Function at 0x452c70
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffcec
mov edi, dword [0x48d550]
mov dl, 0x2b
mov ax, 0x12
call fcn.0042d52c
test eax, eax
je 0x4534e5
mov edx, dword [0x48d89c]
mov edx, dword [edx]
lea eax, [esp + 0x3c]
call fcn.00402ba4
lea eax, [esp + 0x3c]
call fcn.00402934
call fcn.004025ec
test eax, eax
je 0x452ccc
mov edx, dword [0x48d89c]
mov edx, dword [edx]
mov ax, 3
call fcn.0040de10
jmp 0x4534e5
mov eax, dword [0x48d5ac]
movsx eax, byte [eax]
mov edx, dword [0x48d524]
mov eax, dword [edx + eax*4 - 4]
add eax, 0xc
mov dword [esp + 0x30], eax
mov eax, dword [0x48d5ac]
movsx eax, byte [eax + 1]
mov edx, dword [0x48d524]
mov eax, dword [edx + eax*4 - 4]
lea ebx, [eax + 0xc]
mov dword [esp + 0x34], ebx
mov eax, dword [esp + 0x30]
call fcn.00428760
mov eax, ebx
call fcn.00428760
mov eax, dword [0x48d3bc]
mov edx, dword [eax]
mov dword [esp + 8], edx
mov edx, dword [eax + 4]
mov dword [esp + 0xc], edx
mov eax, dword [0x48d3bc]
mov edx, dword [eax + 8]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x14], edx
fild qword [esp + 8]
mov eax, dword [0x48da98]
fild qword [eax]
faddp st(1)
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.00410208
call fcn.00405bdc
mov byte [esp + 0x2c], al
fild qword [esp + 0x10]
mov eax, dword [0x48da98]
fild qword [eax]
faddp st(1)
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.00410208
call fcn.00405bdc
mov byte [esp + 0x2d], al
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov ax, 0x65
call fcn.0040bc04
mov edx, eax
lea eax, [esp + 0x3c]
call fcn.00403250
push eax
xor eax, eax
mov al, byte [edi + 0x18bc]
add ax, 0x15b
call fcn.0040bc04
mov edx, eax
pop eax
call fcn.00403250
call fcn.004032bc
lea eax, [esp + 0x3c]
call fcn.004032bc
mov bl, 1
lea esi, [esp + 0x30]
mov eax, dword [esi]
push dword [eax + 0x10]
push dword [eax + 0xc]
call fcn.00412e40
push eax
xor edx, edx
mov dl, bl
lea eax, [esp + 0x40]
call fcn.00403214
mov edx, 0x4534f8
call fcn.00404918
mov edx, dword [esi]
mov edx, dword [edx + 8]
call fcn.00403250
mov edx, 0x453504
call fcn.00404918
pop edx
call fcn.00403250
push eax
mov ax, 0x87
call fcn.0040bc04
mov edx, eax
pop eax
call fcn.00403250
call fcn.004032bc
inc ebx
add esi, 4
cmp bl, 3
jne 0x452dc3
xor eax, eax
mov al, byte [edi + 0x18be]
add ax, 0x10
call fcn.0040bc04
mov edx, eax
mov eax, dword [0x48da44]
call fcn.00405c48
mov eax, dword [0x48da44]
mov dl, 0x28
call fcn.0040fa38
mov eax, dword [0x48da44]
mov dl, 0x29
call fcn.0040fa38
lea eax, [esp + 0x308]
mov edx, dword [0x48d5e0]
mov ecx, 7
call fcn.00403310
lea edx, [esp + 0x308]
lea eax, [esp + 0x3c]
call fcn.0040321c
mov edx, 0x453510
call fcn.00404918
mov edx, dword [0x48da44]
call fcn.00403250
call fcn.004032bc
lea eax, [esp + 0x3c]
call fcn.004032bc
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 8]
call fcn.0040fb28
push eax
mov ax, 0x1f3
call fcn.0040bc04
pop edx
call fcn.0040f5a0
mov eax, dword [esp + 0x34]
mov eax, dword [eax + 8]
call fcn.0040fb28
mov edx, eax
mov eax, dword [0x48da44]
call fcn.0040f5a0
mov edx, dword [0x48da44]
mov eax, dword [0x48d948]
mov cx, 0x4b
call fcn.00405c70
mov eax, dword [0x48d948]
xor edx, edx
call fcn.0040e810
mov eax, 0xe000
call fcn.004024e8
mov esi, eax
mov eax, 0xe000
call fcn.004024e8
mov ebp, eax
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov eax, dword [0x48d5f4]
