Function at 0x435f34
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffce0
mov edi, dword [0x4be784]
mov dl, 0x2e
mov ax, 0x12
call fcn.0048841c
test eax, eax
je 0x436826
mov edx, dword [0x4beaa8]
mov edx, dword [edx]
lea eax, [esp + 0x48]
call fcn.00402bec
lea eax, [esp + 0x48]
call fcn.0040297c
call fcn.00402634
test eax, eax
je 0x435f90
mov edx, dword [0x4beaa8]
mov edx, dword [edx]
mov ax, 3
call fcn.004acdac
jmp 0x436826
mov eax, dword [0x4be7ec]
movsx eax, byte [eax]
mov edx, dword [0x4be754]
mov eax, dword [edx + eax*4 - 4]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x38], eax
mov eax, dword [0x4be7ec]
movsx eax, byte [eax + 1]
mov edx, dword [0x4be754]
mov eax, dword [edx + eax*4 - 4]
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x3c], ebx
mov eax, dword [esp + 0x38]
mov edx, dword [eax + 0x1a0]
call dword [edx + 0x10]
mov eax, ebx
mov edx, dword [eax + 0x1a0]
call dword [edx + 0x10]
mov eax, dword [0x4be594]
mov edx, dword [eax]
mov dword [esp + 8], edx
mov edx, dword [eax + 4]
mov dword [esp + 0xc], edx
mov eax, dword [0x4be594]
mov edx, dword [eax + 8]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x14], edx
fild qword [esp + 8]
mov eax, dword [0x4bee10]
fild qword [eax]
faddp st(1)
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004af438
call fcn.004b8144
mov byte [esp + 0x34], al
fild qword [esp + 0x10]
mov eax, dword [0x4bee10]
fild qword [eax]
faddp st(1)
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004af438
call fcn.004b8144
mov byte [esp + 0x35], al
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov ax, 0x65
call fcn.004aa600
mov edx, eax
lea eax, [esp + 0x48]
call fcn.004035b8
push eax
xor eax, eax
mov al, byte [edi + 0x18bc]
add ax, 0x15b
call fcn.004aa600
mov edx, eax
pop eax
call fcn.004035b8
call fcn.00403624
lea eax, [esp + 0x48]
call fcn.00403624
mov dword [esp + 0x28], 1
lea ebx, [esp + 0x38]
mov eax, dword [ebx]
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004b21b4
push eax
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x4c]
call fcn.0040357c
mov edx, 0x43683c
call fcn.00404e58
mov edx, dword [ebx]
mov edx, dword [edx + 0xc]
call fcn.004035b8
mov edx, 0x436848
call fcn.00404e58
pop edx
call fcn.004035b8
push eax
mov ax, 0x87
call fcn.004aa600
mov edx, eax
pop eax
call fcn.004035b8
call fcn.00403624
inc dword [esp + 0x28]
add ebx, 4
cmp dword [esp + 0x28], 3
jne 0x436095
xor eax, eax
mov al, byte [edi + 0x18be]
add ax, 0x10
call fcn.004aa600
mov edx, eax
mov eax, dword [0x4bedb0]
call fcn.004b81b0
mov eax, dword [0x4bedb0]
mov dl, 0x28
call fcn.004aec2c
mov eax, dword [0x4bedb0]
mov dl, 0x29
call fcn.004aec2c
lea eax, [esp + 0x314]
mov edx, dword [0x4be82c]
mov ecx, 7
call fcn.00403678
lea edx, [esp + 0x314]
lea eax, [esp + 0x48]
call fcn.00403584
mov edx, 0x436854
call fcn.00404e58
mov edx, dword [0x4bedb0]
call fcn.004035b8
call fcn.00403624
lea eax, [esp + 0x48]
call fcn.00403624
mov eax, dword [esp + 0x38]
mov eax, dword [eax + 0xc]
call fcn.004aed10
push eax
mov ax, 0x1f3
call fcn.004aa600
pop edx
call fcn.004ae1b0
mov eax, dword [esp + 0x3c]
mov eax, dword [eax + 0xc]
call fcn.004aed10
mov edx, eax
mov eax, dword [0x4bedb0]
call fcn.004ae1b0
mov edx, dword [0x4bedb0]
mov eax, dword [0x4bec98]
mov cx, 0x4b
call fcn.004b81d8
mov eax, dword [0x4bec98]
xor edx, edx
call fcn.004ad8ec
mov eax, 0xe000
call fcn.00402504
mov esi, eax
mov eax, 0xe000
call fcn.00402504
mov dword [esp + 0x40], eax
mov eax, dword [0x4bee10]
fild qword [eax]
fsub dword [0x436858]
fdiv dword [0x43685c]
call fcn.004028f4
inc eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
