Function at 0x585ec0
Capabilities:
Create process on windows
Schedule task via at

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x585ec9
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405328
xor eax, eax
push ebp
push 0x58630f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x586320
push 0x586334
call sub.user32.dll_FindWindowA
test eax, eax
je 0x5862e9
dec ebx
je 0x585f21
dec ebx
je 0x586017
dec ebx
je 0x5860f9
jmp 0x58629d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x5d2], 0
je 0x585f3f
xor ecx, ecx
mov edx, 0x586348
call fcn.00530888
mov edx, dword [0x507a40]
mov eax, 0x10
call fcn.00405e14
mov ebx, eax
mov edx, 0x10
mov eax, ebx
call fcn.00408604
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x5d2], 0
je 0x585f7b
xor ecx, ecx
mov edx, 0x586358
call fcn.00530888
mov eax, dword [0x59fdf0]
mov eax, dword [eax]
mov eax, dword [eax + 0x40]
mov dword [ebx], eax
mov eax, dword [0x59fdf0]
mov eax, dword [eax]
mov eax, dword [eax + 0x4c]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x5d2], 0
je 0x585fb2
xor ecx, ecx
mov edx, 0x586368
call fcn.00530888
lea eax, [ebx + 8]
mov edx, dword [ebp - 8]
call fcn.00404eb0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x5d2], 0
je 0x585fdb
xor ecx, ecx
mov edx, 0x586378
call fcn.00530888
push ebx
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x585a40
xor edx, edx
xor eax, eax
call fcn.00404e10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x5d2], 0
je 0x5862e9
xor ecx, ecx
mov edx, 0x586388
call fcn.00530888
jmp 0x5862e9
xor edx, edx
push ebp
push 0x58609e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x5d2], 0
je 0x586043
xor ecx, ecx
mov edx, 0x586398
call fcn.00530888
push 5
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405338
push eax
push 0x5863a0
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x586073
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00585ec0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x5d2], 0
je 0x586091
xor ecx, ecx
mov edx, 0x5863b0
call fcn.00530888
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5862e9
xor edx, edx
push ebp
push 0x586254
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x5d2], 0
je 0x586125
xor ecx, ecx
mov edx, 0x5863e0
call fcn.00530888
lea edx, [ebp - 0x24]
mov eax, 0x5863f0
call fcn.004e81bc
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
call fcn.00418950
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x5d2], 0
je 0x58615b
xor ecx, ecx
mov edx, 0x586418
call fcn.00530888
push 0
push 0x586420
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.00414124
add esp, 0x10
push 0
push 0x586428
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.00414124
add esp, 0x10
mov eax, dword [0x59fdf0]
mov eax, dword [eax]
mov eax, dword [eax + 0x40]
push eax
push 0x586434
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.00414124
add esp, 0x10
mov eax, dword [0x59fdf0]
mov eax, dword [eax]
mov eax, dword [eax + 0x4c]
push eax
push 0x586440
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.00414124
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x5d2], 0
je 0x5861df
xor ecx, ecx
mov edx, 0x586454
call fcn.00530888
push 0xffffffffffffffff
push 0x58645c
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.00414124
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x5d2], 0
je 0x586212
xor ecx, ecx
mov edx, 0x586470
call fcn.00530888
lea eax, [ebp - 8]
push eax
push 0x586478
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.00414124
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x5d2], 0
je 0x586247
xor ecx, ecx
mov edx, 0x586490
call fcn.00530888
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5862e9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x5d2], 0
je 0x5862bb
xor ecx, ecx
mov edx, 0x5864a0
call fcn.00530888
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00585ec0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x5d2], 0
je 0x5862e9
xor ecx, ecx
mov edx, 0x5864b0
call fcn.00530888
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x586316
lea eax, [ebp - 0x24]
call fcn.00406cf4
lea eax, [ebp - 0x20]
call fcn.0041411c
lea eax, [ebp - 8]
call fcn.00404e5c
ret