mov byte [eax], 1
push 0xe000
lea edx, [esp + 0xc]
mov eax, dword [esp + 0x34]
mov ecx, esi
call fcn.004254a8
mov dword [esp + 0x28], eax
mov eax, dword [0x48d5f4]
mov byte [eax], 1
push 0xe000
lea edx, [esp + 0x14]
mov eax, dword [esp + 0x38]
mov ecx, ebp
call fcn.004254a8
cmp dword [esp + 0x28], 0xffffffff
je 0x453255
cmp eax, 0xffffffff
je 0x453255
cmp eax, dword [esp + 0x28]
jge 0x452f87
mov dword [esp + 0x28], eax
mov ax, word [esp + 0x28]
test ax, ax
jbe 0x453203
mov word [esp + 0x38], ax
mov bx, 1
fild qword [esp + 0x18]
mov eax, dword [0x48d3bc]
fild qword [eax]
fsubp st(1)
mov eax, dword [0x48da98]
fild qword [eax]
fcompp
fnstsw ax
sahf
je 0x453262
fild qword [esp + 0x20]
mov eax, dword [0x48d3bc]
fild qword [eax + 8]
fsubp st(1)
mov eax, dword [0x48da98]
fild qword [eax]
fcompp
fnstsw ax
sahf
je 0x453262
cmp byte [edi + 0x18bc], 0
je 0x452ff6
movzx eax, bx
mov al, byte [esi + eax - 1]
movzx edx, bx
cmp al, byte [ebp + edx - 1]
jne 0x453017
cmp byte [edi + 0x18bc], 0
jne 0x45312b
movzx eax, bx
mov al, byte [esi + eax - 1]
movzx edx, bx
cmp al, byte [ebp + edx - 1]
jne 0x45312b
fild qword [esp]
fadd dword [0x453514]
fistp qword [esp]
wait
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.00410208
mov edx, eax
xor ecx, ecx
mov cl, byte [esp + 0x2c]
lea eax, [esp + 0x3c]
call fcn.00403258
call fcn.00402c54
mov eax, dword [0x48d3bc]
fild qword [eax]
mov eax, dword [0x48d3bc]
fild qword [eax + 8]
fcompp
fnstsw ax
sahf
je 0x453087
push dword [esp + 0x24]
push dword [esp + 0x24]
call fcn.00410208
push eax
mov dl, 0x2f
lea eax, [esp + 0x40]
call fcn.00403198
xor ecx, ecx
mov cl, byte [esp + 0x31]
pop edx
call fcn.00403258
call fcn.00402c54
movzx eax, bx
movzx eax, byte [esi + eax - 1]
mov dword [esp + 0x310], eax
fild dword [esp + 0x310]
add esp, 0xfffffff8
fistp qword [esp]
wait
mov dl, 2
xor eax, eax
call fcn.0040fe88
push eax
mov edx, 0x453520
lea eax, [esp + 0x40]
call fcn.00404918
pop edx
call fcn.00403250
call fcn.00402c54
cmp byte [edi + 0x18bc], 0
je 0x45310d
movzx eax, bx
movzx eax, byte [ebp + eax - 1]
mov dword [esp + 0x310], eax
fild dword [esp + 0x310]
add esp, 0xfffffff8
fistp qword [esp]
wait
mov dl, 2
xor eax, eax
call fcn.0040fe88
push eax
mov dl, 9
lea eax, [esp + 0x40]
call fcn.00403198
pop edx
call fcn.00403250
call fcn.00402c54
lea eax, [esp + 0x3c]
call fcn.004032bc
movzx eax, bx
mov ecx, 0x3e8
xor edx, edx
div ecx
test edx, edx
jne 0x45312b
call fcn.0040f494
call fcn.004025ec
test eax, eax
je 0x45314a
mov edx, dword [0x48d89c]
mov edx, dword [edx]
mov ax, 5
call fcn.0040de10
jmp 0x453262
mov eax, dword [0x48d9fc]
cmp byte [eax], 0
jne 0x453186
cmp byte [edi + 0x18b5], 0
je 0x4531d9
movzx eax, word [edi + 0x1870]
mov dword [esp + 0x310], eax
fild dword [esp + 0x310]
fild qword [esp]
fcompp
fnstsw ax
sahf
jb 0x4531d9
cmp word [edi + 0x1870], 0
jbe 0x4531d9
lea eax, [esp + 0x3c]
call fcn.004032bc
mov ax, 0x1c3
call fcn.0040bc04
mov edx, eax
lea eax, [esp + 0x3c]
call fcn.00403250
mov dl, 0x20
call fcn.00403198
push eax
mov eax, dword [0x48d9fc]
mov al, byte [eax]
xor al, 1
and eax, 0x7f
add ax, 0x1c4
call fcn.0040bc04
mov edx, eax
pop eax
call fcn.00403250
mov dl, 0x2e
call fcn.00403198
call fcn.004032bc
jmp 0x453262
fild qword [esp + 0x18]
fadd dword [0x453514]
fistp qword [esp + 0x18]
wait
fild qword [esp + 0x20]
fadd dword [0x453514]
