Function at 0x40c4cf
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x5b0
mov eax, dword [0x52efc0]
mov edi, dword [ebp + 8]
lea esi, [esp + 0x110]
xor eax, ebp
mov dword [esp + 0x5a8], eax
mov eax, 0x4e3743
mov dword [esi], eax
push eax
call fcn.004ceea0
add esp, 4
mov dword [esi + 4], eax
lea ebx, [esp + 0xec]
mov ecx, edi
push esi
push ebx
call fcn.0042cef0
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x40c528
mov eax, dword [esp + 0xf0]
xor ebx, ebx
test eax, eax
jne 0x40d160
lea ecx, [esp + 0xec]
push ebx
push 0x4e2bc0
push 0xffffffffffffffff
push ebx
call fcn.0042815a
test eax, eax
jne 0x40d160
mov ecx, edi
push str.flash_update
call fcn.0042ce80
xor ebx, ebx
test al, al
je 0x40d160
lea ecx, [esp + 0xe0]
call fcn.0042cb10
lea ecx, [esp + 0xd4]
call fcn.0042cb10
lea ecx, [esp + 0xc8]
call fcn.0042cb10
lea eax, [esp + 0x3a0]
push 0x208
push ebx
push eax
call fcn.004b81d0
add esp, 0xc
push 0x104
lea eax, [esp + 0x3a4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x3a0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ebx, [esp + 0xbc]
lea eax, [esp + 0x3a0]
mov ecx, ebx
push eax
call fcn.00402d2c
mov ecx, ebx
push str.components
call fcn.004288d4
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x40c5f9
mov ebx, dword [esp + 0xbc]
mov eax, dword [esp + 0xc0]
lea ecx, [esp + 0xb0]
push eax
push ebx
call fcn.0042cb30
mov ecx, edi
push 0x4e2be8
push esi
call fcn.0042d050
lea edi, [esp + 0xe0]
mov ecx, edi
push esi
call fcn.00431280
mov ecx, esi
call fcn.0042cba0
mov esi, 0x4e2bbe
lea ecx, [esp + 0xa4]
push esi
call fcn.00402d2c
lea ecx, [esp + 0x98]
push esi
call fcn.00402d2c
xor eax, eax
lea esi, [esp + 0x110]
inc eax
mov ecx, esi
push eax
push eax
push edi
call fcn.0045b540
lea edi, [esp + 0x20]
mov ecx, esi
push edi
call fcn.0045b7e0
movzx eax, byte [edi + 0xb]
test al, al
jns 0x40c675
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40c9d3
mov ecx, 0xc
lea eax, [esp + 0xa4]
lea edx, [esp + 0x98]
lea esi, [esp + 0x8c]
add eax, ecx
add ecx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov ecx, edi
lea ebx, [esp + 0x80]
push ebx
call fcn.00431140
mov ecx, esi
push ebx
call fcn.004281c4
mov ecx, ebx
call fcn.0042cba0
movzx eax, byte [esp + 0x97]
mov ecx, esi
test al, al
jns 0x40c6dd
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x90]
push 1
mov edx, 4
push edx
push 0x4e2bf0
push eax
push ecx
call fcn.00446bf0
add esp, 0x14
test al, al
je 0x40c825
movzx eax, byte [esp + 0x97]
mov ecx, esi
test al, al
jns 0x40c718
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x90]
push 1
push 5
push str.npswf
push eax
push ecx
call fcn.00446ab0
add esp, 0x14
test al, al
je 0x40c825
lea ecx, [esp + 0xd4]
push edi
call fcn.00430e10
lea ebx, [esp + 0xa4]
mov ecx, ebx
push esi
call fcn.004283b4
movzx eax, byte [esp + 0xaf]
test al, al
