Function at 0x4ac360
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x8e
push 0
push 0
dec ecx
jne 0x4ac368
push ecx
push ebx
push esi
push edi
lea ebx, [ebp - 0x3b0]
xor eax, eax
push ebp
push 0x4acfa3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x53bf6c]
mov edx, 0x4acfbc
call fcn.004056b0
jne 0x4acf68
mov eax, dword [0x5363c0]
mov eax, dword [eax]
call fcn.00464990
mov eax, dword [0x53bfd8]
mov edx, 0x4acfc8
call fcn.004056b0
jne 0x4ac3d3
mov eax, dword [0x53bf68]
mov eax, dword [eax + 0x360]
or ecx, 0xffffffff
mov edx, 0x18
call fcn.0046ee30
jmp 0x4ac3fb
mov eax, dword [0x53bfd8]
mov edx, 0x4acfd4
call fcn.004056b0
jne 0x4ac3fb
mov eax, dword [0x53bf68]
mov eax, dword [eax + 0x360]
xor ecx, ecx
mov edx, 0x18
call fcn.0046ee30
call fcn.0040ba34
fstp qword [0x53c060]
wait
call fcn.004033ac
push 0x4acfe0
mov eax, 0x270f
call fcn.004033d4
lea edx, [ebp - 0x3cc]
call fcn.00409cb4
mov eax, dword [ebp - 0x3cc]
lea edx, [ebp - 0x3c8]
call fcn.0049fed0
lea eax, [ebp - 0x3c8]
lea edx, [ebp - 0x3b8]
call fcn.0049ff48
mov eax, dword [ebp - 0x3b8]
push eax
mov eax, 0x14
call fcn.004033d4
mov edx, eax
add edx, 0xa
lea ecx, [ebp - 0x3b4]
pop eax
call fcn.00436304
push dword [ebp - 0x3b4]
lea edx, [ebp - 0x3d0]
mov eax, dword [0x53bf74]
call fcn.004aba30
push dword [ebp - 0x3d0]
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040561c
mov eax, dword [ebp - 4]
call fcn.0040a180
test al, al
jne 0x4ac4c5
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.00405718
push eax
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1e4]
call fcn.00403728
lea eax, [ebp - 0x1e4]
call fcn.004034c4
call fcn.004030bc
mov eax, 0x270f
call fcn.004033d4
lea edx, [ebp - 0x3e0]
call fcn.00409cb4
mov eax, dword [ebp - 0x3e0]
lea edx, [ebp - 0x3c8]
call fcn.0049fed0
lea eax, [ebp - 0x3c8]
lea edx, [ebp - 0x3dc]
call fcn.0049ff48
mov eax, dword [ebp - 0x3dc]
push eax
mov eax, 0x14
call fcn.004033d4
mov edx, eax
add edx, 0xa
lea ecx, [ebp - 0x3d8]
pop eax
call fcn.00436304
lea eax, [ebp - 0x3d8]
push eax
lea edx, [ebp - 0x3e4]
mov eax, dword [0x53bf74]
call fcn.004aba30
mov edx, dword [ebp - 0x3e4]
pop eax
call fcn.00405554
mov eax, dword [ebp - 0x3d8]
lea edx, [ebp - 0x3d4]
call fcn.004ab978
mov edx, dword [ebp - 0x3d4]
lea eax, [ebp - 0x1e4]
call fcn.00405a38
call fcn.00403de4
call fcn.004030bc
lea eax, [ebp - 0x1e4]
call fcn.004037f0
call fcn.004030bc
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00403728
mov eax, ebx
call fcn.004034b8
call fcn.004030bc
mov eax, ebx
call fcn.00403958
call fcn.004030bc
test al, al
jne 0x4ac5d7
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00403b60
mov eax, ebx
call fcn.00403bcc
call fcn.004030bc
mov eax, ebx
call fcn.004037f0
call fcn.004030bc
mov eax, dword [ebp - 4]
call fcn.00405718
push eax
call sub.kernel32.dll_DeleteFileA
push 0x4acfe0
mov eax, 0x270f
call fcn.004033d4
lea edx, [ebp - 0x3f0]
call fcn.00409cb4
mov eax, dword [ebp - 0x3f0]
lea edx, [ebp - 0x3c8]
call fcn.0049fed0
lea eax, [ebp - 0x3c8]
lea edx, [ebp - 0x3ec]
call fcn.0049ff48
mov eax, dword [ebp - 0x3ec]
push eax
mov eax, 0x14
call fcn.004033d4
mov edx, eax
add edx, 0xa
lea ecx, [ebp - 0x3e8]
pop eax
call fcn.00436304
push dword [ebp - 0x3e8]
lea edx, [ebp - 0x3f4]
mov eax, dword [0x53bf74]
call fcn.004aba30
