Function at 0x4d7ffc
Capabilities:
Create process on windows
Delete file
Move file
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x64
push 0
push 0
dec ecx
jne 0x4d8004
push ebx
push esi
push edi
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d8805
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b0]
mov edx, dword [eax]
call dword [edx + 0x5c]
test al, al
je 0x4d87d2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3a8]
mov si, 0xffec
call fcn.004055e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3a0]
mov si, 0xffec
call fcn.004055e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b0]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x74]
lea eax, [ebp - 0x2f4]
mov ecx, 0x4d8820
mov edx, dword [0x4ec3b8]
call fcn.004073c8
mov eax, dword [ebp - 0x2f4]
call fcn.00406f98
push eax
push 0
call sub.user32.dll_FindWindowW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x4d80bd
push 0
push 0
push 0x10
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_SendMessageW
xor eax, eax
push ebp
push 0x4d8703
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0041528c
fstp qword [ebp - 0x18]
wait
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
mov edx, 0x4d883c
call fcn.00415f4c
push dword [0x4ec3bc]
push 0x4d8868
push dword [ebp - 0x1c]
push 0x4d8888
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004074ac
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x2f0]
call fcn.00404a14
lea eax, [ebp - 0x2f0]
call fcn.004047ac
call fcn.004043cc
cmp byte [0x4e6714], 0
jne 0x4d857b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
call fcn.004d7814
cmp edx, 0
jne 0x4d8152
cmp eax, 0x1f4
jbe 0x4d8212
jmp 0x4d8158
jle 0x4d8212
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c8]
call fcn.004d7814
cmp edx, 0
jne 0x4d8178
cmp eax, 0x1f4
jbe 0x4d8212
jmp 0x4d817e
jle 0x4d8212
push 0x4d88a0
mov eax, dword [ebp - 4]
push dword [eax + 0x3c4]
push 0x4d88c0
mov eax, dword [ebp - 4]
push dword [eax + 0x3c8]
push 0x4d88dc
mov eax, dword [ebp - 4]
push dword [eax + 0x3cc]
push 0x4d8940
lea eax, [ebp - 8]
mov edx, 7
call fcn.004074ac
push 0x4d8940
push dword [0x4ec3b8]
push 0x4d8950
push dword [ebp - 8]
lea eax, [ebp - 0x2f8]
mov edx, 4
call fcn.004074ac
mov edx, dword [ebp - 0x2f8]
lea eax, [ebp - 0x2f0]
call fcn.004078a4
call fcn.00404e70
call fcn.004043cc
mov edx, 0x4d8970
lea eax, [ebp - 0x2f0]
call fcn.004078a4
call fcn.00404e70
call fcn.004043cc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
call fcn.004d7814
cmp edx, 0
jne 0x4d822e
cmp eax, 0x1f4
jae 0x4d82a8
jmp 0x4d8230
jge 0x4d82a8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c8]
call fcn.004d7814
cmp edx, 0
jne 0x4d824c
cmp eax, 0x1f4
jae 0x4d82a8
jmp 0x4d824e
jge 0x4d82a8
push 0x4d88a0
mov eax, dword [ebp - 4]
push dword [eax + 0x3d4]
push 0x4d8990
mov eax, dword [ebp - 4]
push dword [eax + 0x3d8]
push 0x4d8940
lea eax, [ebp - 8]
mov edx, 5
call fcn.004074ac
call fcn.0041528c
add esp, 0xfffffff8
fstp qword [esp]
wait
push 0x4d89e4
push 0
push 0x4d89fc
mov ecx, 2
mov edx, 0x4d8a44
mov eax, 0x4d8a60
call fcn.004d7078
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
call fcn.004d7814
cmp edx, 0
jne 0x4d82c8
cmp eax, 0x1f4
jbe 0x4d8379
jmp 0x4d82ce
jle 0x4d8379
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c8]
call fcn.004d7814
cmp edx, 0
jne 0x4d82ee
cmp eax, 0x1f4
jae 0x4d8379
jmp 0x4d82f4
jge 0x4d8379
xor eax, eax
push ebp
push 0x4d836f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3cc]
call fcn.00406f98
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3cc]
call fcn.00406f98
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
call fcn.00406f98
push eax
call sub.kernel32.dll_MoveFileW
call fcn.0041528c
add esp, 0xfffffff8
fstp qword [esp]
wait
push 0x4d89e4
push 0
push 0x4d8a7c
mov ecx, 2
mov edx, 0x4d8a44
mov eax, 0x4d8a60
call fcn.004d7078
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d8379
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
call fcn.004d7814
cmp edx, 0
jne 0x4d8399
cmp eax, 0x1f4
jae 0x4d844a
jmp 0x4d839f
jge 0x4d844a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c8]
call fcn.004d7814
cmp edx, 0
jne 0x4d83bf
cmp eax, 0x1f4
jbe 0x4d844a
jmp 0x4d83c5
jle 0x4d844a
xor eax, eax
push ebp
push 0x4d8440
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3cc]