jns 0x40c769
mov ebx, dword [esp + 0xa4]
mov eax, dword [esp + 0xa8]
test eax, eax
mov edx, 0xffffffff
je 0x40c791
lea edx, [ebx + eax*2 - 2]
add eax, eax
neg eax
cmp word [edx], 0x2e
je 0x40c78d
add edx, 0xfffffffe
add eax, 2
jne 0x40c77a
xor edx, edx
dec edx
jmp 0x40c791
sub edx, ebx
sar edx, 1
lea ecx, [esp + 0x80]
push dword [esp + 0x10]
push edx
push 0
lea eax, [esp + 0xb0]
push eax
call fcn.004282dc
cmp byte [esp + 0xaf], 0
js 0x40c7ca
mov word [esp + 0xa4], 0
mov byte [esp + 0xaf], 0
jmp 0x40c805
mov eax, dword [esp + 0xa4]
mov word [eax], 0
mov dword [esp + 0xa8], 0
cmp byte [esp + 0xaf], 0
jns 0x40c805
push dword [esp + 0xa4]
call fcn.004aeac6
add esp, 4
mov dword [esp + 0xac], 0
mov eax, dword [esp + 0x88]
movsd xmm0, qword [esp + 0x80]
mov dword [esp + 0xac], eax
movsd qword [esp + 0xa4], xmm0
movzx eax, byte [esp + 0x97]
mov ecx, esi
test al, al
jns 0x40c841
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x90]
push 1
mov edx, 4
push edx
push 0x4e2bf0
push eax
push ecx
call fcn.00446bf0
add esp, 0x14
test al, al
je 0x40c989
movzx eax, byte [esp + 0x97]
mov ecx, esi
test al, al
jns 0x40c87c
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x90]
push 1
push 8
push str.pepflash
push eax
push ecx
call fcn.00446ab0
add esp, 0x14
test al, al
je 0x40c989
lea ecx, [esp + 0xc8]
push edi
call fcn.00430e10
lea ebx, [esp + 0x98]
mov ecx, ebx
push esi
call fcn.004283b4
movzx eax, byte [esp + 0xa3]
test al, al
jns 0x40c8cd
mov ebx, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
test eax, eax
mov edx, 0xffffffff
je 0x40c8f5
lea edx, [ebx + eax*2 - 2]
add eax, eax
neg eax
cmp word [edx], 0x2e
je 0x40c8f1
add edx, 0xfffffffe
add eax, 2
jne 0x40c8de
xor edx, edx
dec edx
jmp 0x40c8f5
sub edx, ebx
sar edx, 1
lea ecx, [esp + 0x80]
push dword [esp + 0xc]
push edx
push 0
lea eax, [esp + 0xa4]
push eax
call fcn.004282dc
cmp byte [esp + 0xa3], 0
js 0x40c92e
mov word [esp + 0x98], 0
mov byte [esp + 0xa3], 0
jmp 0x40c969
mov eax, dword [esp + 0x98]
mov word [eax], 0
mov dword [esp + 0x9c], 0
cmp byte [esp + 0xa3], 0
jns 0x40c969
push dword [esp + 0x98]
call fcn.004aeac6
add esp, 4
mov dword [esp + 0xa0], 0
mov eax, dword [esp + 0x88]
movsd xmm0, qword [esp + 0x80]
mov dword [esp + 0xa0], eax
movsd qword [esp + 0x98], xmm0
cmp byte [esp + 0x97], 0
jns 0x40c9a2
push dword [esp + 0x8c]
call fcn.004aeac6
add esp, 4
lea ecx, [esp + 0x110]
push esi
call fcn.0045b7e0
mov ecx, edi
push esi
call fcn.00431280
mov ecx, esi
call fcn.0042cba0
movzx eax, byte [esp + 0x2b]
test al, al
jns 0x40c9cb
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x40c6a3
lea esi, [esp + 0x20]
mov ecx, esi
call fcn.0042cba0
lea ecx, [esp + 0x110]
call fcn.0045b6f0
lea ecx, [esp + 0x8c]
lea eax, [esp + 0xd4]
mov dword [esp + 0xc], ecx
push eax
call fcn.004281c4
xor ebx, ebx
lea ecx, [esp + 0x74]