push dword [ebp - 0x3f4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040561c
mov eax, dword [ebp - 8]
call fcn.0040a180
test al, al
jne 0x4ac6aa
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.00405718
push eax
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1e4]
call fcn.00403728
lea eax, [ebp - 0x1e4]
call fcn.004034c4
call fcn.004030bc
mov eax, 0x270f
call fcn.004033d4
lea edx, [ebp - 0x404]
call fcn.00409cb4
mov eax, dword [ebp - 0x404]
lea edx, [ebp - 0x3c8]
call fcn.0049fed0
lea eax, [ebp - 0x3c8]
lea edx, [ebp - 0x400]
call fcn.0049ff48
mov eax, dword [ebp - 0x400]
push eax
mov eax, 0x14
call fcn.004033d4
mov edx, eax
add edx, 0xa
lea ecx, [ebp - 0x3fc]
pop eax
call fcn.00436304
lea eax, [ebp - 0x3fc]
push eax
lea edx, [ebp - 0x408]
mov eax, dword [0x53bf74]
call fcn.004aba30
mov edx, dword [ebp - 0x408]
pop eax
call fcn.00405554
mov eax, dword [ebp - 0x3fc]
lea edx, [ebp - 0x3f8]
call fcn.004ab978
mov edx, dword [ebp - 0x3f8]
lea eax, [ebp - 0x1e4]
call fcn.00405a38
call fcn.00403de4
call fcn.004030bc
lea eax, [ebp - 0x1e4]
call fcn.004037f0
call fcn.004030bc
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00403728
mov eax, ebx
call fcn.004034b8
call fcn.004030bc
mov eax, ebx
call fcn.00403958
call fcn.004030bc
test al, al
jne 0x4ac7bc
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00403b60
mov eax, ebx
call fcn.00403bcc
call fcn.004030bc
mov eax, ebx
call fcn.004037f0
call fcn.004030bc
mov eax, dword [ebp - 8]
call fcn.00405718
push eax
call sub.kernel32.dll_DeleteFileA
push 0x4acfe0
mov eax, 0x270f
call fcn.004033d4
lea edx, [ebp - 0x414]
call fcn.00409cb4
mov eax, dword [ebp - 0x414]
lea edx, [ebp - 0x3c8]
call fcn.0049fed0
lea eax, [ebp - 0x3c8]
lea edx, [ebp - 0x410]
call fcn.0049ff48
mov eax, dword [ebp - 0x410]
push eax
mov eax, 0x14
call fcn.004033d4
mov edx, eax
add edx, 0xa
lea ecx, [ebp - 0x40c]
pop eax
call fcn.00436304
push dword [ebp - 0x40c]
lea edx, [ebp - 0x418]
mov eax, dword [0x53bf74]
call fcn.004aba30
push dword [ebp - 0x418]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040561c
mov eax, dword [ebp - 0xc]
call fcn.0040a180
test al, al
jne 0x4ac88f
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0xc]
call fcn.00405718
push eax
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x1e4]
call fcn.00403728
lea eax, [ebp - 0x1e4]
call fcn.004034c4
call fcn.004030bc
mov eax, 0x270f
call fcn.004033d4
lea edx, [ebp - 0x428]
call fcn.00409cb4
mov eax, dword [ebp - 0x428]
lea edx, [ebp - 0x3c8]
call fcn.0049fed0
lea eax, [ebp - 0x3c8]
lea edx, [ebp - 0x424]
call fcn.0049ff48
mov eax, dword [ebp - 0x424]
push eax
mov eax, 0x14
call fcn.004033d4
mov edx, eax
add edx, 0xa
lea ecx, [ebp - 0x420]
pop eax
call fcn.00436304
lea eax, [ebp - 0x420]
push eax
lea edx, [ebp - 0x42c]
mov eax, dword [0x53bf74]
call fcn.004aba30
mov edx, dword [ebp - 0x42c]
pop eax
call fcn.00405554
mov eax, dword [ebp - 0x420]
lea edx, [ebp - 0x41c]
call fcn.004ab978
mov edx, dword [ebp - 0x41c]
lea eax, [ebp - 0x1e4]
call fcn.00405a38
call fcn.00403de4
call fcn.004030bc
lea eax, [ebp - 0x1e4]
call fcn.004037f0
call fcn.004030bc
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00403728
mov eax, ebx
call fcn.004034b8
call fcn.004030bc
mov eax, ebx
call fcn.00403958
call fcn.004030bc
test al, al
jne 0x4ac9a1
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00403b60