test eax, eax
jle 0x43658c
mov dword [esp + 0x44], eax
mov dword [esp + 0x28], 1
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x2c]
jge 0x43624c
mov ebx, 0xe000
jmp 0x43626f
mov eax, dword [0x4bee10]
fild qword [eax]
fsub dword [0x436858]
add esp, 0xfffffff8
fistp qword [esp]
wait
push 0
push 0xe000
call fcn.004af060
mov ebx, eax
inc ebx
push ebx
lea edx, [esp + 0xc]
mov eax, dword [esp + 0x3c]
mov ecx, esi
mov ebp, dword [eax + 0x1a0]
call dword [ebp + 0x18]
mov dword [esp + 0x30], eax
push ebx
lea edx, [esp + 0x14]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov ebp, dword [eax + 0x1a0]
call dword [ebp + 0x18]
cmp ebx, dword [esp + 0x30]
jg 0x43658c
cmp ebx, eax
jg 0x43658c
cmp eax, dword [esp + 0x30]
jge 0x4362b9
mov dword [esp + 0x30], eax
mov bp, word [esp + 0x30]
test bp, bp
jbe 0x43653a
mov bx, 1
fild qword [esp + 0x18]
mov eax, dword [0x4be594]
fild qword [eax]
fsubp st(1)
mov eax, dword [0x4bee10]
fild qword [eax]
fcompp
fnstsw ax
sahf
je 0x436599
fild qword [esp + 0x20]
mov eax, dword [0x4be594]
fild qword [eax + 8]
fsubp st(1)
mov eax, dword [0x4bee10]
fild qword [eax]
fcompp
fnstsw ax
sahf
je 0x436599
cmp byte [edi + 0x18bc], 0
je 0x436327
movzx eax, bx
mov al, byte [esi + eax - 1]
movzx edx, bx
mov ecx, dword [esp + 0x40]
cmp al, byte [ecx + edx - 1]
jne 0x43634c
cmp byte [edi + 0x18bc], 0
jne 0x436464
movzx eax, bx
mov al, byte [esi + eax - 1]
movzx edx, bx
mov ecx, dword [esp + 0x40]
cmp al, byte [ecx + edx - 1]
jne 0x436464
fild qword [esp]
fadd dword [0x436858]
fistp qword [esp]
wait
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.004af438
mov edx, eax
xor ecx, ecx
mov cl, byte [esp + 0x34]
lea eax, [esp + 0x48]
call fcn.004035c0
call fcn.00402ca8
mov eax, dword [0x4be594]
fild qword [eax]
mov eax, dword [0x4be594]
fild qword [eax + 8]
fcompp
fnstsw ax
sahf
je 0x4363bc
push dword [esp + 0x24]
push dword [esp + 0x24]
call fcn.004af438
push eax
mov dl, 0x2f
lea eax, [esp + 0x4c]
call fcn.00403500
xor ecx, ecx
mov cl, byte [esp + 0x39]
pop edx
call fcn.004035c0
call fcn.00402ca8
movzx eax, bx
movzx eax, byte [esi + eax - 1]
mov dword [esp + 0x31c], eax
fild dword [esp + 0x31c]
add esp, 0xfffffff8
fistp qword [esp]
wait
mov dl, 2
xor eax, eax
call fcn.004af0b0
push eax
mov edx, 0x436868
lea eax, [esp + 0x4c]
call fcn.00404e58
pop edx
call fcn.004035b8
call fcn.00402ca8
cmp byte [edi + 0x18bc], 0
je 0x436446
movzx eax, bx
mov edx, dword [esp + 0x40]
movzx eax, byte [edx + eax - 1]
mov dword [esp + 0x31c], eax
fild dword [esp + 0x31c]
add esp, 0xfffffff8
fistp qword [esp]
wait
mov dl, 2
xor eax, eax
call fcn.004af0b0
push eax
mov dl, 9
lea eax, [esp + 0x4c]
call fcn.00403500
pop edx
call fcn.004035b8
call fcn.00402ca8
lea eax, [esp + 0x48]
call fcn.00403624
movzx eax, bx
mov ecx, 0x3e8
xor edx, edx
div ecx
test edx, edx
jne 0x436464
call fcn.004ae0a4
call fcn.00402634
test eax, eax
je 0x436483
mov edx, dword [0x4beaa8]
mov edx, dword [edx]
mov ax, 5
call fcn.004acdac
jmp 0x436599
mov eax, dword [0x4bed48]
cmp byte [eax], 0
jne 0x4364bf
cmp byte [edi + 0x18b5], 0
je 0x436512
movzx eax, word [edi + 0x1870]
mov dword [esp + 0x31c], eax
fild dword [esp + 0x31c]
fild qword [esp]
fcompp
fnstsw ax
sahf
jb 0x436512
cmp word [edi + 0x1870], 0
jbe 0x436512
lea eax, [esp + 0x48]
call fcn.00403624
mov ax, 0x1c3
call fcn.004aa600
mov edx, eax
lea eax, [esp + 0x48]
call fcn.004035b8
mov dl, 0x20
call fcn.00403500
push eax
mov eax, dword [0x4bed48]
mov al, byte [eax]
xor al, 1
and eax, 0x7f
add ax, 0x1c4
call fcn.004aa600
mov edx, eax
pop eax
call fcn.004035b8
mov dl, 0x2e
call fcn.00403500
call fcn.00403624
jmp 0x436599