mov dword [esp + 0x84], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x88], ebx
call fcn.0042cb10
lea ecx, [esp + 0x68]
call fcn.0042cb10
lea eax, [esp + 0xa4]
lea edi, [esp + 0x58]
push eax
push str.seflash_npflash_
push edi
call fcn.0040d191
add esp, 0xc
mov ecx, edi
push str..dll
call fcn.004288d4
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
movsd xmm0, qword [eax]
movsd qword [esi], xmm0
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
movzx eax, byte [esi + 0xb]
test al, al
jns 0x40ca77
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0xb0]
push eax
push esi
lea esi, [esp + 0x118]
push esi
call fcn.00431b50
lea ecx, [esp + 0x74]
push esi
call fcn.00431280
mov ecx, esi
call fcn.0042cba0
cmp byte [esp + 0x2b], bl
jns 0x40cab0
push dword [esp + 0x20]
call fcn.004aeac6
add esp, 4
cmp byte [esp + 0x63], 0
jns 0x40cac3
push dword [esp + 0x58]
call fcn.004aeac6
add esp, 4
lea eax, [esp + 0x98]
push eax
push str.seflashppflash_
lea edi, [esp + 0x60]
push edi
call fcn.0040d191
add esp, 0xc
mov ecx, edi
push str..dll
call fcn.004288d4
mov ecx, dword [eax + 8]
xor ebx, ebx
mov dword [esp + 0x28], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x20], xmm0
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
movzx eax, byte [esp + 0x2b]
test al, al
jns 0x40cb17
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
jmp 0x40cb1b
lea edx, [esp + 0x20]
lea ecx, [esp + 0xb0]
push eax
push edx
push esi
call fcn.00431b50
lea ecx, [esp + 0x68]
push esi
call fcn.00431280
mov ecx, esi
call fcn.0042cba0
cmp byte [esp + 0x2b], bl
jns 0x40cb4d
push dword [esp + 0x20]
call fcn.004aeac6
add esp, 4
cmp byte [esp + 0x63], 0
jns 0x40cb60
push dword [esp + 0x58]
call fcn.004aeac6
add esp, 4
mov edi, 0x4e2c6c
lea esi, [esp + 0x38]
lea eax, [esp + 0x8c]
push eax
push edi
push esi
call fcn.0040d191
add esp, 0xc
mov eax, 0x4e2c66
mov ecx, esi
push eax
mov esi, 0x4e2c66
call fcn.004288d4
mov edx, dword [eax + 8]
lea ecx, [esp + 0x48]
xor ebx, ebx
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
push 0x4e2c70
call fcn.004288d4
mov edx, dword [eax + 8]
lea ecx, [esp + 0x58]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
push edi
call fcn.004288d4
mov edx, dword [eax + 8]
lea ecx, [esp + 0x20]
mov dword [ecx + 8], edx
lea edx, [esp + 0x74]
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
movzx eax, byte [esp + 0x7f]
test al, al
cmovs eax, dword [esp + 0x78]
cmovs edx, dword [esp + 0x74]
push eax
push edx
call fcn.00428714
mov ecx, dword [eax + 8]
lea edi, [esp + 0x110]
mov dword [edi + 8], ecx
mov ecx, edi
movsd xmm0, qword [eax]
movsd qword [edi], xmm0
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
push esi
call fcn.004288d4
mov ecx, dword [eax + 4]
mov edx, dword [eax + 7]
mov esi, dword [eax]
mov dword [esp + 0xfb], edx
