Function at 0x47602c
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x18
push 0
push 0
dec ecx
jne 0x476034
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
xor eax, eax
push ebp
push 0x476b3a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x21], 1
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0x11
lea edx, [ebp - 0x48]
xor ecx, ecx
mov eax, 0x476b58
call fcn.00461740
mov eax, dword [esi]
cmp byte [eax + 0xc], 0
je 0x47608c
mov eax, dword [esi]
cmp byte [eax + 0x5d], 0
jne 0x47609b
mov eax, dword [esi]
cmp byte [eax + 0x101], 0
jne 0x47609b
mov eax, 0x476b88
call fcn.00461688
jmp 0x476ace
mov eax, dword [esi]
movzx eax, byte [eax + 0x5d]
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 0
mov eax, dword [esi]
movzx eax, byte [eax + 0x101]
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x4c], 0
lea edx, [ebp - 0x58]
mov ecx, 1
mov eax, 0x476bf4
call fcn.004617fc
mov eax, dword [esi]
push dword [eax + 0xfc]
push dword [eax + 0xf8]
mov eax, dword [esi]
add eax, 0x74
call fcn.0047a16c
test al, al
je 0x476111
mov eax, 0x476c48
call fcn.00461688
mov eax, dword [esi]
cmp byte [eax + 0x138], 0
jne 0x476111
mov eax, dword [esi]
push eax
push 0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov dl, 0xd
mov eax, dword [0x4a0800]
call fcn.0046d330
mov byte [ebp - 0x21], 0
mov eax, dword [esi]
mov ebx, dword [eax + 0x70]
mov eax, ebx
call fcn.0040895c
push eax
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x5c]
mov eax, dword [esi]
call fcn.004743a0
mov edx, dword [ebp - 0x5c]
mov ecx, ebx
mov ebx, dword [esi]
mov eax, dword [ebx + 0xfc]
call dword [ebx + 0xf8]
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x6c]
xor edx, edx
mov eax, 0x476ca8
call fcn.00454460
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x68], eax
mov eax, dword [0x49a850]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov eax, dword [esi]
mov eax, dword [eax + 0xe4]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x68]
mov ecx, 0x476cc0
mov edx, 2
call fcn.00452f7c
lea edx, [ebp - 0x10]
mov eax, dword [esi]
call fcn.00479b70
mov eax, dword [esi]
mov byte [eax + 0x64], 0
lea eax, [ebp - 0x1c]
xor edx, edx
call fcn.004071a8
mov eax, dword [esi]
mov eax, dword [eax + 0x60]
call fcn.0040895c
mov edi, eax
test edi, edi
jl 0x476205
inc edi
xor ebx, ebx
mov eax, dword [esi]
cmp byte [eax + 0x64], 0
jne 0x4761cb
imul eax, ebx, 0xe
mov edx, dword [esi]
mov edx, dword [edx + 0x60]
cmp byte [edx + eax*8 + 0x14], 0
jne 0x4761cb
xor eax, eax
jmp 0x4761cd
mov al, 1
mov edx, dword [esi]
mov byte [edx + 0x64], al
imul eax, ebx, 0xe
mov edx, dword [esi]
mov edx, dword [edx + 0x60]
cmp byte [edx + eax*8 + 0x14], 0
je 0x476201
push dword [ebp - 0x1c]
push 0x476cd0
imul eax, ebx, 0xe
mov edx, dword [esi]
mov edx, dword [edx + 0x60]
push dword [edx + eax*8]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004076f4
inc ebx
dec edi
jne 0x4761b0
mov eax, dword [esi]
cmp byte [eax + 0x138], 0
jne 0x476217
mov eax, dword [esi]
call fcn.00479c5c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0x11
lea edx, [ebp - 0x48]
xor ecx, ecx
mov eax, 0x476ce0
call fcn.00461740
mov edx, dword [ebp - 0xc]
mov eax, dword [esi]
call fcn.00473c54
test al, al
je 0x47692a
push 0x1388
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebp - 0xc]
call fcn.0045632c
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0
lea edx, [ebp - 0x48]
xor ecx, ecx
mov eax, 0x476d0c
call fcn.00461740
mov eax, dword [esi]
cmp byte [eax + 0x5d], 0
je 0x476374
mov eax, dword [esi]
cmp byte [eax + 0x64], 0
je 0x476374
mov eax, dword [esi]
call fcn.004744fc
push eax
lea eax, [ebp - 0x20]
mov ecx, 1
mov edx, dword [0x474508]
call fcn.00408b1c
add esp, 4
mov eax, dword [esi]
mov eax, dword [eax + 0x60]
call fcn.0040895c
mov edi, eax
test edi, edi
jl 0x4762d8
inc edi
xor ebx, ebx