fild qword [esp + 0x18]
fadd dword [0x436858]
fistp qword [esp + 0x18]
wait
fild qword [esp + 0x20]
fadd dword [0x436858]
fistp qword [esp + 0x20]
wait
inc ebx
dec bp
jne 0x4362cb
call fcn.004ae0a4
fild qword [esp + 0x18]
mov eax, dword [0x4be594]
fild qword [eax]
fsubp st(1)
mov eax, dword [0x4bee10]
fild qword [eax]
fdivp st(1)
fmul dword [0x43686c]
call fcn.004028e8
mov edx, dword [0x4be344]
mov byte [edx], al
mov eax, dword [0x4be344]
mov al, byte [eax]
mov edx, dword [0x4be8d0]
cmp al, byte [edx]
je 0x43657e
call fcn.004b5c48
inc dword [esp + 0x28]
dec dword [esp + 0x44]
jne 0x43621b
mov eax, dword [0x4be344]
mov byte [eax], 0x64
call fcn.004b5c48
lea eax, [esp + 0x48]
call fcn.00403624
fild qword [esp]
fcomp dword [0x436870]
fnstsw ax
sahf
jbe 0x436647
push dword [esp + 4]
push dword [esp + 4]
call fcn.004b21b4
mov edx, eax
lea eax, [esp + 0x214]
call fcn.004b81b0
push 0x436874
lea eax, [esp + 0x218]
push eax
call sub.kernel32.dll_lstrcatA
xor eax, eax
mov al, byte [edi + 0x18bc]
add eax, eax
add ax, 0x157
add ax, 2
dec eax
call fcn.004aa600
push eax
lea eax, [esp + 0x218]
push eax
call sub.kernel32.dll_lstrcatA
mov ax, 0x66
call fcn.004aa600
push eax
lea eax, [esp + 0x218]
push eax
call sub.kernel32.dll_lstrcatA
push 0x436874
lea eax, [esp + 0x218]
push eax
call sub.kernel32.dll_lstrcatA
lea edx, [esp + 0x214]
lea eax, [esp + 0x48]
call fcn.004035b8
call fcn.00402ca8
jmp 0x43664f
mov byte [esp + 0x214], 0
call fcn.00402634
test eax, eax
mov eax, dword [esp + 0x38]
mov edx, dword [eax + 0x1a0]
call dword [edx + 0x14]
mov eax, dword [esp + 0x3c]
mov edx, dword [eax + 0x1a0]
call dword [edx + 0x14]
lea eax, [esp + 0x48]
call fcn.00402d90
mov eax, esi
call fcn.00402524
mov eax, dword [esp + 0x40]
call fcn.00402524
call fcn.004adbe0
fild qword [esp]
fcomp dword [0x436870]
fnstsw ax
sahf
jbe 0x4367a5
lea eax, [edi + 0x500]
call fcn.004aed10
push eax
mov ax, 0x67
call fcn.004aa600
pop edx
call fcn.004ae1b0
mov eax, dword [0x4bedb0]
push eax
lea eax, [esp + 0x218]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 0x214]
mov edx, 0x14
call fcn.004b12a8
cmp al, 1
jne 0x436747
lea edx, [edi + 0x500]
mov eax, dword [0x4bedb0]
call fcn.004b81b0
push 0x436878
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4beaa8]
mov eax, dword [eax]
push eax
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
push 0x43687c
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
push 3
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jae 0x436747
lea edx, [edi + 0x500]
mov ax, 7
call fcn.004acdac
mov eax, 0xfa
call fcn.004ae058
mov eax, dword [0x4bef84]
mov byte [eax], 1
mov ax, 0x68
call fcn.004aa600
mov edx, 0x14
call fcn.004b12a8
cmp al, 1
jne 0x436826
mov eax, dword [0x4beaa8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_DeleteFileA_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x436826
mov edx, dword [0x4beaa8]
mov edx, dword [edx]
mov ax, 4
call fcn.004acdac
jmp 0x436826
lea eax, [esp + 0x48]
call fcn.00402f6c
mov al, byte [edi + 0x18bc]
xor al, 1
and eax, 0x7f
add ax, 0x1c6
call fcn.004aa600
mov edx, eax
mov eax, dword [0x4bedb0]
call fcn.004b81b0
cmp byte [edi + 0x18bc], 0
je 0x436817
mov eax, dword [esp + 0x38]
fild qword [eax + 0x10]
mov eax, dword [esp + 0x3c]
fild qword [eax + 0x10]
fcompp
fnstsw ax
sahf
je 0x436817
mov eax, dword [0x4be594]
fild qword [eax]
mov eax, dword [0x4be594]
fild qword [eax + 8]
fcompp
fnstsw ax
sahf
jne 0x436817
mov ax, 0x1c8
call fcn.004aa600
push eax
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4bedb0]
mov edx, 4
call fcn.004b12a8
add esp, 0x320
pop ebp
pop edi
pop esi
pop ebx
ret