Function at 0x5dd38c
Capabilities:
Delete file
Resume thread
Suspend thread

Disassembly:
push 0x35c
mov eax, 0x6e5ed3
call fcn.00432a44
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x338], ecx
mov ecx, eax
mov dword [ebp - 0x33c], eax
call fcn.00437b82
mov eax, dword [esi + 0x34]
xor ecx, ecx
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x344], ecx
mov dword [ebp - 4], ecx
push eax
push ecx
push 0xa
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
xor eax, eax
test esi, esi
mov dword [ebp - 0x344], esi
setne al
push eax
call fcn.004050cb
mov ebx, eax
test ebx, ebx
jne 0x5dd636
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
push ecx
call fcn.004050cb
mov ebx, eax
test ebx, ebx
jne 0x5dd636
mov dword [ebp - 0x364], esi
mov byte [ebp - 4], 1
push 0x5dd658
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
xor ecx, ecx
test edi, edi
mov dword [ebp - 0x340], edi
setne cl
push ecx
call fcn.004050cb
mov ebx, eax
test ebx, ebx
jne 0x5dd62b
mov dword [ebp - 0x368], edi
mov byte [ebp - 4], 2
push 0x443a9c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov dword [ebp - 0x34c], eax
test eax, eax
setne cl
push ecx
call fcn.004050cb
mov ebx, eax
test ebx, ebx
jne 0x5dd620
and dword [ebp - 0x330], eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x330]
mov edi, dword [ebp - 0x338]
push eax
push dword [ebp - 0x33c]
push edi
call fcn.005dd19f
mov ebx, eax
test ebx, ebx
jne 0x5dd5fe
and dword [ebp - 0x334], eax
mov byte [ebp - 4], 4
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x80]
push eax
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
xor ecx, ecx
mov dword [ebp - 0x334], eax
test eax, eax
setne cl
push ecx
call fcn.004050cb
mov ebx, eax
test ebx, ebx
jne 0x5dd5da
push 0x2c8
push eax
lea eax, [ebp - 0x328]
push eax
call fcn.00436326
add esp, 0xc
mov dword [ebp - 0x32c], 0x10007
lea eax, [ebp - 0x32c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
push eax
call fcn.004050cb
mov ebx, eax
test ebx, ebx
jne 0x5dd5da
push 0x50
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.00436326
mov eax, dword [ebp - 0x274]
lea ecx, [ebp - 0x360]
mov dword [ebp - 0x54], eax
add esp, 0xc
mov edi, dword [ebp - 0x330]
lea eax, [ebp - 0x60]
mov dword [ebp - 0x354], eax
lea eax, [ebp - 0x32c]
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0x360], eax
lea eax, [ebp - 0x354]
mov dword [ebp - 0x35c], eax
movzx eax, byte [ebp + 0x10]
push ebx
neg eax
mov dword [ebp - 0x60], 0xc48653ba
push ebx
push ecx
mov ecx, dword [ebp - 0x338]
sbb eax, eax
and eax, 3
mov dword [ebp - 0x358], ebx
push eax
push edi
mov eax, dword [ecx]
call dword [eax + 0x80]
push eax
push dword [ebp - 0x334]
call dword [ebp - 0x34c]
push eax
call fcn.004050cb
mov ebx, eax
test ebx, ebx
je 0x5dd5e0
test edi, edi
je 0x5dd5ca
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov dword [ebp - 0x330], edi
mov eax, dword [ebp - 0x33c]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x5dd5e0
mov edi, dword [ebp - 0x330]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x334]
test eax, eax
je 0x5dd604
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x334], 0
jmp 0x5dd604
mov edi, dword [ebp - 0x330]
mov byte [ebp - 4], 2
test edi, edi
je 0x5dd61a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x330], 0
mov edi, dword [ebp - 0x340]
mov byte [ebp - 4], 1
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x5dd64c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x344], 0
mov eax, ebx
call fcn.00402698
ret 0x10