Function at 0x4162f4
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x4162fc
push ecx
push ebx
push esi
push edi
mov eax, 0x414f88
call fcn.004061dc
xor eax, eax
push ebp
push 0x4167c4
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00403190
test eax, eax
jne 0x4163c2
push 0x104
push 0x41ca28
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, 0x41ca24
mov edx, 0x41ca28
mov ecx, 0x105
call fcn.0040491c
lea eax, [ebp - 0x14]
mov ecx, 0x4167dc
mov edx, dword [0x41ca24]
call fcn.004049a0
mov eax, dword [ebp - 0x14]
call fcn.00407958
test al, al
jne 0x416393
push 5
lea eax, [ebp - 0x18]
mov ecx, 0x41680c
mov edx, dword [0x41ca24]
call fcn.004049a0
mov eax, dword [ebp - 0x18]
call fcn.00404b18
push eax
call sub.kernel32.dll_WinExec
jmp 0x4163b6
push 5
lea eax, [ebp - 0x1c]
mov ecx, 0x4167dc
mov edx, dword [0x41ca24]
call fcn.004049a0
mov eax, dword [ebp - 0x1c]
call fcn.00404b18
push eax
call sub.kernel32.dll_WinExec
push 0
call sub.user32.dll_PostQuitMessage
jmp 0x4167a2
xor edx, edx
push ebp
push 0x41678a
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x20]
mov eax, 0x41682c
call fcn.00414c78
mov edx, dword [ebp - 0x20]
mov eax, 0x41ca0c
call main
lea edx, [ebp - 0x24]
mov eax, 0x41685c
call fcn.00414c78
mov edx, dword [ebp - 0x24]
mov eax, 0x41ca10
call main
lea edx, [ebp - 0x28]
mov eax, 0x416890
call fcn.00414c78
mov edx, dword [ebp - 0x28]
mov eax, 0x41ca14
call main
call fcn.004031f0
mov eax, 3
call fcn.00403218
lea edx, [ebp - 0x2c]
call fcn.0040754c
mov eax, dword [ebp - 0x2c]
call fcn.00407688
inc eax
dec eax
je 0x416449
dec eax
je 0x41646a
dec eax
je 0x41648b
jmp 0x4164aa
mov eax, 0x41ca08
mov edx, dword [0x41ca0c]
call main
mov eax, 0x41ca00
mov edx, 0x41682c
call main
jmp 0x4164aa
mov eax, 0x41ca08
mov edx, dword [0x41ca10]
call main
mov eax, 0x41ca00
mov edx, 0x41685c
call main
jmp 0x4164aa
mov eax, 0x41ca08
mov edx, dword [0x41ca14]
call main
mov edx, 0x416890
mov eax, 0x41ca00
call main
call fcn.004031f0
mov eax, 2
call fcn.00403218
lea edx, [ebp - 0x30]
call fcn.0040754c
mov eax, dword [ebp - 0x30]
call fcn.00407688
inc eax
dec eax
je 0x4164d2
dec eax
je 0x4164e3
jmp 0x4164f2
mov eax, 0x41ca20
mov edx, 0x4168c4
call main
jmp 0x4164f2
mov eax, 0x41ca20
mov edx, 0x4168d8
call main
mov dl, 1
mov eax, dword [0x413774]
call fcn.00413874
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.00413914
mov cl, 1
mov edx, 0x4168ec
mov eax, ebx
call fcn.00413978
lea ecx, [ebp - 0x34]
xor edx, edx
mov eax, ebx
call fcn.00413b44
cmp dword [ebp - 0x34], 0
jne 0x41653d
mov ecx, dword [0x41ca00]
xor edx, edx
mov eax, ebx
call fcn.00413b14
jmp 0x416561
lea ecx, [ebp - 0x3c]
xor edx, edx
mov eax, ebx
call fcn.00413b44
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.00414c78