mov eax, ebx
call fcn.00403bcc
call fcn.004030bc
mov eax, ebx
call fcn.004037f0
call fcn.004030bc
mov eax, dword [ebp - 0xc]
call fcn.00405718
push eax
call sub.kernel32.dll_DeleteFileA
push 0x4acfe0
mov eax, 0x270f
call fcn.004033d4
lea edx, [ebp - 0x438]
call fcn.00409cb4
mov eax, dword [ebp - 0x438]
lea edx, [ebp - 0x3c8]
call fcn.0049fed0
lea eax, [ebp - 0x3c8]
lea edx, [ebp - 0x434]
call fcn.0049ff48
mov eax, dword [ebp - 0x434]
push eax
mov eax, 0x14
call fcn.004033d4
mov edx, eax
add edx, 0xa
lea ecx, [ebp - 0x430]
pop eax
call fcn.00436304
push dword [ebp - 0x430]
lea edx, [ebp - 0x43c]
mov eax, dword [0x53bf74]
call fcn.004aba30
push dword [ebp - 0x43c]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040561c
mov eax, dword [ebp - 0x10]
call fcn.0040a180
test al, al
jne 0x4aca74
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x10]
call fcn.00405718
push eax
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x1e4]
call fcn.00403728
lea eax, [ebp - 0x1e4]
call fcn.004034c4
call fcn.004030bc
mov eax, 0x270f
call fcn.004033d4
lea edx, [ebp - 0x44c]
call fcn.00409cb4
mov eax, dword [ebp - 0x44c]
lea edx, [ebp - 0x3c8]
call fcn.0049fed0
lea eax, [ebp - 0x3c8]
lea edx, [ebp - 0x448]
call fcn.0049ff48
mov eax, dword [ebp - 0x448]
push eax
mov eax, 0x14
call fcn.004033d4
mov edx, eax
add edx, 0xa
lea ecx, [ebp - 0x444]
pop eax
call fcn.00436304
lea eax, [ebp - 0x444]
push eax
lea edx, [ebp - 0x450]
mov eax, dword [0x53bf74]
call fcn.004aba30
mov edx, dword [ebp - 0x450]
pop eax
call fcn.00405554
mov eax, dword [ebp - 0x444]
lea edx, [ebp - 0x440]
call fcn.004ab978
mov edx, dword [ebp - 0x440]
lea eax, [ebp - 0x1e4]
call fcn.00405a38
call fcn.00403de4
call fcn.004030bc
lea eax, [ebp - 0x1e4]
call fcn.004037f0
call fcn.004030bc
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.00403728
mov eax, ebx
call fcn.004034b8
call fcn.004030bc
mov eax, ebx
call fcn.00403958
call fcn.004030bc
test al, al
jne 0x4acb86
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00403b60
mov eax, ebx
call fcn.00403bcc
call fcn.004030bc
mov eax, ebx
call fcn.004037f0
call fcn.004030bc
mov eax, dword [ebp - 0x10]
call fcn.00405718
push eax
call sub.kernel32.dll_DeleteFileA
push 0x4acfe0
mov eax, 0x270f
call fcn.004033d4
lea edx, [ebp - 0x45c]
call fcn.00409cb4
mov eax, dword [ebp - 0x45c]
lea edx, [ebp - 0x3c8]
call fcn.0049fed0
lea eax, [ebp - 0x3c8]
lea edx, [ebp - 0x458]
call fcn.0049ff48
mov eax, dword [ebp - 0x458]
push eax
mov eax, 0x14
call fcn.004033d4
mov edx, eax
add edx, 0xa
lea ecx, [ebp - 0x454]
pop eax
call fcn.00436304
push dword [ebp - 0x454]
lea edx, [ebp - 0x460]
mov eax, dword [0x53bf74]
call fcn.004aba30
push dword [ebp - 0x460]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040561c
mov eax, dword [ebp - 0x14]
call fcn.0040a180
test al, al
jne 0x4acc59
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x14]
call fcn.00405718
push eax
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x1e4]
call fcn.00403728
lea eax, [ebp - 0x1e4]
call fcn.004034c4
call fcn.004030bc
mov eax, 0x270f
call fcn.004033d4
lea edx, [ebp - 0x470]
call fcn.00409cb4
mov eax, dword [ebp - 0x470]
lea edx, [ebp - 0x3c8]
call fcn.0049fed0
lea eax, [ebp - 0x3c8]
lea edx, [ebp - 0x46c]
call fcn.0049ff48
mov eax, dword [ebp - 0x46c]
push eax
mov eax, 0x14
