Function at 0x4a3470
Capabilities:
Create process on windows
Self delete

Disassembly:
push 0xffffffffffffffff
push 0x4f2855
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x230], eax
push ebx
push esi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x248], ebx
xor eax, eax
push 0x1ff
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov word [esp + 0x38], ax
lea eax, [esp + 0x41]
push ebx
push eax
mov dword [esp + 0x24], ebx
mov byte [esp + 0x48], bl
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [esp + 0x250]
push ecx
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x248], 1
push 0x5027e0
push eax
lea edx, [esp + 0x14]
push edx
call fcn.00402a60
add esp, 0xc
mov byte [esp + 0x248], 3
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0x200
lea eax, [esp + 0x40]
push ebx
push eax
call sub.MSVCR90.dll_memset
mov esi, dword [esp + 0x18]
mov eax, dword [esi - 0xc]
add esp, 0xc
cmp eax, 0x200
jg 0x4a36a7
jae 0x4a356a
lea edx, [esp + 0x3c]
mov eax, esi
sub edx, esi
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x4a3560
mov esi, dword [esi - 0xc]
lea ecx, [esp + 0x3c]
mov edx, 0x494
mov eax, ecx
mov word [esp + 0x28], dx
mov byte [esp + esi + 0x3d], bl
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2a], ebx
mov dword [esp + 0x2e], ebx
mov dword [esp + 0x32], ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4a35a4
sub eax, edx
cmp eax, 0xa
jbe 0x4a35bd
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
lea ecx, [esp + 0x250]
push ecx
lea ecx, [esp + 0x3c]
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x248], 4
push 0x5027e0
push eax
lea edx, [esp + 0x1c]
push edx
call fcn.00402a60
add esp, 0xc
mov byte [esp + 0x248], 5
push eax
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x248], 4
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x248], 3
lea ecx, [esp + 0x38]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0x4ff418
push 0x502d68
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_5924]
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x248], 6
mov eax, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push str._c_del__s__q___s_
push ecx
call dword [sym.imp.mfc90.dll_Ordinal_2539]
mov edx, dword [esp + 0x18]
add esp, 0xc
cmp dword [edx - 0xc], 0xa
jle 0x4a3695
mov eax, dword [esp + 0x10]
push ebx
push ebx
push eax
push 0x50c710
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [esp + 0x10]
push ecx
push str.ShellExecute_cmd__s_
push 8
call fcn.0043d500
add esp, 0xc
mov byte [esp + 0x248], 3
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x248], bl
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dword [esp + 0x248], 0xffffffff
lea ecx, [esp + 0x250]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.004e0148
add esp, 0x240
ret