Function at 0x647d44
Capabilities:
Accept command line arguments
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x20
push 0
push 0
dec ecx
jne 0x647d4c
push ecx
push ebx
push esi
push edi
mov byte [ebp - 0x29], al
xor eax, eax
push ebp
push 0x64846e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x2a], 0
mov byte [ebp - 0x31], 0
mov edx, dword [0x67a764]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
mov ecx, 0x64848c
call fcn.00409ebc
mov dl, 1
mov eax, dword [ebp - 0x14]
call fcn.004202f0
test al, al
je 0x64840d
mov dl, 1
mov eax, dword [0x47a8bc]
call fcn.0049ceb4
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x4cd9b4]
call fcn.004d0b78
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.006127e8
call sub.kernel32.dll_GetACP_1
mov edx, eax
mov eax, dword [0x67a764]
mov eax, dword [eax]
call fcn.0061eb1c
test al, al
je 0x647dff
lea eax, [ebp - 0x98]
call fcn.0061b9a0
mov eax, dword [ebp - 0x98]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.0061eb1c
test al, al
je 0x647dff
xor eax, eax
jmp 0x647e01
mov al, 1
mov byte [ebp - 0x39], al
push 0
mov ecx, 0x6484b0
mov edx, 0x6484c8
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
test eax, eax
jle 0x647f84
mov dword [ebp - 0x40], eax
mov esi, 1
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xa0], esi
mov byte [ebp - 0x9c], 0
lea edx, [ebp - 0xa0]
xor ecx, ecx
mov eax, 0x6484e4
call fcn.00420f7c
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x648500
mov edx, dword [ebp - 4]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 4]
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x648518
mov edx, dword [ebp - 4]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 4]
push 0
lea eax, [ebp - 0xa4]
push eax
mov ecx, 0x64852c
mov edx, dword [ebp - 4]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 4]
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0x24]
call fcn.0041ef98
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x647eac
sub eax, 4
mov eax, dword [eax]
dec eax
jge 0x647eb3
mov al, 1
jmp 0x647ec9
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x648548
call fcn.0040a23c
dec eax
setne al
test al, al
jne 0x647f7a
mov edx, dword [0x67a764]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
call fcn.00409ebc
mov dl, 1
mov eax, dword [ebp - 0x10]
call fcn.004202f0
test al, al
je 0x6483f6
lea edx, [ebp - 0xbc]
mov eax, dword [ebp - 0x10]
call fcn.0060ff48
lea eax, [ebp - 0xbc]
lea edx, [ebp - 0xac]
call fcn.006100a4
mov eax, dword [ebp - 0xac]
lea edx, [ebp - 0xa8]
call fcn.0041ef98
mov eax, dword [ebp - 0xa8]
mov edx, dword [ebp - 0x24]
call fcn.00409ff4
je 0x647f71
mov eax, dword [0x67a564]
cmp byte [eax + 0x878], 0
je 0x647f64
lea eax, [ebp - 0xc0]
mov ecx, dword [ebp - 0x10]
mov edx, 0x648560
call fcn.00409ebc
mov eax, dword [ebp - 0xc0]
xor edx, edx
call fcn.0063b130
mov eax, dword [ebp - 0x10]
call fcn.00420698
jmp 0x6483f6
cmp esi, dword [ebp - 0x30]
jne 0x647f7a
mov byte [ebp - 0x31], 1
inc esi
dec dword [ebp - 0x40]
jne 0x647e2d
cmp byte [ebp - 0x31], 0
jne 0x647fad
mov eax, dword [0x67a564]
cmp byte [eax + 0x878], 0
je 0x6483f6
xor edx, edx
mov eax, 0x6485b4
call fcn.0063b130
jmp 0x6483f6
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00406b1c
cmp byte [ebp - 0x39], 0
je 0x647fd9
lea edx, [ebp - 0xc4]
mov eax, dword [ebp - 0x1c]
call fcn.004208e4
mov edx, dword [ebp - 0xc4]
lea eax, [ebp - 0x1c]
call fcn.00409284
mov edx, 0x64860c
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0xc8]
push eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 0x9c], 0x11
lea edx, [ebp - 0xa0]
xor ecx, ecx
mov eax, 0x648624
call fcn.00420f7c
mov edx, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0xcc]
push eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 0x9c], 0x11
lea edx, [ebp - 0xa0]
xor ecx, ecx
mov eax, 0x648644
call fcn.00420f7c
mov edx, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [ebp - 0x30]
test eax, eax
jle 0x648295
mov dword [ebp - 0x40], eax
mov esi, 1
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xa0], esi
mov byte [ebp - 0x9c], 0
lea edx, [ebp - 0xa0]
xor ecx, ecx
mov eax, 0x6484e4
call fcn.00420f7c
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x648500
mov edx, dword [ebp - 4]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 4]
push 0
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x648680
mov edx, dword [ebp - 4]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 4]
lea edx, [ebp - 0xd0]
