Function at 0x462b1c
Capabilities:
Create process on windows
Delete file
Move file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffce4
mov byte [esp], dl
mov esi, eax
mov byte [esp + 0x18], 0
mov eax, esi
call fcn.0047e098
fistp qword [esp + 8]
wait
cmp byte [esi + 0x557], 0
jne 0x462b54
cmp byte [esp], 0
jne 0x462b63
cmp byte [esi + 0x552], 0
jne 0x462b63
cmp byte [esi + 0x55d], 0
jne 0x462b63
cmp dword [esi + 0x4c], 0
je 0x462b67
xor ebx, ebx
jmp 0x462b69
mov bl, 1
test bl, bl
je 0x462b81
mov edx, dword [esi + 0x14]
lea eax, [esp + 0x119]
call fcn.00405c48
jmp 0x462c2a
mov edx, dword [0x48d550]
add edx, 0x100
lea eax, [esp + 0x119]
call fcn.00405c48
mov eax, dword [esi + 0x14]
call fcn.0040fb28
push eax
lea eax, [esp + 0x11d]
push eax
call sub.kernel32.dll_lstrcatA
mov al, byte [esi + 0x55d]
test al, al
jle 0x462bc9
cmp al, 0x1a
jg 0x462bc9
lea eax, [esp + 0x119]
call fcn.00412e28
cmp byte [esi + 0x55d], 0
jne 0x462bd8
cmp dword [esi + 0x4c], 0
je 0x462bea
push 0x462f5c
lea eax, [esp + 0x11d]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 0x119]
call fcn.00412584
test al, al
je 0x462c10
lea eax, [esp + 0x119]
xor edx, edx
call fcn.00411180
test al, al
je 0x462f4e
push 0
lea edx, [esp + 0x11d]
mov eax, esi
mov cl, 1
call fcn.004692d0
test al, al
je 0x462f4e
cmp byte [esp], 0
je 0x462c3e
mov edi, dword [0x48d550]
add edi, 0x500
jmp 0x462c4a
mov edi, dword [0x48d550]
add edi, 0x1c7a
push 1
push 0x462f64
lea eax, [esp + 0x121]
push eax
push edi
push 0
mov eax, dword [esi]
push eax
call sub.shell32.dll_ShellExecuteA
mov edx, dword [0x48d29c]
mov dword [edx], eax
mov eax, dword [0x48d29c]
cmp dword [eax], 0x20
ja 0x462cc3
mov eax, dword [0x48d29c]
cmp dword [eax], 0
jbe 0x462cc3
mov edx, edi
mov ax, 7
call fcn.0040de10
test bl, bl
jne 0x462f4e
lea eax, [esp + 0x119]
push eax
call sub.kernel32.dll_DeleteFileA_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x462f4e
lea edx, [esp + 0x119]
mov ax, 4
call fcn.0040de10
jmp 0x462f4e
mov eax, 0xfa
call fcn.0040f448
mov eax, dword [0x48dbbc]
mov byte [eax], 1
test bl, bl
jne 0x462ef4
cmp byte [esp], 0
je 0x462ef4
cmp byte [esi + 0x55d], 0
jne 0x462ef4
cmp dword [esi + 0x4c], 0
jne 0x462ef4
cmp byte [esi + 0x557], 0
jne 0x462ef4
mov ax, 0x1fd
call fcn.0040bc04
mov edx, 0x77
call fcn.00411d74
cmp al, 1
jne 0x462ef4
mov eax, dword [esi + 0x48c]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x490]
mov dword [esp + 0x14], eax
fild qword [esi + 0x494]
fcomp dword [0x462f68]
fnstsw ax
sahf
jne 0x462deb
push 0
push 0
mov ax, word [esi + 0x534]
xor ecx, ecx
mov dl, 9
call fcn.0044f244
test al, al
je 0x462f4e
mov ax, word [esi + 0x534]
call fcn.00412944
mov edx, eax
lea eax, [esp + 0x219]
call fcn.00405c48
lea eax, [esp + 0x219]
push eax
call sub.kernel32.dll_DeleteFileA_1
lea eax, [esp + 0x219]
push eax
lea eax, [esp + 0x11d]
push eax
call sub.kernel32.dll_MoveFileA
mov byte [esi + 0x82], 3
mov byte [esi + 0x8c], 1
mov byte [esp + 0x18], 1
lea eax, [esp + 0x219]
call fcn.00412f30
fistp qword [esi + 0x18]
wait
push 0
push 0
fild qword [esi + 0x18]
fsub dword [0x462f6c]
add esp, 0xfffffff8
fistp qword [esp]
wait
lea eax, [esi + 0xc]
call fcn.00423bdc
jmp 0x462eda
mov edx, dword [0x48d370]
lea eax, [esp + 0x19]
call fcn.00405c48
lea edx, [esp + 0x119]
mov eax, dword [0x48d370]
call fcn.00405c48
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.004616f8
mov edi, eax
test di, di
jle 0x462eda
movsx ebp, di
mov eax, dword [0x48d524]
mov eax, dword [eax + ebp*4 - 4]
call fcn.0046d580
mov eax, dword [0x48d720]
mov byte [eax], 1
push 0
push 0
push 0x10
mov eax, dword [0x48d524]
mov eax, dword [eax + ebp*4 - 4]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [0x48d720]
mov byte [eax], 0
mov eax, dword [0x48d4a8]
cmp dword [eax], 0
jle 0x462ec9
lea eax, [esp + 0x119]
call fcn.00412f30
fild qword [esi + 0x494]
fild qword [esi + 0x48c]
fsubp st(1)
fadd dword [0x462f6c]
fcompp
fnstsw ax
sahf
je 0x462eaf
push dword [esp + 0x14]
push dword [esp + 0x14]
mov eax, esi
xor edx, edx
call fcn.0047e0e8
mov eax, esi
xor edx, edx
call fcn.0046d1a8
mov eax, esi
mov dl, 1
call fcn.0046de78
jmp 0x462ec9
push dword [esp + 0x14]
push dword [esp + 0x14]
mov eax, esi
xor edx, edx
call fcn.0047e0e8
mov eax, esi
mov dl, 1
call fcn.0046dd98
push dword [esp + 0xc]
push dword [esp + 0xc]
mov eax, esi
xor edx, edx
call fcn.0047e0e8
mov byte [esi + 0x8f], 0
mov eax, esi
call fcn.004632ec
call fcn.00444994
mov eax, esi
call fcn.0047d4c8
test bl, bl
jne 0x462f4e
cmp byte [esp + 0x18], 0
jne 0x462f4e
mov ax, 0x16
call fcn.0040bc04
lea edx, [esp + 0x119]
call fcn.0040f5a0
mov eax, dword [0x48da44]
mov edx, 0x13
call fcn.00411d74
cmp al, 1
jne 0x462f4e
lea eax, [esp + 0x119]
push eax
call sub.kernel32.dll_DeleteFileA_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x462f4e
lea edx, [esp + 0x119]
mov ax, 4
call fcn.0040de10
add esp, 0x31c
pop ebp
pop edi
pop esi
pop ebx
ret