imul eax, ebx, 0xe
mov edx, dword [esi]
mov edx, dword [edx + 0x60]
lea eax, [edx + eax*8]
lea edx, [ebp - 0x70]
call fcn.0047b860
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x20]
lea eax, [eax + ebx*4]
call fcn.00407154
inc ebx
dec edi
jne 0x4762b3
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x20]
call fcn.0040895c
mov edx, eax
mov ecx, 0x476d40
mov eax, dword [ebp - 0x20]
call fcn.00452f7c
mov edx, dword [ebp - 0x10]
mov eax, 0x476d50
call fcn.00407b08
test eax, eax
jle 0x476347
push 0
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x7c]
mov edx, dword [ebp - 0x18]
mov eax, 0x476d80
call fcn.00481bbc
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x48]
mov ebx, dword [esi]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0xfc]
call dword [ebx + 0xf8]
mov edx, dword [ebp - 0x74]
lea eax, [ebp - 0x10]
call fcn.004071a8
jmp 0x476374
lea eax, [ebp - 0x80]
push eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x48]
mov ecx, 0x476d40
mov edx, 1
call fcn.00452f7c
mov edx, dword [ebp - 0x80]
lea eax, [ebp - 0x10]
call fcn.004071a8
push 0x476dac
push dword [ebp - 0xc]
push 0x476dbc
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004076f4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0x11
lea edx, [ebp - 0x48]
xor ecx, ecx
mov eax, 0x476dd0
call fcn.00461740
mov dword [ebp - 0x28], 3
mov eax, dword [esi]
cmp byte [eax + 0xf0], 0
je 0x476429
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0x14]
call fcn.0046adbc
mov ebx, eax
test bl, bl
je 0x47641e
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0x100400
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4763ec
cmp eax, 0xffffffff
jne 0x4763ff
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0x101000
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x47640b
cmp eax, 0xffffffff
jne 0x47641e
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0x100000
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x40], eax
mov eax, dword [esi]
mov byte [eax + 0x139], 1
jmp 0x476436
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x14]
call fcn.00454654
mov ebx, eax
test bl, bl
je 0x476771
mov eax, dword [esi]
cmp dword [eax + 0x120], 0
je 0x476469
push 1
push 0
push 0
mov eax, dword [esi]
mov eax, dword [eax + 0x120]
call fcn.004071e0
push eax
push 0x476df0
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [esi]
mov byte [eax + 0x139], 1
push 0xffffffffffffffff
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
sete byte [ebp - 0x21]
mov eax, dword [esi]
mov dword [eax + 0x12c], 1
cmp byte [ebp - 0x21], 0
jne 0x4765b6
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, dword [esi]
mov dword [eax + 0x12c], ebx
mov dword [ebp - 0x58], ebx
mov byte [ebp - 0x54], 0
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea edx, [ebp - 0x58]
mov ecx, 1
mov eax, 0x476e08
call fcn.00461740
mov eax, dword [esi]
mov eax, dword [eax + 0x12c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x84]
call fcn.00410590
mov eax, dword [ebp - 0x84]
push eax
mov ecx, 0x476e60
mov edx, dword [esi]
mov eax, 0x476e78
call fcn.0047b8d8
mov dl, 1
mov eax, dword [0x462374]
call fcn.0046367c
mov ebx, eax
lea eax, [ebx + 0x24]
mov edx, dword [0x4a0800]
mov edx, dword [edx + 0x9c]
call fcn.00407154
lea eax, [ebx + 0x28]
mov edx, dword [0x4a0800]
mov edx, dword [edx + 0x60]
call fcn.00407154
lea edx, [ebp - 0x88]
mov eax, dword [0x4a0800]
call fcn.0046da28
mov edx, dword [ebp - 0x88]
lea eax, [ebx + 0x30]
call fcn.00407154
lea eax, [ebx + 0x38]
mov edx, dword [0x4a0800]
mov edx, dword [edx + 0xa0]
call fcn.00407154
lea eax, [ebx + 0x34]
mov edx, 0x476eb0
call fcn.00407154
lea eax, [ebx + 0x3c]
mov edx, dword [esi]
mov edx, dword [edx + 4]
call fcn.00407154
mov eax, dword [esi]
cmp byte [eax + 0xc], 0
setne al
mov byte [ebx + 0x2c], al
lea eax, [ebx + 0x4c]
mov edx, dword [ebp - 0xc]
