Function at 0x4d2440
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Delete file
Enumerate files on windows
Get common file path
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x5d8
push esi
push edi
lea eax, [esp + 0x80]
mov byte [esp + 0x1b], cl
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, eax
cmp esi, 0x104
ja 0x4d24db
test esi, esi
je 0x4d24db
lea eax, [esp + 0x4d8]
push eax
push 0
push 0x55ab28
lea eax, [esp + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x4d24db
lea eax, [esp + 0x4d8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0xc9
push 0x554b7c
push 0
push 9
call fcn.00454e70
add esp, 0x10
xor dl, dl
mov cl, 1
call fcn.004c3d20
mov eax, dword [0x5ab0dc]
or eax, 0xc9
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 2
push 0
push 0
push 0
push str.SoftwareClasses_testKey
push reloc.SHLWAPI.dll_ParseURLA
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4d253d
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xc8
push 0x554b7c
push 0
push 9
call fcn.00454e70
add esp, 0x10
xor dl, dl
mov cl, 1
call fcn.004c3d20
mov eax, dword [0x5ab0dc]
or eax, 0xc8
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
cmp esi, 0x104
ja 0x4d277c
test esi, esi
je 0x4d277c
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x84]
call fcn.004d2290
mov ecx, dword [esp + 0x20]
xor edx, edx
test eax, eax
cmovs ecx, edx
jne 0x4d277c
cmp ecx, 0x101
jae 0x4d277c
lea ecx, [esp + 0x290]
mov edx, 0x104
lea esi, [esp + 0x80]
mov eax, ecx
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x4d25af
mov al, byte [esi + ecx]
test al, al
je 0x4d25af
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x4d2596
lea eax, [ecx - 1]
test edx, edx
push 0x55aa9c
cmovne eax, ecx
lea ecx, [esp + 0x294]
mov byte [eax], 0
call fcn.004d2230
lea eax, [esp + 0x398]
push eax
lea eax, [esp + 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x4d277c
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [eax]
nop dword [eax + eax]
test byte [esp + 0x398], 0x20
je 0x4d2722
lea ecx, [esp + 0x188]
mov edx, 0x104
lea esi, [esp + 0x80]
mov eax, ecx
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x4d263e
mov al, byte [esi + ecx]
test al, al
je 0x4d263e
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x4d2625
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
lea ecx, [esp + 0x188]
mov byte [eax], 0
lea eax, [esp + 0x3c4]
push eax
call fcn.004d2230
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
lea eax, [esp + 0x1a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4d26ea
push 0
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
push eax
push 9
push str.abcdefghi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4d26fb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xcb
push 0x554b7c
push 0
push 9
call fcn.00454e70
add esp, 0x10
xor dl, dl
mov cl, 1
call fcn.004c3d20
mov eax, dword [0x5ab0dc]
or eax, 0xcb
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
call edi
jmp 0x4d2772
call edi
cmp eax, 0x20
je 0x4d271e
cmp eax, 3
je 0x4d271e
cmp eax, 2
je 0x4d271e
lea eax, [esp + 0x188]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4d273e
call edi
cmp eax, 0x20
je 0x4d271e
cmp eax, 3
je 0x4d271e
cmp eax, 2
jne 0x4d276c
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x398]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x4d276c
mov eax, dword [esp + 0x14]
jmp 0x4d2600
push 0xca
push 0x554b7c
push 0
push 9
call fcn.00454e70
add esp, 0x10
xor dl, dl
mov cl, 1
call fcn.004c3d20
mov eax, dword [0x5ab0dc]
or eax, 0xca
jmp 0x4d26d5
mov edi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [esp + 0x1b], 0
je 0x4d28c4
push 0
push str.c:windows_system32help.exe___
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jbe 0x4d27d0
push 0xcd
push 0x554b7c
push 0
push 9
call fcn.00454e70
add esp, 0x10
xor dl, dl
mov cl, 1
call fcn.004c3d20
mov eax, dword [0x5ab0dc]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
or eax, 0xcd
push eax
call esi
push eax
call edi
jmp 0x4d27d6
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [esp + 0x70]
mov dword [esp + 0x28], 0x44
push eax
lea eax, [esp + 0x2c]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x55ab9c
push str.c:windows_system32help.exe
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x5c], xmm0
movlpd qword [esp + 0x64], xmm0
movlpd qword [esp + 0x6c], xmm0
movlpd qword [esp + 0x74], xmm0
movlpd qword [esp + 0x7c], xmm0
movlpd qword [esp + 0x84], xmm0
movlpd qword [esp + 0x8c], xmm0
movaps xmmword [esp + 0x98], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4d2878
push 0xce
push 0x554b7c
push 0
push 9
call fcn.00454e70
add esp, 0x10
xor dl, dl
mov cl, 1
call fcn.004c3d20
mov eax, dword [0x5ab0dc]
or eax, 0xce
push eax
call esi
push eax
call edi
push 0
push 0
push 0
push str.c:windows_system32help.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jbe 0x4d28c4
push 0xcf
push 0x554b7c
push 0
push 9
call fcn.00454e70
add esp, 0x10
xor dl, dl
mov cl, 1
call fcn.004c3d20
mov eax, dword [0x5ab0dc]
or eax, 0xcf
push eax
call esi
push eax
call edi
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret