Function at 0x402bb0
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x180
push ebx
mov ebx, eax
cmp dword [ebx + 4], 0
push esi
push edi
jle 0x402e72
lea eax, [ebp - 0x17c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x17c]
push ecx
push 0
push 0x4051f3
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0xb
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov edi, 0xb
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edi
test esi, esi
jne 0x402c1a
xor edi, edi
mov dword [ebp - 8], edi
jmp 0x402c3d
mov eax, dword [str.cmd.exe__c]
mov dword [esi], eax
mov ecx, dword [0x4051f8]
mov dword [esi + 4], ecx
mov dx, word [0x4051fc]
mov word [esi + 8], dx
mov al, byte [0x4051fe]
mov byte [esi + 0xa], al
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
test eax, eax
je 0x402ca5
lea ebx, [eax + edi]
test ebx, ebx
je 0x402c91
push ebx
test edi, edi
jle 0x402c6a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x402c79
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov edi, ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
test esi, esi
jne 0x402c8e
xor edi, edi
mov dword [ebp - 8], edi
jmp 0x402ca5
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
push eax
mov ecx, edi
sub ecx, eax
push edx
add ecx, esi
push ecx
call sub.ntdll.dll_memcpy
add esp, 0xc
lea ebx, [edi + 1]
test ebx, ebx
je 0x402ce7
push ebx
test edi, edi
jle 0x402cc3
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x402cd2
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov edi, ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
test esi, esi
jne 0x402ce7
xor edi, edi
mov dword [ebp - 8], edi
jmp 0x402cf1
mov dl, byte [0x405200]
mov byte [edi + esi - 1], dl
lea eax, [ebp - 0x17c]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402d00
sub eax, edx
mov dword [ebp - 0x10], eax
je 0x402d6a
lea ebx, [eax + edi]
test ebx, ebx
je 0x402d53
push ebx
test edi, edi
jle 0x402d2c
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x402d3b
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov edi, ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
test esi, esi
jne 0x402d50
xor edi, edi
mov dword [ebp - 8], edi
jmp 0x402d6a
mov eax, dword [ebp - 0x10]
push eax
mov edx, edi
lea ecx, [ebp - 0x17c]
sub edx, eax
push ecx
add edx, esi
push edx
call sub.ntdll.dll_memcpy
add esp, 0xc
lea ebx, [edi + 1]
test ebx, ebx
je 0x402dac
push ebx
test edi, edi
jle 0x402d88
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x402d97
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov edi, ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
test esi, esi
jne 0x402dac
xor edi, edi
mov dword [ebp - 8], edi
jmp 0x402db5
mov al, byte [0x405204]
mov byte [edi + esi - 1], al
lea ecx, [ebp - 0x74]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xor ebx, ebx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x74]
push ecx
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push esi
xor edx, edx
push ebx
mov word [ebp - 0x44], dx
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402e3b
mov edx, dword [ebp - 0x28]
push 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x402e3b
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x17c]
call fcn.00402730
test al, al
je 0x402e3b
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
lea ecx, [ebp - 0x14]
push ecx
push edx
push eax
call fcn.00402100
add esp, 0x10
test al, al
jne 0x402e7b
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
lea ecx, [ebp - 0x17c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x10], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
jle 0x402e62
mov edx, dword [ebp - 0x14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
test edi, edi
jle 0x402e72
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x17c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea esi, [ebp - 0x14]
call fcn.00403f00
lea esi, [ebp - 0xc]
call fcn.00403f00
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret