Function at 0x4682ec
Capabilities:
Create process on windows
Self delete
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404490
lea eax, [ebp - 0x164]
mov edx, dword [0x406f10]
call fcn.0040494c
xor eax, eax
push ebp
push 0x46875b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x168]
push eax
mov eax, dword [ebp - 4]
call fcn.004042a0
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 4]
call fcn.00404500
mov eax, dword [ebp - 0x168]
mov edx, 0x468770
call fcn.004043ec
je 0x468389
lea eax, [ebp - 8]
mov ecx, 0x468770
mov edx, dword [ebp - 4]
call fcn.004042ec
jmp 0x468394
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404078
lea eax, [ebp - 0x16c]
mov ecx, 0x46877c
mov edx, dword [ebp - 8]
call fcn.004042ec
mov eax, dword [ebp - 0x16c]
lea ecx, [ebp - 0x164]
mov edx, 0x3f
call fcn.00408480
test eax, eax
jne 0x4686e7
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x158]
call fcn.00407e00
mov eax, dword [ebp - 0xc]
mov edx, 0x468788
call fcn.004043ec
je 0x4686c9
mov eax, dword [ebp - 0xc]
mov edx, 0x468794
call fcn.004043ec
je 0x4686c9
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x158]
mov edx, dword [ebp - 8]
call fcn.004042ec
mov ebx, dword [ebp - 0x15c]
cmp ebx, 0x10
jl 0x46841e
cmp ebx, 0x1f
jle 0x4684dd
cmp ebx, 0x30
je 0x4684dd
cmp ebx, 0x31
je 0x4684dd
cmp ebx, 0x32
je 0x4684dd
cmp ebx, 0x810
je 0x4684dd
cmp ebx, 0x812
je 0x4684dd
cmp ebx, 0x830
je 0x4684dd
cmp ebx, 0x832
je 0x4684dd
cmp ebx, 0x2010
je 0x4684dd
cmp ebx, 0x2012
je 0x4684dd
cmp ebx, 0x2030
je 0x4684dd
cmp ebx, 0x2032
je 0x4684dd
cmp ebx, 0x2810
je 0x4684dd
cmp ebx, 0x2812
je 0x4684dd
cmp ebx, 0x2830
je 0x4684dd
cmp ebx, 0x2832
je 0x4684dd
cmp ebx, 0x4010
je 0x4684dd
cmp ebx, 0x4012
je 0x4684dd
cmp ebx, 0x4030
je 0x4684dd
cmp ebx, 0x4032
je 0x4684dd
cmp ebx, 0x6030
je 0x4684dd
cmp ebx, 0x6032
je 0x4684dd
cmp ebx, 0x12f7a8
jne 0x46850e
mov eax, dword [ebp - 0x158]
mov edx, 0x468788
call fcn.004043ec
je 0x46850e
mov eax, dword [ebp - 0x158]
mov edx, 0x468794
call fcn.004043ec
je 0x46850e
mov eax, dword [ebp - 0xc]
call fcn.004682ec
jmp 0x4686c9
mov ebx, dword [ebp - 0x15c]
cmp ebx, 1
jl 0x468522
cmp ebx, 0xf
jle 0x4685fe
mov esi, dword [ebp - 0x15c]
cmp esi, 0x20
jl 0x468536
cmp esi, 0x28
jl 0x4685fe
cmp dword [ebp - 0x15c], 0x80
je 0x4685fe
cmp dword [ebp - 0x15c], 0x801
je 0x4685fe
cmp dword [ebp - 0x15c], 0x820
je 0x4685fe
cmp dword [ebp - 0x15c], 0x823
je 0x4685fe
cmp dword [ebp - 0x15c], 0x826
je 0x4685fe
cmp dword [ebp - 0x15c], 0x2000
je 0x4685fe
cmp dword [ebp - 0x15c], 0x2001
je 0x4685fe
cmp dword [ebp - 0x15c], 0x2003
je 0x4685fe
cmp dword [ebp - 0x15c], 0x2020
je 0x4685fe
cmp dword [ebp - 0x15c], 0x2023
je 0x4685fe
cmp dword [ebp - 0x15c], 0x2801
je 0x4685fe
cmp dword [ebp - 0x15c], 0x3126
je 0x4685fe
cmp dword [ebp - 0x15c], 0x4020
je 0x4685fe
cmp dword [ebp - 0x15c], 0x4023
je 0x4685fe
cmp dword [ebp - 0x15c], 0x6001
jne 0x4686c9
mov eax, dword [ebp - 0x158]
mov edx, 0x468788
call fcn.004043ec
je 0x4686c9
mov eax, dword [ebp - 0x158]
mov edx, 0x468794
call fcn.004043ec
je 0x4686c9
mov eax, dword [0x46b9a0]
mov eax, dword [eax]
call fcn.0045224c
call fcn.00467ddc
dec eax
jne 0x468669
lea eax, [ebp - 0x170]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4687a0
call fcn.004042ec
mov edx, dword [ebp - 0x170]
mov eax, dword [0x46cc30]
mov eax, dword [eax + 0x330]
call fcn.00432da0
jmp 0x468692
lea eax, [ebp - 0x174]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4687b4
call fcn.004042ec
mov edx, dword [ebp - 0x174]
mov eax, dword [0x46cc30]
mov eax, dword [eax + 0x330]
call fcn.00432da0
inc dword [0x46b6e0]
mov eax, dword [0x46cc30]
mov eax, dword [eax + 0x334]
mov edx, dword [0x46b6e0]
call fcn.0042a460
push 0x80
mov eax, dword [ebp - 0xc]
call fcn.004044a0
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 0xc]
call fcn.00408510
lea eax, [ebp - 0x164]
call fcn.004084d0
test eax, eax
je 0x4683c5
lea eax, [ebp - 0x164]
call fcn.004084f4
mov eax, dword [ebp - 8]
call fcn.0040870c
push 0
push 0x4687c4
push dword [ebp - 8]
push 0x4687e8
lea eax, [ebp - 0x178]
mov edx, 3
call fcn.00404360
mov eax, dword [ebp - 0x178]
call fcn.004044a0
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468762
lea eax, [ebp - 0x178]
mov edx, 5
call fcn.00404004
lea eax, [ebp - 0x164]
mov edx, dword [0x406f10]
call fcn.00404a1c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404004
ret