call fcn.004033d4
mov edx, eax
add edx, 0xa
lea ecx, [ebp - 0x468]
pop eax
call fcn.00436304
lea eax, [ebp - 0x468]
push eax
lea edx, [ebp - 0x474]
mov eax, dword [0x53bf74]
call fcn.004aba30
mov edx, dword [ebp - 0x474]
pop eax
call fcn.00405554
mov eax, dword [ebp - 0x468]
lea edx, [ebp - 0x464]
call fcn.004ab978
mov edx, dword [ebp - 0x464]
lea eax, [ebp - 0x1e4]
call fcn.00405a38
call fcn.00403de4
call fcn.004030bc
lea eax, [ebp - 0x1e4]
call fcn.004037f0
call fcn.004030bc
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.00403728
mov eax, ebx
call fcn.004034b8
call fcn.004030bc
mov eax, ebx
call fcn.00403958
call fcn.004030bc
test al, al
jne 0x4acd6b
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00403b60
mov eax, ebx
call fcn.00403bcc
call fcn.004030bc
mov eax, ebx
call fcn.004037f0
call fcn.004030bc
mov eax, dword [ebp - 0x14]
call fcn.00405718
push eax
call sub.kernel32.dll_DeleteFileA
call fcn.0040ba34
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [0x53c064]
push dword [0x53c060]
call fcn.0049c7c4
cmp edx, 0
jne 0x4acdae
cmp eax, 5
jae 0x4acdd6
jmp 0x4acdb0
jge 0x4acdd6
mov eax, dword [0x53bfdc]
mov edx, 0x4acfc8
call fcn.004056b0
jne 0x4acdc6
call fcn.004a8efc
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4a7314]
call fcn.0041fb5c
jmp 0x4acde2
xor edx, edx
mov eax, dword [0x53bf68]
call fcn.0044a990
cmp dword [0x53bfd0], 0
je 0x4ace42
cmp dword [0x53bfd4], 0
je 0x4ace42
xor eax, eax
push ebp
push 0x4ace38
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x53bfd4]
call fcn.00409df0
mov edx, eax
mov eax, dword [0x53bf68]
call fcn.0044a048
mov eax, dword [0x53bfd0]
call fcn.00409df0
mov edx, eax
mov eax, dword [0x53bf68]
call fcn.0044a07c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ace42
mov eax, dword [0x5366f8]
cmp dword [eax], 0
je 0x4acee4
xor eax, eax
push ebp
push 0x4aceda
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x53bf68]
call fcn.0045fd64
mov ebx, eax
mov eax, dword [0x53bfb8]
call fcn.00409df0
add ebx, eax
mov edx, ebx
mov eax, dword [0x53650c]
mov eax, dword [eax]
call fcn.00465394
mov eax, dword [0x53bf68]
call fcn.0045fd84
mov ebx, eax
mov eax, dword [0x53bfbc]
call fcn.00409df0
add ebx, eax
mov edx, ebx
mov eax, dword [0x53650c]
mov eax, dword [eax]
call fcn.004653d0
mov edx, dword [0x5366f8]
mov edx, dword [edx]
mov eax, dword [0x53650c]
mov eax, dword [eax]
mov eax, dword [eax + 0x360]
call fcn.0044a990
mov eax, dword [0x53650c]
mov eax, dword [eax]
call fcn.00464990
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4acee4
mov eax, dword [0x53bf68]
mov eax, dword [eax + 0x370]
mov dl, 1
call fcn.00439f84
mov eax, dword [0x53bf68]
mov eax, dword [eax + 0x36c]
mov dl, 1
call fcn.00439f84
cmp dword [0x53bff0], 0
je 0x4acf3c
mov eax, dword [0x53bff0]
mov edx, 0x4acff8
call fcn.004056b0
je 0x4acf3c
push 1
push 0
push 0
mov eax, dword [0x53bff0]
call fcn.00405718
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
push ebp
push 0x4acf5e
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0043cae8
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4acf68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acfaa
lea eax, [ebp - 0x474]
mov edx, 0x2b
call fcn.004052ac
lea eax, [ebp - 0x3b8]
mov edx, 2
call fcn.004052ac
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004052ac
ret