fistp qword [esp + 0x20]
wait
inc ebx
dec word [esp + 0x38]
jne 0x452f9e
call fcn.0040f494
fild qword [esp + 0x18]
mov eax, dword [0x48d3bc]
fild qword [eax]
fsubp st(1)
mov eax, dword [0x48da98]
fild qword [eax]
fdivp st(1)
fmul dword [0x453524]
call fcn.004028a0
mov edx, dword [0x48d1d8]
mov byte [edx], al
mov eax, dword [0x48d1d8]
mov al, byte [eax]
mov edx, dword [0x48d668]
cmp al, byte [edx]
je 0x453247
call fcn.00414c64
cmp dword [esp + 0x28], 0xe000
jge 0x452f0d
mov eax, dword [0x48d1d8]
mov byte [eax], 0x64
call fcn.00414c64
lea eax, [esp + 0x3c]
call fcn.004032bc
fild qword [esp]
fcomp dword [0x453528]
fnstsw ax
sahf
jbe 0x453310
push dword [esp + 4]
push dword [esp + 4]
call fcn.00412e40
mov edx, eax
lea eax, [esp + 0x208]
call fcn.00405c48
push 0x45352c
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
xor eax, eax
mov al, byte [edi + 0x18bc]
add eax, eax
add ax, 0x157
add ax, 2
dec eax
call fcn.0040bc04
push eax
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
mov ax, 0x66
call fcn.0040bc04
push eax
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x45352c
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
lea edx, [esp + 0x208]
lea eax, [esp + 0x3c]
call fcn.00403250
call fcn.00402c54
jmp 0x453318
mov byte [esp + 0x208], 0
call fcn.004025ec
test eax, eax
mov eax, dword [esp + 0x30]
call fcn.00428820
mov eax, dword [esp + 0x34]
call fcn.00428820
lea eax, [esp + 0x3c]
call fcn.00402c60
mov eax, esi
call fcn.00402508
mov eax, ebp
call fcn.00402508
call fcn.0040eb04
fild qword [esp]
fcomp dword [0x453528]
fnstsw ax
sahf
jbe 0x453464
lea eax, [edi + 0x500]
call fcn.0040fb28
push eax
mov ax, 0x67
call fcn.0040bc04
pop edx
call fcn.0040f5a0
mov eax, dword [0x48da44]
push eax
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 0x208]
mov edx, 0x14
call fcn.00411d74
cmp al, 1
jne 0x453406
lea edx, [edi + 0x500]
mov eax, dword [0x48da44]
call fcn.00405c48
push 0x453530
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48d89c]
mov eax, dword [eax]
push eax
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
push 0x453534
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
push 3
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jae 0x453406
lea edx, [edi + 0x500]
mov ax, 7
call fcn.0040de10
mov eax, 0xfa
call fcn.0040f448
mov eax, dword [0x48dbbc]
mov byte [eax], 1
mov ax, 0x68
call fcn.0040bc04
mov edx, 0x14
call fcn.00411d74
cmp al, 1
jne 0x4534e5
mov eax, dword [0x48d89c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_DeleteFileA_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4534e5
mov edx, dword [0x48d89c]
mov edx, dword [edx]
mov ax, 4
call fcn.0040de10
jmp 0x4534e5
lea eax, [esp + 0x3c]
call fcn.00402d80
mov al, byte [edi + 0x18bc]
xor al, 1
and eax, 0x7f
add ax, 0x1c6
call fcn.0040bc04
mov edx, eax
mov eax, dword [0x48da44]
call fcn.00405c48
cmp byte [edi + 0x18bc], 0
je 0x4534d6
mov eax, dword [esp + 0x30]
fild qword [eax + 0xc]
mov eax, dword [esp + 0x34]
fild qword [eax + 0xc]
fcompp
fnstsw ax
sahf
je 0x4534d6
mov eax, dword [0x48d3bc]
fild qword [eax]
mov eax, dword [0x48d3bc]
fild qword [eax + 8]
fcompp
fnstsw ax
sahf
jne 0x4534d6
mov ax, 0x1c8
call fcn.0040bc04
push eax
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48da44]
mov edx, 4
call fcn.00411d74
add esp, 0x314
pop ebp
pop edi
pop esi
pop ebx
ret