [ebp - 0xc]
add eax, 0x518
push eax
push str._s_t_d
lea ecx, [ebp - 0x42c]
push ecx
call fcn.004016fe
add esp, 0x14
lea eax, [ebp - 0x24]
push eax
push 0x591294
lea ecx, [ebp - 0x42c]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.0040197e
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4a8b40
push 0x64
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x504]
call fcn.004195a0
mov esi, esp
push 0x5912a4
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x504]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x504]
mov edx, dword [eax + 0x2c]
call edx
cmp esi, esp
call fcn.004f4cf0
mov esi, esp
push 0x40
push 0x590d58
push 0x5912c0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.004f4cf0
push 0
push 0
push 0x12
mov ecx, dword [ebp - 0xc]
call fcn.00410c30
jmp 0x4a8e07
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
push str.._Launcher.new
mov ecx, dword [ebp - 0xc]
call fcn.0040180c
mov byte [ebp - 0x1e99], al
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2810], eax
mov ecx, dword [ebp - 0x2810]
push ecx
call fcn.004f9cb0
add esp, 4
movzx eax, byte [ebp - 0x1e99]
test eax, eax
jne 0x4a8bb3
mov esi, esp
push 0x40
push 0x590d58
push 0x5912e8
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.004f4cf0
push 0
push 0
push 0x12
mov ecx, dword [ebp - 0xc]
call fcn.00410c30
jmp 0x4a8e07
mov esi, esp
push 0x591304
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x504]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x504]
mov edx, dword [eax + 0x2c]
call edx
cmp esi, esp
call fcn.004f4cf0
mov esi, esp
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.004f4cf0
push 0x44
push 0
lea eax, [ebp - 0x1ee8]
push eax
call fcn.004f6010
add esp, 0xc
mov dword [ebp - 0x1ee8], 0x44
mov esi, esp
lea eax, [ebp - 0x2110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp esi, esp
call fcn.004f4cf0
mov esi, esp
push 0x104
lea eax, [ebp - 0x2320]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp esi, esp
call fcn.004f4cf0
lea eax, [ebp - 0x2320]
push eax
lea ecx, [ebp - 0x2110]
push ecx
push str._sLauncher.new__update___s_
lea edx, [ebp - 0x2738]
push edx
call fcn.00401041
add esp, 0x10
mov esi, esp
lea eax, [ebp - 0x1f00]
push eax
lea ecx, [ebp - 0x1ee8]
push ecx
lea edx, [ebp - 0x2110]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2738]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp esi, esp
call fcn.004f4cf0
push 0
push 0
push 0x12
mov ecx, dword [ebp - 0xc]
call fcn.00410c30
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, esp
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.004f4cf0
push 0x200
push 0
lea eax, [ebp - 0x42c]
push eax
call fcn.004f6010
add esp, 0xc
mov dword [ebp - 0x24], 0
push 0
call fcn.004b8390
add esp, 4
push edx
push eax
push 0x5d94fa
push str._s_t_d
lea eax, [ebp - 0x42c]
push eax
call fcn.004016fe
add esp, 0x14
lea eax, [ebp - 0x24]
push eax
push str.kernel_script_files
lea ecx, [ebp - 0x42c]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.0040197e
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4a8db1
push 0
call fcn.004b8390
add esp, 4
mov dword [0x5e37b8], eax
mov esi, esp
lea eax, [ebp - 0x1a64]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp esi, esp
call fcn.004f4cf0
mov eax, dword [0x5e37b8]
push eax
lea ecx, [ebp - 0x1a64]
push ecx
push str._sverify_d.txt
lea edx, [ebp - 0x1c74]
push edx
call fcn.00401bd6
add esp, 0x10
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c74]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.0040180c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2804], eax
mov ecx, dword [ebp - 0x2804]
push ecx
call fcn.004f9cb0
add esp, 4
mov ecx, dword [ebp - 0xc]
call fcn.004014e7
mov esi, esp
push 0x5913d0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x504]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x504]
mov edx, dword [eax + 0x2c]
call edx
cmp esi, esp
call fcn.004f4cf0
mov esi, esp
push 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x4c8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x4c8]
mov edx, dword [eax + 0xd8]
call edx
cmp esi, esp
call fcn.004f4cf0
push edx
mov ecx, ebp
push eax
lea edx, [0x4a8e38]
call fcn.004f4c90
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f4d70
add esp, 0x2820
cmp ebp, esp
call fcn.004f4cf0
mov esp, ebp
pop ebp
ret