Function at 0x404240
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
mov eax, dword [0x420b98]
sub esp, 0x2f4
push ebx
push ebp
xor ebx, ebx
cmp eax, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ebp, 0x94
jne 0x404287
lea eax, [esp + 0x64]
push eax
mov dword [esp + 0x68], ebp
call edi
test eax, eax
je 0x404282
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x6c]
imul eax, eax, 0x64
add eax, ecx
mov dword [0x420b98], eax
jmp 0x404287
mov eax, dword [0x420b98]
cmp eax, 0x258
jae 0x40429a
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2f4
ret
push esi
push 0x420a88
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x420a88
push ebx
push 0x416a84
push 0x420a88
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x420a88
call esi
mov eax, dword [0x420b98]
cmp eax, ebx
jne 0x4042ff
lea ecx, [esp + 0x68]
push ecx
mov dword [esp + 0x6c], ebp
call edi
test eax, eax
je 0x4042fa
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
imul eax, eax, 0x64
add eax, ecx
mov dword [0x420b98], eax
jmp 0x4042ff
mov eax, dword [0x420b98]
cmp eax, 0x258
jb 0x4043e4
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.SCHTASKS
lea edx, [esp + 0x100]
push edx
call edi
push 0x4165c8
lea eax, [esp + 0x100]
push eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.__C_SCHTASKS__Query__TN__CLaunch___XML_ONE____
lea ecx, [esp + 0x100]
push ecx
call edi
push 0x420a88
lea edx, [esp + 0x100]
push edx
call edi
push 0x416594
lea eax, [esp + 0x100]
push eax
call edi
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
push ebx
push ebx
push 0x400
xor ecx, ecx
push ebx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
push ebx
mov dword [esp + 0x3c], ecx
push ebx
lea ecx, [esp + 0x11c]
push ecx
push ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x78], 1
mov word [esp + 0x7c], bx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x18]
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4043c9
push eax
call edi
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4043e4
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x14]
push edx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebp
push eax
lea ebx, [esp + 0x14]
mov eax, 0x420a88
call fcn.00404500
add esp, 4
push 0x420a88
mov edi, eax
call esi
test edi, edi
je 0x404442
mov esi, dword [esp + 0x10]
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
lea eax, [ebx + ebx]
push eax
push 8
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x40444f
push esi
push eax
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2f4
ret
push ebx
push edi
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push 0
mov ebx, eax
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call esi
test ebx, ebx
jne 0x404486
push edi
push ebx
call ebp
push eax
call esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2f4
ret
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str._Actions
push edi
mov dword [esp + 0x18], 0
call ebx
test eax, eax
je 0x4044e3
push str._Exec
push eax
call ebx
test eax, eax
je 0x4044e3
push str._Arguments_
push eax
mov dword [esp + 0x18], 1
call ebx
mov esi, eax
test esi, esi
je 0x4044e3
push str.__Arguments_
add esi, 0xb
push esi
call ebx
test eax, eax
je 0x4044e3
mov ecx, dword [esp + 0x308]
push esi
push ecx
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x10]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x2f4
ret