mov edx, dword [ebp - 0x38]
mov eax, 0x41ca08
call main
lea edx, [ebp - 0x40]
mov eax, 0x416914
call fcn.0040c27c
mov edx, dword [ebp - 0x40]
mov eax, 0x41ca1c
call main
mov eax, dword [0x41ca1c]
test eax, eax
je 0x416589
sub eax, 4
mov eax, dword [eax]
cmp eax, 3
jle 0x41659d
mov eax, 0x41ca1c
mov edx, 0x416928
call fcn.00404954
lea eax, [ebp - 0x44]
mov ecx, 0x41696c
mov edx, dword [0x41ca1c]
call fcn.004049a0
mov eax, dword [ebp - 0x44]
call fcn.00404b18
push eax
call sub.kernel32.dll_DeleteFileA
push 0x416998
lea eax, [ebp - 0x48]
mov ecx, 0x41696c
mov edx, dword [0x41ca1c]
call fcn.004049a0
mov ecx, dword [ebp - 0x48]
mov edx, dword [0x41ca08]
mov eax, 0x4169c4
call fcn.00414d68
mov edx, 0x80000000
mov eax, ebx
call fcn.00413914
mov cl, 1
mov edx, 0x4169fc
mov eax, ebx
call fcn.00413978
lea eax, [ebp - 0x4c]
mov ecx, dword [0x41ca08]
mov edx, 0x416a50
call fcn.004049a0
mov ecx, dword [ebp - 0x4c]
xor edx, edx
mov eax, ebx
call fcn.00413b14
mov eax, ebx
call fcn.004138e4
mov edx, 0x80000001
mov eax, ebx
call fcn.00413914
mov cl, 1
mov edx, 0x416a8c
mov eax, ebx
call fcn.00413978
mov ecx, 0x416ac8
mov edx, 0x416af8
mov eax, ebx
call fcn.00413b14
mov eax, ebx
call fcn.004138e4
mov edx, 0x80000001
mov eax, ebx
call fcn.00413914
mov cl, 1
mov edx, 0x416b10
mov eax, ebx
call fcn.00413978
mov ecx, 0x416b74
mov edx, 0x416b84
mov eax, ebx
call fcn.00413b14
push 0x416b98
push dword [0x41ca20]
push 0x416bcc
lea eax, [ebp - 0x50]
mov edx, 3
call fcn.00404a1c
mov ecx, dword [ebp - 0x50]
mov edx, 0x416be4
mov eax, ebx
call fcn.00413b14
mov eax, 0xfde9
mov ecx, eax
mov edx, 0x416bf0
mov eax, ebx
call fcn.00413bbc
mov eax, ebx
call fcn.004138e4
mov edx, 0x80000001
mov eax, ebx
call fcn.00413914
mov cl, 1
mov edx, 0x416c04
mov eax, ebx
call fcn.00413978
lea ecx, [ebp - 0x54]
mov edx, 0x416c38
mov eax, ebx
call fcn.00413b44
mov edx, dword [ebp - 0x54]
mov eax, 0x41ca18
call main
mov eax, ebx
call fcn.004138e4
mov eax, dword [0x41ca18]
mov edx, dword [0x41ca0c]
call fcn.00404ab0
jne 0x41673f
mov eax, dword [0x41ca18]
mov edx, dword [0x41ca10]
call fcn.00404ab0
jne 0x41673f
mov eax, dword [0x41ca18]
mov edx, dword [0x41ca14]
call fcn.00404ab0
je 0x416772
mov edx, 0x80000001
mov eax, ebx
call fcn.00413914
mov cl, 1
mov edx, 0x416c04
mov eax, ebx
call fcn.00413978
mov ecx, dword [0x41ca08]
mov edx, 0x416c38
mov eax, ebx
call fcn.00413b14
mov eax, ebx
call fcn.004138e4
mov eax, ebx
call fcn.00403974
push 0
call sub.user32.dll_PostQuitMessage
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41679b
push 0
call sub.user32.dll_PostQuitMessage
push 0
call sub.user32.dll_PostQuitMessage
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4167cb
lea eax, [ebp - 0x54]
mov edx, 0x11
call fcn.004046d0
ret