call fcn.00407154
lea eax, [ebx + 0x50]
mov edx, dword [ebp - 0x10]
call fcn.00407154
mov eax, dword [esi]
mov eax, dword [eax + 0x12c]
mov dword [ebx + 0x54], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
mov eax, ebx
call fcn.00405038
jmp 0x47675a
mov eax, dword [esi]
mov byte [eax + 0x128], 1
mov eax, dword [esi]
add eax, 0x12c
push eax
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
jne 0x476662
call sub.kernel32.dll_GetLastError_1
mov edx, dword [esi]
mov dword [edx + 0x12c], eax
mov dl, 1
mov eax, dword [0x462374]
call fcn.0046367c
mov ebx, eax
lea eax, [ebx + 0x38]
mov edx, dword [0x4a0800]
mov edx, dword [edx + 0xa0]
call fcn.00407154
lea eax, [ebx + 0x34]
mov edx, 0x476ee0
call fcn.00407154
lea eax, [ebx + 0x3c]
mov edx, dword [esi]
mov edx, dword [edx + 4]
call fcn.00407154
mov eax, dword [esi]
cmp byte [eax + 0xc], 0
setne al
mov byte [ebx + 0x2c], al
lea eax, [ebx + 0x4c]
mov edx, dword [ebp - 0xc]
call fcn.00407154
lea eax, [ebx + 0x50]
mov edx, dword [ebp - 0x10]
call fcn.00407154
mov eax, dword [esi]
mov eax, dword [eax + 0x12c]
mov dword [ebx + 0x54], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
mov eax, ebx
call fcn.00405038
mov byte [ebp - 0x29], 1
jmp 0x4766ac
mov byte [ebp - 0x29], 0
mov eax, dword [esi]
mov eax, dword [eax + 0x124]
call fcn.00408954
mov edi, eax
dec edi
test edi, edi
jl 0x4766ac
inc edi
xor ebx, ebx
mov eax, dword [esi]
mov eax, dword [eax + 0x124]
mov eax, dword [eax + ebx*4]
cdq
push edx
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0x12c]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x47669e
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4766a8
mov byte [ebp - 0x29], 1
jmp 0x4766ac
inc ebx
dec edi
jne 0x47667d
push ebp
mov eax, dword [esi]
mov eax, dword [eax + 0x12c]
call fcn.00475e74
pop ecx
cmp byte [ebp - 0x29], 0
jne 0x4766d6
mov eax, dword [esi]
mov eax, dword [eax + 0x124]
call fcn.00408954
test eax, eax
je 0x4766d6
xor eax, eax
jmp 0x4766d8
mov al, 1
mov byte [ebp - 0x21], al
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 0x9c], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x98], eax
mov byte [ebp - 0x94], 0
mov eax, dword [esi]
mov eax, dword [eax + 0x12c]
mov dword [ebp - 0x90], eax
mov byte [ebp - 0x8c], 0
lea edx, [ebp - 0xa0]
mov ecx, 2
mov eax, 0x476f10
call fcn.00461740
cmp byte [ebp - 0x21], 0
jne 0x47675a
mov eax, dword [esi]
mov eax, dword [eax + 0x12c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa4]
call fcn.00410590
mov eax, dword [ebp - 0xa4]
push eax
mov ecx, 0x476f68
mov edx, dword [esi]
mov eax, 0x476f88
call fcn.0047b8d8
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x3c]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x47687c
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, dword [esi]
mov dword [eax + 0x12c], ebx
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x44], 0
lea edx, [ebp - 0x48]
xor ecx, ecx
mov eax, 0x476fc0
call fcn.00461740
mov eax, dword [esi]
mov eax, dword [eax + 0x12c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa8]
call fcn.00410590
mov eax, dword [ebp - 0xa8]
push eax
mov ecx, 0x476e60
mov edx, dword [esi]
mov eax, 0x477010
call fcn.0047b8d8
mov dl, 1
mov eax, dword [0x462374]
call fcn.0046367c
mov ebx, eax
lea eax, [ebx + 0x24]
mov edx, dword [0x4a0800]
mov edx, dword [edx + 0x9c]
call fcn.00407154
lea eax, [ebx + 0x28]
mov edx, dword [0x4a0800]
mov edx, dword [edx + 0x60]
call fcn.00407154
lea edx, [ebp - 0xac]
mov eax, dword [0x4a0800]
call fcn.0046da28
mov edx, dword [ebp - 0xac]
lea eax, [ebx + 0x30]
call fcn.00407154
lea eax, [ebx + 0x38]
mov edx, dword [0x4a0800]
mov edx, dword [edx + 0xa0]
call fcn.00407154
lea eax, [ebx + 0x34]
mov edx, 0x477040
call fcn.00407154
lea eax, [ebx + 0x3c]
mov edx, dword [esi]
mov edx, dword [edx + 4]
call fcn.00407154
mov eax, dword [esi]