mov dword [esp + 0xf8], ecx
mov dl, byte [eax + 0xb]
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
cmp byte [esp + 0x8b], bl
js 0x40cc6c
mov word [esp + 0x80], 0
mov byte [esp + 0x8b], 0
jmp 0x40ccab
mov eax, dword [esp + 0x80]
mov word [eax], 0
mov dword [esp + 0x84], 0
cmp byte [esp + 0x8b], 0
jns 0x40ccab
push dword [esp + 0x80]
mov ebx, edx
call fcn.004aeac6
mov edx, ebx
add esp, 4
mov dword [esp + 0x88], 0
mov eax, dword [esp + 0xf8]
mov dword [esp + 0x80], esi
mov ecx, dword [esp + 0xfb]
mov dword [esp + 0x84], eax
xor eax, eax
cmp byte [esp + 0x11b], 0
mov dword [esp + 0x87], ecx
mov byte [esp + 0x8b], dl
mov dword [esp + 0xf8], eax
mov dword [esp + 0xfb], eax
jns 0x40ccfe
push dword [esp + 0x110]
call fcn.004aeac6
add esp, 4
cmp byte [esp + 0x2b], 0
jns 0x40cd11
push dword [esp + 0x20]
call fcn.004aeac6
add esp, 4
cmp byte [esp + 0x63], 0
jns 0x40cd24
push dword [esp + 0x58]
call fcn.004aeac6
add esp, 4
cmp byte [esp + 0x53], 0
jns 0x40cd37
push dword [esp + 0x48]
call fcn.004aeac6
add esp, 4
cmp byte [esp + 0x43], 0
jns 0x40cd4a
push dword [esp + 0x38]
call fcn.004aeac6
add esp, 4
xor eax, eax
cmp byte [esp + 0x8b], 0
xorps xmm0, xmm0
mov dword [esp + 0x118], eax
mov dword [esp + 0x114], eax
mov dword [esp + 0x120], eax
mov dword [esp + 0x11c], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x124], eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x12c], eax
mov dword [esp + 0x138], eax
mov dword [esp + 0x134], eax
mov dword [esp + 0x140], eax
mov dword [esp + 0x13c], eax
mov dword [esp + 0x148], eax
mov dword [esp + 0x144], eax
mov dword [esp + 0x150], eax
mov dword [esp + 0x14c], eax
mov dword [esp + 0x110], 0x44
movaps xmmword [esp + 0x20], xmm0
jns 0x40cde2
mov ecx, dword [esp + 0x80]
jmp 0x40cde9
lea ecx, [esp + 0x80]
lea edx, [esp + 0x20]
push edx
push edi
push eax
push eax
push eax
push eax
push eax
push eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40ce2c
cmp byte [esp + 0x97], 0
jns 0x40ce22
mov eax, dword [esp + 0x8c]
mov dword [esp + 0xc], eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [esp + 0x8c]
lea eax, [esp + 0xc8]
mov ecx, esi
push eax
call fcn.004283b4
mov edi, 0x4e2c6c
lea ebx, [esp + 0x14]
push esi
push edi
push ebx
call fcn.0040d191
add esp, 0xc
mov eax, 0x4e2c66
mov ecx, ebx
push eax
call fcn.004288d4
mov edx, dword [eax + 8]
lea ecx, [esp + 0xf8]
xor ebx, ebx
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
push str._r_360browser_293_pp__p
call fcn.004288d4
mov edx, dword [eax + 8]
lea ecx, [esp + 0x38]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
push edi
call fcn.004288d4
mov edx, dword [eax + 8]
lea ecx, [esp + 0x48]
mov dword [ecx + 8], edx
lea edx, [esp + 0x68]
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
movzx eax, byte [esp + 0x73]
test al, al
cmovs eax, dword [esp + 0x6c]
