Function at 0x54b450
Capabilities:
Accept command line arguments
Create process on windows
Delete file
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x21
push 0
push 0
dec ecx
jne 0x54b458
push ebx
push esi
push edi
mov byte [ebp - 0x29], al
xor eax, eax
push ebp
push 0x54bc1a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x2a], 0
mov byte [ebp - 0x31], 0
mov edx, dword [0x560170]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
mov ecx, 0x54bc38
call fcn.00407474
mov eax, dword [ebp - 0x14]
call fcn.00411ed8
test al, al
je 0x54bbae
mov dl, 1
mov eax, dword [0x428e58]
call fcn.00434874
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x444370]
call fcn.00445b3c
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0051a3e0
call sub.kernel32.dll_GetACP_1
mov edx, eax
mov eax, dword [0x560170]
mov eax, dword [eax]
call fcn.005210a8
test al, al
je 0x54b508
lea eax, [ebp - 0x98]
call fcn.0051e1fc
mov eax, dword [ebp - 0x98]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.005210a8
test al, al
je 0x54b508
xor eax, eax
jmp 0x54b50a
mov al, 1
mov byte [ebp - 0x39], al
push 0
mov ecx, 0x54bc5c
mov edx, 0x54bc74
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
test eax, eax
jle 0x54b6b7
mov dword [ebp - 0x40], eax
mov esi, 1
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xa0], esi
mov byte [ebp - 0x9c], 0
lea edx, [ebp - 0xa0]
xor ecx, ecx
mov eax, 0x54bc90
call fcn.00412f68
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x54bcac
mov edx, dword [ebp - 4]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 4]
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x54bcc4
mov edx, dword [ebp - 4]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 4]
push 0
lea eax, [ebp - 0xa4]
push eax
mov ecx, 0x54bcd8
mov edx, dword [ebp - 4]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 4]
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0x24]
call fcn.00410bfc
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x54b5c6
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x54b5c6
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.00406368
test eax, eax
je 0x54b5cf
sub eax, 4
mov eax, dword [eax]
dec eax
jge 0x54b5d6
mov al, 1
jmp 0x54b5e7
mov edx, dword [ebp - 8]
mov eax, 0x54bcf4
call fcn.004079f8
dec eax
setne al
test al, al
jne 0x54b6ad
mov edx, dword [0x560170]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
call fcn.00407474
mov eax, dword [ebp - 0x10]
call fcn.00411ed8
test al, al
je 0x54bb91
lea edx, [ebp - 0xc0]
mov eax, dword [ebp - 0x10]
call fcn.004cf1e4
lea eax, [ebp - 0xc0]
lea edx, [ebp - 0xb0]
call fcn.004cf340
mov edx, dword [ebp - 0xb0]
lea eax, [ebp - 0xac]
call fcn.004071bc
mov eax, dword [ebp - 0xac]
lea edx, [ebp - 0xa8]
call fcn.00410bfc
mov eax, dword [ebp - 0xa8]
mov edx, dword [ebp - 0x24]
call fcn.00407678
je 0x54b6a4
mov eax, dword [0x55ffd0]
cmp byte [eax + 0x884], 0
je 0x54b691
lea eax, [ebp - 0xc4]
mov ecx, dword [ebp - 0x10]
mov edx, 0x54bd0c
call fcn.00407474
mov eax, dword [ebp - 0xc4]
xor edx, edx
call fcn.00536904
mov eax, dword [ebp - 0x10]
call fcn.0040701c
push eax
call sub.kernel32.dll_DeleteFileW
jmp 0x54bb91
cmp esi, dword [ebp - 0x30]
jne 0x54b6ad
mov byte [ebp - 0x31], 1
inc esi
dec dword [ebp - 0x40]
jne 0x54b536
cmp byte [ebp - 0x31], 0
jne 0x54b6e0
mov eax, dword [0x55ffd0]
cmp byte [eax + 0x884], 0
je 0x54bb91
xor edx, edx
mov eax, 0x54bd68
call fcn.00536904
jmp 0x54bb91
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.0040462c
cmp byte [ebp - 0x39], 0
je 0x54b70c
lea edx, [ebp - 0xc8]
mov eax, dword [ebp - 0x1c]
call fcn.0052308c
mov edx, dword [ebp - 0xc8]
lea eax, [ebp - 0x1c]
call fcn.00406fe4
mov edx, 0x54bdc0
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0xcc]
push eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 0x9c], 0x11
lea edx, [ebp - 0xa0]
xor ecx, ecx
mov eax, 0x54bdd8
call fcn.00412f68
mov edx, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0xd0]
push eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 0x9c], 0x11
lea edx, [ebp - 0xa0]
xor ecx, ecx
mov eax, 0x54bdf8
call fcn.00412f68
mov edx, dword [ebp - 0xd0]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x30]
test eax, eax
jle 0x54ba30
mov dword [ebp - 0x40], eax
mov esi, 1
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xa0], esi
mov byte [ebp - 0x9c], 0
lea edx, [ebp - 0xa0]
xor ecx, ecx
mov eax, 0x54bc90
call fcn.00412f68
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x54bcac
mov edx, dword [ebp - 4]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 4]
push 0
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x54be34
mov edx, dword [ebp - 4]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 4]
lea edx, [ebp - 0xd4]
mov eax, dword [ebp - 0x28]
call fcn.005232bc
mov edx, dword [ebp - 0xd4]
lea eax, [ebp - 0x28]
call fcn.00406fe4
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x54b820
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x54b820
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
call fcn.00406368
test eax, eax
je 0x54b829
sub eax, 4
mov eax, dword [eax]
dec eax
jge 0x54b84d
lea eax, [ebp - 0xd8]
call fcn.0051e1fc
mov edx, dword [ebp - 0xd8]
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
call fcn.00407474
jmp 0x54b8dd
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x54b86a
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x54b86a
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
call fcn.00406368
test eax, eax
je 0x54b873
sub eax, 4
mov eax, dword [eax]
dec eax
jle 0x54b89d
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x54b893
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x54b893
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
call fcn.00406368
cmp word [eax + 2], 0x3a
sete al
jmp 0x54b89f
xor eax, eax
test al, al
je 0x54b8b3
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
call fcn.00522404
jmp 0x54b8dd
lea eax, [ebp - 0xdc]
call fcn.0051e1fc
lea eax, [ebp - 0xdc]
mov edx, dword [ebp - 0x28]
call fcn.004073b4
mov eax, dword [ebp - 0xdc]
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 0x20]
call fcn.00522404
mov eax, dword [0x55ffd0]
cmp byte [eax + 0x884], 0
je 0x54b90b
lea eax, [ebp - 0xe0]
mov ecx, dword [ebp - 0xc]
mov edx, 0x54be48
call fcn.00407474
mov eax, dword [ebp - 0xe0]
xor edx, edx
call fcn.00536904
mov edx, dword [0x560170]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
call fcn.00407474
cmp byte [ebp - 0x39], 0
je 0x54b95c
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x10]
call fcn.0052308c
mov edx, dword [ebp - 0xe4]
lea eax, [ebp - 0x10]
call fcn.00406fe4
lea edx, [ebp - 0xe8]
mov eax, dword [ebp - 0xc]
call fcn.0052308c
mov edx, dword [ebp - 0xe8]
lea eax, [ebp - 0xc]
call fcn.00406fe4
lea eax, [ebp - 0xec]
push eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc0], eax
mov byte [ebp - 0xbc], 0x11
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xb8], eax
mov byte [ebp - 0xb4], 0x11
lea edx, [ebp - 0xc0]
mov ecx, 1
mov eax, 0x54be6c
call fcn.00412f68
mov edx, dword [ebp - 0xec]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0xf0]
push eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 0x9c], 0x11
lea edx, [ebp - 0xa0]
xor ecx, ecx
mov eax, 0x54bdd8
call fcn.00412f68
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00412310
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x54ba05
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x54ba05
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
call fcn.00406368
test eax, eax
je 0x54ba0e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x54ba26
mov eax, dword [ebp - 0x1c]
call fcn.00411f20
test al, al
jne 0x54ba26
mov eax, dword [ebp - 0x1c]
call fcn.00411f44
inc esi
dec dword [ebp - 0x40]
jne 0x54b79a
mov edx, dword [0x560170]
mov edx, dword [edx]
lea eax, [ebp - 0x18]
mov ecx, 0x54be9c
call fcn.00407474
cmp byte [ebp - 0x39], 0
je 0x54ba67
lea edx, [ebp - 0xf4]
mov eax, dword [ebp - 0x18]
call fcn.0052308c
mov edx, dword [ebp - 0xf4]
lea eax, [ebp - 0x18]
call fcn.00406fe4
cmp byte [ebp - 0x29], 0
je 0x54ba8d
call sub.kernel32.dll_GetCommandLineW_1
mov edx, eax
lea eax, [ebp - 0xf8]
call fcn.0040714c
mov edx, dword [ebp - 0xf8]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0xfc]
push eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 0x9c], 0x11
lea edx, [ebp - 0xa0]
xor ecx, ecx
mov eax, 0x54bdd8
call fcn.00412f68
mov edx, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x104]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x104]
lea eax, [ebp - 0x100]
mov ecx, 0
call fcn.004071e4
mov edx, dword [ebp - 0x100]
mov eax, dword [ebp - 0x18]
call fcn.00520420
mov eax, dword [0x55ffd0]
cmp byte [eax + 0x884], 0
je 0x54bb22
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x108]
mov edx, 0x20
call fcn.005369b8
lea eax, [ebp - 0x94]
xor ecx, ecx
mov edx, 0x44
call fcn.004048a0
mov dword [ebp - 0x68], 1
mov word [ebp - 0x64], 0
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x10
call fcn.004048a0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x94]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.0040701c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x54bb8d
mov eax, dword [ebp - 0x4c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x50]
push eax
call sub.kernel32.dll_CloseHandle_1
mov byte [ebp - 0x2a], 1
mov eax, ebx
call fcn.00404ee4
mov eax, dword [ebp - 0x38]
call fcn.00404ee4
mov eax, dword [ebp - 0x14]
call fcn.0040701c
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54bc21
lea eax, [ebp - 0x108]
mov edx, 2
call fcn.00406f88
lea eax, [ebp - 0x100]
call fcn.0040617c
lea eax, [ebp - 0xfc]
mov edx, 0xf
call fcn.00406f88
lea eax, [ebp - 0xb0]
call fcn.0040617c
lea eax, [ebp - 0xac]
mov edx, 3
call fcn.00406f88
lea eax, [ebp - 0x98]
call fcn.00406f80
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.00406f88
ret