mov eax, dword [ebp - 0x28]
call fcn.00620d1c
mov edx, dword [ebp - 0xd0]
lea eax, [ebp - 0x28]
call fcn.00409284
mov edx, dword [ebp - 0x28]
mov eax, edx
test eax, eax
je 0x6480de
sub eax, 4
mov eax, dword [eax]
dec eax
jge 0x6480ff
lea eax, [ebp - 0xd4]
call fcn.0061b9a0
mov edx, dword [ebp - 0xd4]
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
call fcn.00409ebc
jmp 0x64815a
mov eax, edx
test eax, eax
je 0x64810a
sub eax, 4
mov eax, dword [eax]
dec eax
jle 0x64811a
mov eax, dword [ebp - 0x28]
cmp word [eax + 2], 0x3a
sete al
jmp 0x64811c
xor eax, eax
test al, al
je 0x648130
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
call fcn.0061fe68
jmp 0x64815a
lea eax, [ebp - 0xd8]
call fcn.0061b9a0
lea eax, [ebp - 0xd8]
mov edx, dword [ebp - 0x28]
call fcn.00409e64
mov eax, dword [ebp - 0xd8]
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 0x20]
call fcn.0061fe68
mov eax, dword [0x67a564]
cmp byte [eax + 0x878], 0
je 0x648188
lea eax, [ebp - 0xdc]
mov ecx, dword [ebp - 0xc]
mov edx, 0x648694
call fcn.00409ebc
mov eax, dword [ebp - 0xdc]
xor edx, edx
call fcn.0063b130
mov edx, dword [0x67a764]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
call fcn.00409ebc
cmp byte [ebp - 0x39], 0
je 0x6481d9
lea edx, [ebp - 0xe0]
mov eax, dword [ebp - 0x10]
call fcn.00620ac8
mov edx, dword [ebp - 0xe0]
lea eax, [ebp - 0x10]
call fcn.00409284
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0xc]
call fcn.00620ac8
mov edx, dword [ebp - 0xe4]
lea eax, [ebp - 0xc]
call fcn.00409284
lea eax, [ebp - 0xe8]
push eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0x11
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0x11
lea edx, [ebp - 0xbc]
mov ecx, 1
mov eax, 0x6486b8
call fcn.00420f7c
mov edx, dword [ebp - 0xe8]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0xec]
push eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 0x9c], 0x11
lea edx, [ebp - 0xa0]
xor ecx, ecx
mov eax, 0x648624
call fcn.00420f7c
mov edx, dword [ebp - 0xec]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0042078c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x648271
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x64828b
mov dl, 1
mov eax, dword [ebp - 0x1c]
call fcn.00420388
test al, al
jne 0x64828b
mov eax, dword [ebp - 0x1c]
call fcn.00420468
inc esi
dec dword [ebp - 0x40]
jne 0x648067
mov edx, dword [0x67a764]
mov edx, dword [edx]
lea eax, [ebp - 0x18]
mov ecx, 0x6486e8
call fcn.00409ebc
cmp byte [ebp - 0x39], 0
je 0x6482cc
lea edx, [ebp - 0xf0]
mov eax, dword [ebp - 0x18]
call fcn.004208e4
mov edx, dword [ebp - 0xf0]
lea eax, [ebp - 0x18]
call fcn.00409284
cmp byte [ebp - 0x29], 0
je 0x6482f2
call sub.kernel32.dll_GetCommandLineW_1
mov edx, eax
lea eax, [ebp - 0xf4]
call fcn.00409cb8
mov edx, dword [ebp - 0xf4]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0xf8]
push eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 0x9c], 0x11
lea edx, [ebp - 0xa0]
xor ecx, ecx
mov eax, 0x648624
call fcn.00420f7c
mov edx, dword [ebp - 0xf8]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea edx, [ebp - 0x100]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x100]
lea eax, [ebp - 0xfc]
mov ecx, 0
call fcn.004099e0
mov edx, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x18]
call fcn.0061e074
mov eax, dword [0x67a564]
cmp byte [eax + 0x878], 0
je 0x648387
lea edx, [ebp - 0x104]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x104]
mov edx, 0x20
call fcn.0063b1e4
lea eax, [ebp - 0x94]
xor ecx, ecx
mov edx, 0x44
call fcn.00406d94
mov dword [ebp - 0x68], 1
mov word [ebp - 0x64], 0
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x10
call fcn.00406d94
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x94]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.00409c50
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x6483f2
mov eax, dword [ebp - 0x4c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x50]
push eax
call sub.kernel32.dll_CloseHandle_1
mov byte [ebp - 0x2a], 1
mov eax, ebx
call fcn.00407240
mov eax, dword [ebp - 0x38]
call fcn.00407240
mov eax, dword [ebp - 0x14]
call fcn.00420698
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x648475
lea eax, [ebp - 0x104]
mov edx, 2
call fcn.00408ebc
lea eax, [ebp - 0xfc]
call fcn.00408e80
lea eax, [ebp - 0xf8]
mov edx, 0xf
call fcn.00408ebc
lea eax, [ebp - 0xac]
mov edx, 3
call fcn.00408ebc
lea eax, [ebp - 0x98]
call fcn.00408e5c
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.00408ebc
ret