cmp byte [eax + 0xc], 0
setne al
mov byte [ebx + 0x2c], al
lea eax, [ebx + 0x4c]
mov edx, dword [ebp - 0xc]
call fcn.00407154
lea eax, [ebx + 0x50]
mov edx, dword [ebp - 0x10]
call fcn.00407154
call sub.kernel32.dll_GetLastError_1
mov dword [ebx + 0x54], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
mov eax, ebx
call fcn.00405038
mov eax, dword [esi]
mov eax, dword [eax + 8]
mov edx, 0x477068
call fcn.004078b4
jne 0x4768c4
mov eax, dword [esi]
cmp dword [eax + 0x12c], 0x652
jne 0x4768c4
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0
jle 0x4768c4
push 0xea60
call sub.kernel32.dll_Sleep_1
mov ecx, dword [esi]
mov edx, 0x47707c
mov eax, dword [0x4a0800]
call fcn.0046d570
jmp 0x4763b1
push 0xea60
call sub.kernel32.dll_Sleep_1
cmp byte [ebp - 0x21], 0
je 0x476a8f
mov eax, dword [esi]
push dword [eax + 0xfc]
push dword [eax + 0xf8]
mov eax, dword [esi]
add eax, 0xac
call fcn.0047a16c
test al, al
jne 0x476a8f
mov edx, dword [esi]
mov eax, 0x4770ac
call fcn.0047b888
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0x11
lea edx, [ebp - 0x48]
xor ecx, ecx
mov eax, 0x4770e8
call fcn.00461740
mov byte [ebp - 0x21], 0
jmp 0x476a8f
mov eax, dword [esi]
mov ebx, dword [eax + 0x70]
mov eax, ebx
call fcn.0040895c
push eax
lea eax, [ebp - 0xb0]
push eax
lea edx, [ebp - 0xb4]
mov eax, dword [esi]
call fcn.004743a0
mov edx, dword [ebp - 0xb4]
mov ecx, ebx
mov ebx, dword [esi]
mov eax, dword [ebx + 0xfc]
call dword [ebx + 0xf8]
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0x11
lea edx, [ebp - 0x48]
xor ecx, ecx
mov eax, 0x477120
call fcn.00461740
mov edx, dword [esi]
mov eax, 0x47715c
call fcn.0047b888
mov dl, 1
mov eax, dword [0x462374]
call fcn.0046367c
mov ebx, eax
lea eax, [ebx + 0x24]
mov edx, dword [0x4a0800]
mov edx, dword [edx + 0x9c]
call fcn.00407154
lea eax, [ebx + 0x28]
mov edx, dword [0x4a0800]
mov edx, dword [edx + 0x60]
call fcn.00407154
lea edx, [ebp - 0xb8]
mov eax, dword [0x4a0800]
call fcn.0046da28
mov edx, dword [ebp - 0xb8]
lea eax, [ebx + 0x30]
call fcn.00407154
lea eax, [ebx + 0x38]
mov edx, dword [0x4a0800]
mov edx, dword [edx + 0xa0]
call fcn.00407154
lea eax, [ebx + 0x34]
mov edx, 0x477194
call fcn.00407154
lea eax, [ebx + 0x3c]
mov edx, dword [esi]
mov edx, dword [edx + 4]
call fcn.00407154
mov eax, dword [esi]
cmp byte [eax + 0xc], 0
setne al
mov byte [ebx + 0x2c], al
mov eax, dword [esi]
mov eax, dword [eax + 0x70]
mov dword [ebp - 0x30], eax
call fcn.0040895c
push eax
lea eax, [ebp - 0xbc]
push eax
lea edx, [ebp - 0xc0]
mov eax, dword [esi]
call fcn.004743a0
mov edx, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x30]
mov edi, dword [esi]
mov eax, dword [edi + 0xfc]
call dword [edi + 0xf8]
mov edx, dword [ebp - 0xbc]
lea eax, [ebx + 0x40]
call fcn.00407154
lea eax, [ebx + 0x48]
mov edx, dword [0x4a0800]
mov edx, dword [edx + 0x6c]
call fcn.00407154
lea eax, [ebx + 0x4c]
mov edx, dword [ebp - 0xc]
call fcn.00407154
lea eax, [ebx + 0x44]
xor edx, edx
call fcn.00407154
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
mov eax, ebx
call fcn.00405038
mov eax, dword [ebp - 0xc]
call fcn.004071e0
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0x11
lea edx, [ebp - 0x48]
xor ecx, ecx
mov eax, 0x4771c0
call fcn.00461740
mov eax, dword [esi]
cmp byte [eax + 0x138], 0
jne 0x476ace
movzx edx, byte [ebp - 0x21]
mov eax, dword [esi]
call fcn.00479c18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476b41
lea eax, [ebp - 0xc0]
mov edx, 8
call fcn.0040714c
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.0040714c
lea eax, [ebp - 0x7c]
mov edx, dword [0x47cdd0]
call fcn.00407e88
lea eax, [ebp - 0x74]
mov edx, 3
call fcn.0040714c
lea eax, [ebp - 0x5c]
call fcn.00407144
lea eax, [ebp - 0x20]
mov edx, dword [0x474508]
call fcn.00408b28
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.0040714c
ret