Function at 0x442b90
Capabilities:
Create process on windows
Delete file
Resume thread
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcbc
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x330], eax
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x328], eax
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x324], eax
xor eax, eax
push ebp
push 0x442eea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4beb98]
cmp dword [eax], 0
je 0x442c01
push 0
push 0
push 0x404
mov eax, dword [0x4beb98]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
call fcn.0044032c
mov eax, dword [0x4becc4]
cmp dword [eax], 0
jbe 0x442c1d
mov eax, dword [0x4becc4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_FreeLibrary_1
call fcn.00442af0
mov bl, 0x2a
mov esi, dword [0x4beb40]
mov eax, dword [esi]
call fcn.004b1c50
push eax
call sub.kernel32.dll_DeleteFileA_1
add esi, 4
dec bl
jne 0x442c2a
mov bl, 6
mov esi, dword [0x4be8f4]
mov eax, esi
call fcn.004b1c50
push eax
call sub.kernel32.dll_DeleteFileA_1
add esi, 0xb
dec bl
jne 0x442c46
mov eax, dword [0x4bebd4]
cmp byte [eax], 0
je 0x442c74
mov eax, dword [0x4bea18]
call fcn.004b1c50
push eax
call sub.kernel32.dll_DeleteFileA_1
call fcn.00402634
test eax, eax
lea eax, [ebp - 0x324]
mov edx, 0x4bd954
mov ecx, 9
call fcn.00404b04
mov edx, dword [ebp - 0x324]
lea eax, [ebp - 0x2cc]
call fcn.00402bec
lea eax, [ebp - 0x2cc]
call fcn.0040297c
mov edx, 0x442f00
lea eax, [ebp - 0x2cc]
call fcn.00404e58
call fcn.00403624
push 0xff
lea eax, [ebp - 0x100]
push eax
mov eax, dword [0x4bf704]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
push 0x442f10
lea eax, [ebp - 0x32c]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00404b04
push dword [ebp - 0x32c]
push 0x442f20
lea eax, [ebp - 0x328]
mov edx, 3
call fcn.00404bdc
mov edx, dword [ebp - 0x328]
lea eax, [ebp - 0x2cc]
call fcn.00404e58
call fcn.00403624
push 0x442f2c
lea eax, [ebp - 0x334]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00404b04
push dword [ebp - 0x334]
push 0x442f40
lea eax, [ebp - 0x330]
mov edx, 3
call fcn.00404bdc
mov edx, dword [ebp - 0x330]
lea eax, [ebp - 0x2cc]
call fcn.00404e58
call fcn.00403624
lea eax, [ebp - 0x100]
mov dl, 0x5c
call fcn.004b838c
mov byte [eax], 0
push 0x442f58
lea eax, [ebp - 0x33c]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00404b04
push dword [ebp - 0x33c]
push 0x442f20
lea eax, [ebp - 0x338]
mov edx, 3
call fcn.00404bdc
mov edx, dword [ebp - 0x338]
lea eax, [ebp - 0x2cc]
call fcn.00404e58
call fcn.00403624
lea eax, [ebp - 0x344]
mov edx, 0x4bd954
mov ecx, 9
call fcn.00404b04
mov ecx, dword [ebp - 0x344]
lea eax, [ebp - 0x340]
mov edx, 0x442f68
call fcn.00404b68
mov edx, dword [ebp - 0x340]
lea eax, [ebp - 0x2cc]
call fcn.00404e58
call fcn.00403624
lea eax, [ebp - 0x2cc]
call fcn.00402d90
call fcn.00402634
test eax, eax
jne 0x442ecc
mov ebx, 0x44
lea eax, [ebp - 0x310]
mov edx, ebx
call fcn.004066e4
mov dword [ebp - 0x310], ebx
mov dword [ebp - 0x2e4], 1
mov word [ebp - 0x2e0], 0
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x310]
push eax
push 0x442f70
push 0
push 0x44
push 0
push 0
push 0
push 0x4bd954
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x442ecc
push 0xfffffffffffffff1
mov eax, dword [ebp - 0x31c]
push eax
call sub.kernel32.dll_SetThreadPriority
push 0xf
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
push 0x80
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
mov eax, dword [ebp - 0x320]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x31c]
push eax
call sub.kernel32.dll_ResumeThread
mov eax, dword [ebp - 0x31c]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442ef1
lea eax, [ebp - 0x344]
mov edx, 9
call fcn.004048c0
ret