call fcn.00406f98
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3cc]
call fcn.00406f98
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c8]
call fcn.00406f98
push eax
call sub.kernel32.dll_MoveFileW
call fcn.0041528c
add esp, 0xfffffff8
fstp qword [esp]
wait
push 0x4d89e4
push 0
push 0x4d8aa8
mov ecx, 2
mov edx, 0x4d8a44
mov eax, 0x4d8a60
call fcn.004d7078
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d844a
push 0x4d88a0
mov eax, dword [ebp - 4]
push dword [eax + 0x3d4]
push 0x4d88c0
mov eax, dword [ebp - 4]
push dword [eax + 0x3cc]
push 0x4d8ad8
mov eax, dword [ebp - 4]
push dword [eax + 0x3d8]
push 0x4d8940
lea eax, [ebp - 8]
mov edx, 7
call fcn.004074ac
push 0x4d8940
push dword [0x4ec3b8]
push 0x4d8950
push dword [ebp - 8]
lea eax, [ebp - 0x2fc]
mov edx, 4
call fcn.004074ac
mov edx, dword [ebp - 0x2fc]
lea eax, [ebp - 0x2f0]
call fcn.004078a4
call fcn.00404e70
call fcn.004043cc
mov edx, 0x4d8970
lea eax, [ebp - 0x2f0]
call fcn.004078a4
call fcn.00404e70
call fcn.004043cc
push 0x4d8940
push dword [0x4ec3b8]
push 0x4d8b4c
push dword [0x4e672c]
push 0x4d8b8c
push dword [0x4e6730]
push 0x4d8b9c
push dword [0x4e6710]
push 0x4d8bf0
mov eax, dword [ebp - 4]
push dword [eax + 0x3d8]
push 0x4d8c1c
lea edx, [ebp - 0x300]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d8]
call fcn.00412e68
push dword [ebp - 0x300]
push 0x4d8c40
lea eax, [ebp - 8]
mov edx, 0xd
call fcn.004074ac
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x2f0]
call fcn.004078a4
call fcn.00404e70
call fcn.004043cc
mov edx, 0x4d8970
lea eax, [ebp - 0x2f0]
call fcn.004078a4
call fcn.00404e70
call fcn.004043cc
push 0x4d8ca8
mov eax, dword [ebp - 4]
push dword [eax + 0x3d8]
push 0x4d8940
lea eax, [ebp - 0x304]
mov edx, 3
call fcn.004074ac
mov edx, dword [ebp - 0x304]
lea eax, [ebp - 0x2f0]
call fcn.004078a4
call fcn.00404e70
call fcn.004043cc
push 0x4d8ca8
mov eax, dword [ebp - 4]
push dword [eax + 0x3c4]
push 0x4d8940
lea eax, [ebp - 0x308]
mov edx, 3
call fcn.004074ac
mov edx, dword [ebp - 0x308]
lea eax, [ebp - 0x2f0]
call fcn.004078a4
call fcn.00404e70
call fcn.004043cc
push 0x4d8ca8
mov eax, dword [ebp - 4]
push dword [eax + 0x3c8]
push 0x4d8940
lea eax, [ebp - 0x30c]
mov edx, 3
call fcn.004074ac
mov edx, dword [ebp - 0x30c]
lea eax, [ebp - 0x2f0]
call fcn.004078a4
call fcn.00404e70
call fcn.004043cc
push 0x4d8ca8
mov eax, dword [ebp - 4]
push dword [eax + 0x3cc]
push 0x4d8940
lea eax, [ebp - 0x310]
mov edx, 3
call fcn.004074ac
mov edx, dword [ebp - 0x310]
lea eax, [ebp - 0x2f0]
call fcn.004078a4
call fcn.00404e70
call fcn.004043cc
push 0x4d8ca8
mov eax, dword [ebp - 4]
push dword [eax + 0x3d4]
push 0x4d8940
lea eax, [ebp - 0x314]
mov edx, 3
call fcn.004074ac
mov edx, dword [ebp - 0x314]
lea eax, [ebp - 0x2f0]
call fcn.004078a4
call fcn.00404e70
call fcn.004043cc
push 0x4d8ca8
push dword [ebp - 0xc]
push 0x4d8940
lea eax, [ebp - 0x318]
mov edx, 3
call fcn.004074ac
mov edx, dword [ebp - 0x318]
lea eax, [ebp - 0x2f0]
call fcn.004078a4
call fcn.00404e70
call fcn.004043cc
lea eax, [ebp - 0x2f0]
call fcn.00404ad8
call fcn.004043cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d870d
mov eax, dword [0x4e6b9c]
mov eax, dword [eax]
cmp byte [eax + 0x5b], 0
je 0x4d875a
push 1
lea eax, [ebp - 0x31c]
mov ecx, 0x4d8cc0
mov edx, dword [0x4ec3bc]
call fcn.004073c8
mov eax, dword [ebp - 0x31c]
call fcn.00406f98
push eax
push 0x4d8ccc
mov eax, dword [ebp - 0xc]
call fcn.00406f98
push eax
push 0x4d8ccc
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x4d8798
push 0
lea eax, [ebp - 0x320]
mov ecx, 0x4d8cc0
mov edx, dword [0x4ec3bc]
call fcn.004073c8
mov eax, dword [ebp - 0x320]
call fcn.00406f98
push eax
push 0x4d8ccc
mov eax, dword [ebp - 0xc]
call fcn.00406f98
push eax
push 0x4d8ccc
push 0
call sub.shell32.dll_ShellExecuteW
call fcn.0041528c
add esp, 0xfffffff8
fstp qword [esp]
wait
push 0x4d8cdc
mov eax, dword [0x4ec3c0]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d8]
push eax
xor ecx, ecx
mov edx, 0x4d8a44
mov eax, 0x4d8a60
call fcn.004d7078
mov eax, dword [ebp - 4]
call fcn.004ad604
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d880c
lea eax, [ebp - 0x320]
mov edx, 0xc
call fcn.00406f04
lea eax, [ebp - 0x1c]
call fcn.00406efc
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00406f04
ret