Function at 0x405de0
Capabilities:
Create process on windows
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3cc
push ebx
push esi
push edi
lea edi, [ebp - 0x3cc]
mov ecx, 0xf3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x478b40]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
mov dword [ebp - 0x3cc], ecx
mov edx, dword [ebp - 0x3cc]
sub edx, 4
mov dword [ebp - 0x3cc], edx
cmp dword [ebp - 0x3cc], 0xdb
ja case.0x405e47.1
mov eax, dword [ebp - 0x3cc]
movzx ecx, byte [eax + 0x406154]
jmp dword [ecx*4 + 0x406120]
call fcn.00401122
call fcn.0040109b
jmp case.0x405e47.1
call fcn.0040109b
jmp case.0x405e47.1
mov eax, dword [section..data]
push eax
call fcn.004011b3
add esp, 4
jmp case.0x405e47.1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 1]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
push eax
call fcn.004010cd
add esp, 4
mov dword [ebp - 0x24], eax
push 5
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.0040b300
add esp, 0xc
push 4
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x34]
push ecx
call fcn.0040cc60
add esp, 0xc
push 0
push 3
push 4
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [section..data]
push ecx
call fcn.00401212
jmp case.0x405e47.1
mov eax, dword [ebp + 8]
add eax, 1
push eax
push 0x463e40
push 0x479fb0
call fcn.0040acc0
add esp, 0xc
push 0x479fb0
mov eax, dword [section..data]
push eax
call fcn.00401028
add esp, 8
jmp case.0x405e47.1
mov eax, dword [section..data]
push eax
call fcn.0040105a
jmp case.0x405e47.1
mov eax, dword [ebp + 8]
add eax, 1
push eax
push 0x463e40
push 0x479fb0
call fcn.0040acc0
add esp, 0xc
push 0x479fb0
mov eax, dword [section..data]
push eax
call fcn.004010dc
jmp case.0x405e47.1
push 0
push 0
push 0xb8
lea eax, [ebp - 0xf4]
push eax
mov ecx, dword [section..data]
push ecx
call fcn.004011f4
sub esp, 0xb8
mov ecx, 0x2e
lea esi, [ebp - 0xf4]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov eax, dword [section..data]
push eax
call fcn.0040118b
jmp case.0x405e47.1
mov eax, dword [ebp + 8]
add eax, 1
push eax
push 0x463e40
push 0x479fb0
call fcn.0040acc0
add esp, 0xc
mov esi, esp
push 0
push 0
push 0
push 0x401186
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.0040b060
jmp case.0x405e47.1
push 0xff
push 0
lea eax, [ebp - 0x1fc]
push eax
call fcn.0040b300
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, 1
push eax
push 0x463e40
lea ecx, [ebp - 0x1fc]
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0x1fc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, esp
call fcn.0040b060
jmp case.0x405e47.1
push 0xff
push 0
lea eax, [ebp - 0x304]
push eax
call fcn.0040b300
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, 1
push eax
push 0x463e40
lea ecx, [ebp - 0x304]
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, esp
push 1
push 0
push 0
lea eax, [ebp - 0x304]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp esi, esp
call fcn.0040b060
jmp case.0x405e47.1
cmp dword [0x47a3b0], 0
jne case.0x405e47.1
mov esi, esp
push 0
push 0
push 0
push 0x40111d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.0040b060
mov eax, dword [ebp - 0xc]
push edx
mov ecx, ebp
push eax
lea edx, [0x4060b4]
call fcn.0040b090
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b050
add esp, 0x3cc
cmp ebp, esp
call fcn.0040b060
mov esp, ebp
pop ebp
ret