cmovs edx, dword [esp + 0x68]
push eax
push edx
call fcn.00428714
mov edx, dword [eax + 8]
lea ecx, [esp + 0x58]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
mov eax, 0x4e2c66
push eax
call fcn.004288d4
mov ecx, dword [eax + 4]
mov edx, dword [eax + 7]
mov edi, dword [eax]
mov dword [esp + 0x10b], edx
mov dword [esp + 0x108], ecx
lea ecx, [esp + 0x84]
mov dl, byte [eax + 0xb]
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
cmp byte [ecx + 7], bl
mov ebx, ecx
js 0x40cf4a
mov word [esp + 0x80], 0
mov byte [esp + 0x8b], 0
jmp 0x40cf8d
mov eax, dword [esp + 0x80]
mov word [eax], 0
mov dword [esp + 0x84], 0
cmp byte [esp + 0x8b], 0
jns 0x40cf8d
push dword [esp + 0x80]
mov byte [esp + 0x10], dl
call fcn.004aeac6
mov dl, byte [esp + 0x10]
add esp, 4
mov dword [esp + 0x88], 0
mov eax, dword [esp + 0x108]
mov ecx, dword [esp + 0x10b]
mov dword [esp + 0x80], edi
mov dword [ebx + 3], ecx
mov dword [ebx], eax
xor eax, eax
cmp byte [esp + 0x63], 0
mov byte [esp + 0x8b], dl
mov dword [esp + 0x108], eax
mov dword [esp + 0x10b], eax
jns 0x40cfd1
push dword [esp + 0x58]
call fcn.004aeac6
add esp, 4
cmp byte [esp + 0x53], 0
lea edi, [esp + 0x110]
jns 0x40cfeb
push dword [esp + 0x48]
call fcn.004aeac6
add esp, 4
cmp byte [esp + 0x43], 0
jns 0x40cffe
push dword [esp + 0x38]
call fcn.004aeac6
add esp, 4
cmp byte [esp + 0x103], 0
jns 0x40d017
push dword [esp + 0xf8]
call fcn.004aeac6
add esp, 4
cmp byte [esp + 0x1f], 0
jns 0x40d02a
push dword [esp + 0x14]
call fcn.004aeac6
add esp, 4
cmp byte [esp + 0x8b], 0
jns 0x40d03d
mov eax, dword [esp + 0x80]
jmp 0x40d044
lea eax, [esp + 0x80]
lea edx, [esp + 0x20]
xor ecx, ecx
push edx
push edi
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40d082
cmp byte [esp + 0x97], 0
jns 0x40d07b
mov esi, dword [esp + 0x8c]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
lea eax, [esp + 0xe4]
push eax
call fcn.00432830
add esp, 8
lea ecx, [esp + 0x68]
call fcn.0042cba0
lea ecx, [esp + 0x74]
call fcn.0042cba0
cmp byte [esp + 0x8b], 0
jns 0x40d0ca
push dword [esp + 0x80]
call fcn.004aeac6
add esp, 4
cmp byte [esp + 0x97], 0
jns 0x40d0e3
push dword [esp + 0x8c]
call fcn.004aeac6
add esp, 4
cmp byte [esp + 0xa3], 0
jns 0x40d0fc
push dword [esp + 0x98]
call fcn.004aeac6
add esp, 4
cmp byte [esp + 0xaf], 0
jns 0x40d115
push dword [esp + 0xa4]
call fcn.004aeac6
add esp, 4
lea ecx, [esp + 0xb0]
call fcn.0042cba0
cmp byte [esp + 0xc7], 0
jns 0x40d13a
push dword [esp + 0xbc]
call fcn.004aeac6
add esp, 4
lea ecx, [esp + 0xc8]
call fcn.0042cba0
lea ecx, [esp + 0xd4]
call fcn.0042cba0
lea ecx, [esp + 0xe0]
call fcn.0042cba0
mov bl, 1
cmp byte [esp + 0xf7], 0
jns 0x40d179
push dword [esp + 0xec]
call fcn.004aeac6
add esp, 4
mov ecx, dword [esp + 0x5a8]
xor ecx, ebp
call fcn.004aeb01
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret