Function at 0x7379a8
Capabilities:
Acquire debug privileges
Create process on windows
Empty the recycle bin

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x13
push 0
push 0
dec ecx
jne 0x7379b0
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov ebx, 0x7b0a30
xor eax, eax
push ebp
push 0x738326
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00735208
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x738334
mov eax, dword [0x7a922c]
mov eax, dword [eax]
call eax
push 0
push 0xf4240
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
call fcn.0040c3c4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
xor eax, eax
mov dword [0x7b0cb8], eax
xor eax, eax
mov dword [0x7b0cbc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x434]
mov edx, dword [eax]
call dword [edx + 0x114]
mov eax, 0x7b0cc8
mov edx, 0x738348
call fcn.0040aa64
mov eax, dword [ebp - 8]
call fcn.00735208
mov ecx, ebx
mov edx, 0x1ff
mov eax, dword [0x7b0cc8]
call fcn.00426490
test eax, eax
jne 0x737ebb
test byte [ebx + 0x10], 0x10
je 0x737eac
mov eax, dword [ebx + 0x14]
mov edx, 0x738370
call fcn.0040b6d4
je 0x737eac
mov eax, dword [ebx + 0x14]
mov edx, 0x738380
call fcn.0040b6d4
je 0x737eac
mov eax, dword [ebx + 0x14]
mov edx, 0x738394
call fcn.0040b6d4
je 0x737eac
mov eax, dword [ebx + 0x14]
mov edx, 0x7383bc
call fcn.0040b6d4
je 0x737eac
mov eax, dword [ebx + 0x14]
mov edx, 0x7383ec
call fcn.0040b6d4
je 0x737eac
mov eax, dword [ebx + 0x14]
mov edx, 0x738408
call fcn.0040b6d4
je 0x737eac
mov eax, dword [ebx + 0x14]
mov edx, 0x738428
call fcn.0040b6d4
je 0x737eac
mov eax, dword [ebx + 0x14]
mov edx, 0x738450
call fcn.0040b6d4
je 0x737eac
inc dword [0x7b0cbc]
lea eax, [ebp - 0x3c]
mov ecx, dword [ebx + 0x14]
mov edx, 0x73846c
call fcn.0040b53c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x434]
mov eax, dword [eax + 0x2d0]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x400]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x737b47
mov eax, 0x73849c
call fcn.00426520
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3d0]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x737b7e
push 0x7384d4
push dword [ebx + 0x14]
push 0x7384f4
lea eax, [ebp - 0x40]
mov edx, 3
call fcn.0040b5c4
mov eax, dword [ebp - 0x40]
call fcn.00732c18
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3e8]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x737bfc
push 0x7384d4
push dword [ebx + 0x14]
push 0x738528
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.0040b5c4
mov eax, dword [ebp - 0x44]
call fcn.00732c18
push 0x7385a8
push dword [ebx + 0x14]
push 0x7385ec
lea eax, [ebp - 0x48]
mov edx, 3
call fcn.0040b5c4
mov eax, dword [ebp - 0x48]
call fcn.00732c18
push 0
push 0x73864c
push dword [ebx + 0x14]
push 0x738528
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.0040b5c4
mov eax, dword [ebp - 0x4c]
push eax
call sub.KERNEL32.DLL_WinExec
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x408]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x737c33
push 0x7384d4
push dword [ebx + 0x14]
push 0x73868c
lea eax, [ebp - 0x50]
mov edx, 3
call fcn.0040b5c4
mov eax, dword [ebp - 0x50]
call fcn.00732c18
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ec]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x737c6a
push 0x7384d4
push dword [ebx + 0x14]
push 0x7386ec
lea eax, [ebp - 0x54]
mov edx, 3
call fcn.0040b5c4
mov eax, dword [ebp - 0x54]
call fcn.00732c18
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x40c]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x737ca1
push 0x7384d4
push dword [ebx + 0x14]
push 0x738764
lea eax, [ebp - 0x58]
mov edx, 3
call fcn.0040b5c4
mov eax, dword [ebp - 0x58]
call fcn.00732c18
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3f8]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x737cd8
push 0x7384d4
push dword [ebx + 0x14]
push 0x7387e0
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.0040b5c4
mov eax, dword [ebp - 0x5c]
call fcn.00732c18
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3f0]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x737d0f
push 0x7384d4
push dword [ebx + 0x14]
push 0x73883c
lea eax, [ebp - 0x60]
mov edx, 3
call fcn.0040b5c4
mov eax, dword [ebp - 0x60]
call fcn.00732c18
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x410]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x737d46
push 0x7384d4
push dword [ebx + 0x14]
push 0x73888c
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.0040b5c4
mov eax, dword [ebp - 0x64]
call fcn.00426520
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x414]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x737d7d
push 0x7384d4
push dword [ebx + 0x14]
push 0x7388f8
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.0040b5c4
mov eax, dword [ebp - 0x68]
call fcn.00732c18
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x418]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x737db4
push 0x7384d4
push dword [ebx + 0x14]
push 0x738960
lea eax, [ebp - 0x6c]
mov edx, 3
call fcn.0040b5c4
mov eax, dword [ebp - 0x6c]
call fcn.00426520
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3f4]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x737deb
push 0x7384d4
push dword [ebx + 0x14]
push 0x7389d8
lea eax, [ebp - 0x70]
mov edx, 3
call fcn.0040b5c4
mov eax, dword [ebp - 0x70]
call fcn.00732c18
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x420]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x737e22
push 0x7384d4
push dword [ebx + 0x14]
push 0x738a38
lea eax, [ebp - 0x74]
mov edx, 3
call fcn.0040b5c4
mov eax, dword [ebp - 0x74]
call fcn.00732c18
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x42c]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x737e7b
push 0x7384d4
push dword [ebx + 0x14]
push 0x738a88
lea eax, [ebp - 0x78]
mov edx, 3
call fcn.0040b5c4
mov eax, dword [ebp - 0x78]
call fcn.00732c18
push 0x7384d4
push dword [ebx + 0x14]
push 0x738ad4
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.0040b5c4
mov eax, dword [ebp - 0x7c]
call fcn.00732c18
push 0x73846c
push dword [ebx + 0x14]
push 0x738b4c
lea eax, [ebp - 0x80]
mov edx, 3
call fcn.0040b5c4
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x434]
mov eax, dword [eax + 0x2d0]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, ebx
call fcn.004264e0
test eax, eax
je 0x737a59
mov eax, ebx
call fcn.00426504
mov eax, dword [ebp - 8]
call fcn.00735208
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3cc]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x737f11
mov eax, 0x738b70
call fcn.00732c18
mov eax, 0x738bf8
call fcn.00732c18
mov eax, 0x738c7c
call fcn.00732c18
mov eax, 0x738d00
call fcn.00732c18
mov eax, 0x738d2c
call fcn.00732c18
mov eax, dword [ebp - 8]
call fcn.00735208
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3d4]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x737f38
mov eax, 0x738d48
call fcn.00732c18
mov eax, dword [ebp - 8]
call fcn.00735208
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3d8]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x737f5f
mov eax, 0x738d7c
call fcn.00732c18
mov eax, dword [ebp - 8]
call fcn.00735208
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3dc]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x738004
xor eax, eax
push ebp
push 0x737fe1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x738da4
call sub.KERNEL32.DLL_WinExec
push 0x64
call sub.KERNEL32.DLL_Sleep_2
push 0
push 0x738dc4
call sub.KERNEL32.DLL_WinExec
push 0x64
call sub.KERNEL32.DLL_Sleep_2
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00538a74
push eax
call sub.shell32.dll_SHEmptyRecycleBinA
push 0x64
call sub.KERNEL32.DLL_Sleep_2
mov eax, 0x738dec
call fcn.00732c18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x738004
mov eax, dword [ebp - 8]
call fcn.00735208
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x73802b
mov eax, 0x738e58
call fcn.00732c18
mov eax, dword [ebp - 8]
call fcn.00735208
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3e4]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x738052
mov eax, 0x738e8c
call fcn.00732c18
mov eax, dword [ebp - 8]
call fcn.00735208
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x428]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x738079
mov eax, 0x738eec
call fcn.00732c18
lea edx, [ebp - 0x88]
mov eax, dword [0x7b0cbc]
call fcn.00425674
mov ecx, dword [ebp - 0x88]
lea eax, [ebp - 0x84]
mov edx, 0x738f10
call fcn.0040b53c
mov edx, dword [ebp - 0x84]
mov eax, dword [0x7b0a28]
mov eax, dword [eax + 0x434]
mov eax, dword [eax + 0x2d0]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x738f54
lea edx, [ebp - 0x90]
mov eax, dword [0x7b0cb8]
call fcn.00425674
push dword [ebp - 0x90]
push 0x738fb8
lea eax, [ebp - 0x8c]
mov edx, 3
call fcn.0040b5c4
mov edx, dword [ebp - 0x8c]
mov eax, dword [0x7b0a28]
mov eax, dword [eax + 0x434]
mov eax, dword [eax + 0x2d0]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
fild dword [0x7b0cc4]
fmul dword [0x738fbc]
fdiv dword [0x738fc0]
fstp xword [0x7b1c80]
wait
xor eax, eax
mov dword [0x7b0cc4], eax
xor eax, eax
mov dword [0x7b1c80], eax
mov dword [0x7b1c84], eax
mov word [0x7b1c88], ax
mov eax, dword [ebp - 8]
call fcn.00735208
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3dc]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x7381a1
mov edx, 0x738fd0
mov al, 1
call fcn.00732b5c
test al, al
jne 0x738186
mov eax, dword [0x7b0a28]
mov eax, dword [eax + 0x434]
mov eax, dword [eax + 0x2d0]
mov edx, 0x739000
mov ecx, dword [eax]
call dword [ecx + 0x3c]
jmp 0x7381a1
mov eax, dword [0x7b0a28]
mov eax, dword [eax + 0x434]
mov eax, dword [eax + 0x2d0]
mov edx, 0x73902c
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [ebp - 8]
call fcn.00735208
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x738334
mov eax, dword [0x7a922c]
mov eax, dword [eax]
call eax
push 0
push 0xf4240
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
call fcn.0040c3c4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
fild qword [ebp - 0x18]
fdiv dword [0x738fc0]
fild qword [ebp - 0x10]
fdiv dword [0x738fc0]
fsubp st(1)
fstp qword [ebp - 0x20]
wait
fldz
fcomp qword [ebp - 0x20]
wait
fnstsw ax
sahf
jbe 0x738206
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
fld qword [ebp - 0x20]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea edx, [ebp - 4]
mov eax, dword [0x7a9614]
call fcn.004282e0
mov eax, 0x7b0ccc
mov edx, dword [ebp - 4]
call fcn.0040aa64
push 0x739080
push dword [0x7b0ccc]
push 0x7390a0
lea eax, [ebp - 0x94]
mov edx, 3
call fcn.0040b5c4
mov edx, dword [ebp - 0x94]
mov eax, dword [0x7b0a28]
mov eax, dword [eax + 0x434]
mov eax, dword [eax + 0x2d0]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x7390b4
push dword [0x7b0ccc]
push 0x7390a0
lea eax, [ebp - 0x98]
mov edx, 3
call fcn.0040b5c4
mov edx, dword [ebp - 0x98]
mov eax, dword [0x7b0a28]
mov eax, dword [eax + 0x5b0]
call fcn.0052f6f4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4c4]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x90]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x504]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x90]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x524]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x90]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x534]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x90]
mov eax, dword [ebp - 8]
call fcn.00735208
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x548]
xor edx, edx
call fcn.00660090
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x73832d
lea eax, [ebp - 0x98]
mov edx, 0x18
call fcn.0040a6e4
lea eax, [ebp - 4]
call fcn.0040a684
ret