Function at 0x404440
Capabilities:
Create process on windows
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x89c
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0xffffffff
push 5
push 4
call fcn.00407150
add esp, 8
push 0
push 1
call fcn.00407130
add esp, 8
test eax, eax
jne 0x40493f
call fcn.00405570
test eax, eax
je 0x40493f
push 0x14
push 2
call fcn.00407150
add esp, 8
push 6
push 4
call fcn.00407150
add esp, 8
push 0
push 1
call fcn.00407130
add esp, 8
test eax, eax
jne 0x40487e
push 0
push 0x405bf0
push 0
push 0x65
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 1
jne 0x40487e
mov ecx, dword [0x41712c]
push ecx
push 0
call fcn.00404b30
add esp, 4
push eax
call fcn.00403440
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x404612
push 0x28
push 2
call fcn.00407150
add esp, 8
push 7
push 4
call fcn.00407150
add esp, 8
push 0
push 1
call fcn.00407130
add esp, 8
test eax, eax
jne 0x40455b
mov edx, dword [ebp + 8]
push edx
push 0
call fcn.00404ca0
add esp, 4
push eax
push 0
call fcn.00404b30
add esp, 4
push eax
call fcn.00405d80
add esp, 0xc
test eax, eax
je 0x40455b
push 0x64
push 2
call fcn.00407150
add esp, 8
mov dword [ebp - 8], 1
jmp 0x40460d
mov dword [ebp - 0x880], 0
mov eax, 0x11111111
and eax, 1
je 0x404580
push 0
push 8
call fcn.00404200
mov dword [ebp - 0x884], eax
jmp 0x40458a
mov dword [ebp - 0x884], 8
mov ecx, 0x11111111
and ecx, 0x10
je 0x4045a5
push 0
push 2
call fcn.00404200
mov dword [ebp - 0x87c], eax
jmp 0x4045af
mov dword [ebp - 0x87c], 2
push 0x30
mov edx, dword [ebp - 0x87c]
push edx
mov eax, dword [ebp - 0x884]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x880], eax
mov ecx, 0x11111111
and ecx, 1
je 0x4045ed
cmp dword [ebp - 0x884], 0
je 0x4045ed
mov edx, dword [ebp - 0x884]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 0x11111111
and eax, 0x10
je 0x40460d
cmp dword [ebp - 0x87c], 0
je 0x40460d
mov ecx, dword [ebp - 0x87c]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x404877
cmp dword [ebp - 4], 1
jne 0x404877
mov dword [ebp - 4], 0xffffffff
cmp dword [0x417134], 0
je 0x404872
mov edx, dword [0x417168]
add edx, 1
mov dword [0x417168], edx
cmp dword [0x417168], 3
jb 0x404872
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x460], 0
mov dword [ebp - 0x454], 0xffffffff
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x474], 0
push 0x400
push 0
lea eax, [ebp - 0x450]
push eax
call fcn.004078c0
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x50]
push ecx
call fcn.004078c0
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x470], edx
mov dword [ebp - 0x46c], edx
mov dword [ebp - 0x468], edx
mov dword [ebp - 0x464], edx
mov dword [ebp - 0x50], 0x44
push 0
call fcn.00407320
add esp, 4
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0
je 0x4047da
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x460]
push eax
call dword [0x417140]
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0xffffffff
je 0x4047da
push 0
mov ecx, dword [0x417120]
push ecx
push 0
push 4
push 0
mov edx, dword [ebp - 0x454]
push edx
call dword [0x417148]
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0
je 0x4047cd
push 0
push 0
push 0
push 2
mov eax, dword [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
je 0x4047c0
cmp dword [0x417128], 0
je 0x4047b3
mov ecx, dword [0x417120]
push ecx
mov edx, dword [0x417128]
push edx
mov eax, dword [ebp - 0x474]
push eax
call fcn.00407940
add esp, 0xc
push 2
mov ecx, dword [ebp - 0x460]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [ebp - 0x458], 1
mov edx, dword [0x417128]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x474]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0x45c]
push ecx
call dword [0x417144]
mov edx, dword [ebp - 0x454]
push edx
call dword [0x417144]
cmp dword [ebp - 0x458], 0
je 0x404870
push 0x400
lea eax, [ebp - 0x450]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x450]
push ecx
push 0
call fcn.00407320
add esp, 4
push eax
push str.__s____s_
lea edx, [ebp - 0x878]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x470]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea edx, [ebp - 0x878]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x404856
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404822
mov eax, dword [ebp - 0x46c]
push eax
call dword [0x417144]
mov ecx, dword [ebp - 0x470]
push ecx
call dword [0x417144]
jmp 0x40487e
jmp 0x40449c
jmp 0x40487e
cmp dword [ebp - 4], 0xffffffff
jne 0x40493a
mov dword [ebp - 0x88c], 0
mov edx, 0x11111111
and edx, 1
je 0x4048ad
push 0
push 9
call fcn.00404200
mov dword [ebp - 0x890], eax
jmp 0x4048b7
mov dword [ebp - 0x890], 9
mov eax, 0x11111111
and eax, 0x10
je 0x4048d2
push 0
push 2
call fcn.00404200
mov dword [ebp - 0x888], eax
jmp 0x4048dc
mov dword [ebp - 0x888], 2
push 0x30
mov ecx, dword [ebp - 0x888]
push ecx
mov edx, dword [ebp - 0x890]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x88c], eax
mov eax, 0x11111111
and eax, 1
je 0x40491a
cmp dword [ebp - 0x890], 0
je 0x40491a
mov ecx, dword [ebp - 0x890]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, 0x11111111
and edx, 0x10
je 0x40493a
cmp dword [ebp - 0x888], 0
je 0x40493a
mov eax, dword [ebp - 0x888]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4049f1
mov dword [ebp - 0x898], 0
mov ecx, 0x11111111
and ecx, 1
je 0x404964
push 0
push 0xa
call fcn.00404200
mov dword [ebp - 0x89c], eax
jmp 0x40496e
mov dword [ebp - 0x89c], 0xa
mov edx, 0x11111111
and edx, 0x10
je 0x404989
push 0
push 2
call fcn.00404200
mov dword [ebp - 0x894], eax
jmp 0x404993
mov dword [ebp - 0x894], 2
push 0x30
mov eax, dword [ebp - 0x894]
push eax
mov ecx, dword [ebp - 0x89c]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x898], eax
mov edx, 0x11111111
and edx, 1
je 0x4049d1
cmp dword [ebp - 0x89c], 0
je 0x4049d1
mov eax, dword [ebp - 0x89c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, 0x11111111
and ecx, 0x10
je 0x4049f1
cmp dword [ebp - 0x894], 0
je 0x4049f1
mov edx, dword [ebp - 0x894]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push 0
call fcn.00407150
add esp, 8
push 0
call fcn.00404b30
add esp, 4
test eax, eax
je 0x404a26
push 0
call fcn.00404b30
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
call fcn.00404b30
add esp, 4
push 0
call fcn.00407320
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x404a50
push 0
push 0
call fcn.00407320
add esp, 4
push eax
call fcn.00407400
add esp, 8
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret