Function at 0x40a67d
Capabilities:
Create process on windows
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4d2cd0
mov eax, dword fs:[0]
push eax
sub esp, 0x64c
mov eax, dword [0x518450]
xor eax, esp
mov dword [esp + 0x648], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x518450]
xor eax, esp
push eax
lea eax, [esp + 0x660]
mov dword fs:[0], eax
mov bx, dx
mov dword [esp + 0x24], ecx
movzx eax, bl
mov edi, dword [eax*4 + 0x52aa34]
test edi, edi
je 0x40aa45
cmp dword [edi + 0x70], 0x14
jl 0x40aa45
cmp dword [edi + 0x70], 0x17
jg 0x40aa45
lea ecx, [esp + 0x8c]
call fcn.0041e868
xor esi, esi
mov dword [esp + 0x668], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
lea ecx, [esp + 0x1cc]
mov byte [esp + 0x668], 1
call fcn.0040dcf4
movzx ebx, bx
mov ebp, eax
push ebx
push 0xa809ada3
mov edx, 0x8df970a9
mov dword [esp + 0x28], ebp
mov ecx, 0x39b6ec8d
call fcn.0040152a
pop ecx
push eax
push ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
call ebp
add esp, 0xc
lea eax, [esp + 0x14]
mov edx, 0xa3b89e9f
mov ecx, 0x17f702ab
push eax
lea eax, [esp + 0x90]
push eax
push 0x8648439a
call fcn.00401500
pop ecx
mov edx, eax
lea ecx, [esp + 0x1d4]
call fcn.0040a331
push 0x17c
call fcn.004ba21e
add esp, 0xc
mov dword [esp + 0x28], eax
mov byte [esp + 0x668], 2
test eax, eax
je 0x40a79c
mov ecx, eax
call fcn.0044501d
mov esi, eax
mov byte [esp + 0x668], 1
test esi, esi
je 0x40a8da
lea ecx, [esp + 0x2c]
call fcn.00423fcd
lea eax, [ebx - 0x41]
mov byte [esp + 0x668], 3
push eax
lea ecx, [esp + 0x30]
call fcn.0042479a
test al, al
je 0x40a8bb
push 0
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.00445934
test al, al
je 0x40a8b2
push ebx
push 0x2cbfc3cc
mov edx, 0x94f1ec6
mov ecx, 0xbd00820c
call fcn.0040152a
pop ecx
push eax
push dword [esp + 0x28]
call ebp
add esp, 0xc
mov edx, 0xb93f77cd
mov ecx, 0xd70eb17
push 0x9ccfaac2
call fcn.0040152a
pop ecx
push eax
lea eax, [esp + 0x1d0]
push eax
call fcn.004ba90a
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x40a886
push 0
push 0
push ebx
mov ecx, esi
call fcn.00445297
push ebx
call fcn.004baa50
pop ecx
lea eax, [esp + 0x14]
mov edx, 0x2b890ce2
push eax
lea eax, [esp + 0x90]
mov ecx, 0x9fc69036
push eax
push 0xe79d1e8
call fcn.00401500
pop ecx
mov edx, eax
lea ecx, [esp + 0x1d4]
call fcn.0040a331
pop ecx
pop ecx
lea eax, [esp + 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x14]
xor ebx, ebx
push eax
lea eax, [esp + 0x90]
mov ecx, esi
push eax
push ebx
push ebx
call fcn.0044572d
push eax
lea edx, [esp + 0x1d8]
push esi
push ebx
mov ecx, edx
call fcn.0040a36e
add esp, 0x14
lea ecx, [esp + 0x2c]
call fcn.00424059
mov ecx, esi
call fcn.0044512d
push esi
call fcn.004ba219
pop ecx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x668], 1
call fcn.00423ffa
push 0x6d40686e
mov edx, 0x48b0b56a
mov ecx, 0xfcff2980
call fcn.0040152a
lea edx, [esp + 0x1d0]
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x40a8f8
lea ecx, [esp + 0x1dc]
call fcn.0040dcf4
lea ecx, [edi + 0x94]
mov edx, 0x3796005b
push ecx
push 0x4ef5b0
push 0x1266dd43
mov ecx, 0x83d99cad
mov esi, eax
call fcn.0040152a
pop ecx
push eax
push esi
call ebp
add esp, 0x10
lea eax, [esp + 0x414]
xor ebx, ebx
push ebx
push ebx
push 0x248
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x1f0]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [esp + 0x414]
push eax
lea ecx, [esp + 0x90]
call fcn.0041f56e
mov eax, dword [esp + 0x18]
mov esi, ebx
mov ecx, dword [esp + 0x14]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x40a9a2
push dword [ecx + esi*4]
call fcn.0040507c
mov eax, dword [esp + 0x1c]
inc esi
pop ecx
mov ecx, dword [esp + 0x14]
sub eax, ecx
sar eax, 2
cmp esi, eax
jb 0x40a987
lea eax, [esp + 0x1dc]
mov edx, 0xe3052258
push eax
push 0xc6f5ff41
mov ecx, 0x574abef2
call fcn.0040152a
pop ecx
push eax
lea eax, [esp + 0x41c]
push eax
call ebp
add esp, 0xc
lea eax, [esp + 0x414]
push 0x40
push 0x4ef5ec
push eax
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x40aa28
push eax
push ebx
lea eax, [esp + 0x1d4]
mov edx, 0xce61f7e5
push eax
push 0xeb912ae1
mov ecx, 0x7a2e6ab1
call fcn.0040152a
pop ecx
push eax
push 0x78eb6457
mov edx, 0x5d1bb95f
mov ecx, 0xe954241f
call fcn.0040152a
pop ecx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x14]
call fcn.0040ab0c
or dword [esp + 0x668], 0xffffffff
lea ecx, [esp + 0x8c]
call fcn.0041e964
mov ecx, dword [esp + 0x660]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x648]
xor ecx, esp
call fcn.004b9a6c
add esp, 0x658
ret