Function at 0x425bec
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x50
push 0
push 0
dec ecx
jne 0x425bf4
push ecx
push ebx
push esi
push edi
lea ebx, [ebp - 0x1cc]
mov esi, dword [0x43f370]
xor eax, eax
push ebp
push 0x4264c0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x426493
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00425398
push 0x32
call sub.kernel32.dll_Sleep_1
xor edi, edi
mov eax, dword [0x43f66c]
mov eax, dword [eax]
call fcn.00405294
mov edx, eax
mov eax, ebx
call fcn.004031c4
mov eax, ebx
call fcn.00402f54
call fcn.00402bb0
mov edx, 0x4264d8
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
mov edx, 0x4264ec
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x4264fc
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
lea eax, [ebp - 0x1d8]
call fcn.004050e0
mov eax, dword [ebp - 0x1d8]
call fcn.00405294
mov edx, eax
lea eax, [ebp - 0x1d4]
call fcn.00404fcc
push dword [ebp - 0x1d4]
push 0x42650c
lea eax, [ebp - 0x1d0]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x1d0]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x426518
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
lea eax, [ebp - 0x1e4]
call fcn.004050e0
mov eax, dword [ebp - 0x1e4]
call fcn.00405294
mov edx, eax
lea eax, [ebp - 0x1e0]
call fcn.00404fcc
push dword [ebp - 0x1e0]
push 0x42652c
lea eax, [ebp - 0x1dc]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x1dc]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x4264fc
mov eax, dword [0x43f570]
push dword [eax]
push 0x426540
lea eax, [ebp - 0x1e8]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x1e8]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x426518
mov eax, dword [0x43f570]
mov eax, dword [eax]
call fcn.00405294
mov edx, eax
lea eax, [ebp - 0x1f0]
call fcn.00404fcc
push dword [ebp - 0x1f0]
push 0x42652c
lea eax, [ebp - 0x1ec]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x1ec]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
lea edx, [ebp - 0x1f8]
mov eax, 1
call fcn.00402df4
mov eax, dword [ebp - 0x1f8]
lea edx, [ebp - 0x1f4]
call fcn.00408970
mov eax, dword [ebp - 0x1f4]
push eax
lea edx, [ebp - 0x1fc]
mov eax, dword [0x43f3b8]
mov eax, dword [eax]
call fcn.00408970
mov edx, dword [ebp - 0x1fc]
pop eax
call fcn.004051e0
je 0x425ea2
lea edx, [ebp - 0x204]
mov eax, 1
call fcn.00402df4
mov eax, dword [ebp - 0x204]
lea edx, [ebp - 0x200]
call fcn.00408970
mov eax, dword [ebp - 0x200]
push eax
lea edx, [ebp - 0x208]
mov eax, dword [0x43f394]
mov eax, dword [eax]
call fcn.00408970
mov edx, dword [ebp - 0x208]
pop eax
call fcn.004051e0
je 0x425ea2
push 0x4264fc
lea edx, [ebp - 0x210]
xor eax, eax
call fcn.00402df4
push dword [ebp - 0x210]
push 0x426550
lea eax, [ebp - 0x20c]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x20c]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x4264fc
mov eax, dword [0x43f4c4]
push dword [eax]
push 0x426550
lea eax, [ebp - 0x214]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x214]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x4264fc
mov eax, dword [0x43f400]
push dword [eax]
push 0x426550
lea eax, [ebp - 0x218]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x218]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x4264fc
mov eax, dword [0x43f3d0]
push dword [eax]
push 0x426550
lea eax, [ebp - 0x21c]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x21c]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x4264fc
mov eax, dword [0x43f3fc]
push dword [eax]
push 0x426540
lea eax, [ebp - 0x220]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x220]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x4264fc
mov eax, dword [0x43f6d0]
push dword [eax]
push 0x426540
lea eax, [ebp - 0x224]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x224]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x4264fc
mov eax, dword [0x43f4d4]
push dword [eax]
push 0x426550
lea eax, [ebp - 0x228]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x228]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x4264fc
mov eax, dword [0x43f404]
push dword [eax]
push 0x426550
lea eax, [ebp - 0x22c]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x22c]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x426560
push dword [esi + 0x10]
push 0x426570
lea eax, [ebp - 0x230]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x230]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x426560
push dword [esi + 0x10]
push 0x426584
lea eax, [ebp - 0x234]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x234]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x426518
mov eax, dword [0x43f4c4]
push dword [eax]
push 0x42652c
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x238]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x426518
mov eax, dword [0x43f4d4]
push dword [eax]
push 0x42652c
lea eax, [ebp - 0x23c]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x23c]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x426518
mov eax, dword [0x43f404]
push dword [eax]
push 0x42652c
lea eax, [ebp - 0x240]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x240]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x4264fc
lea edx, [ebp - 0x248]
mov eax, dword [0x43f48c]
mov eax, dword [eax]
call fcn.00421438
push dword [ebp - 0x248]
push 0x426550
lea eax, [ebp - 0x244]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x244]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x4264fc
mov eax, dword [0x43f48c]
push dword [eax]
push 0x42650c
lea eax, [ebp - 0x24c]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x24c]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x4264fc
mov eax, dword [0x43f5a8]
push dword [eax]
push 0x426550
lea eax, [ebp - 0x250]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x250]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x4264fc
mov eax, dword [0x43f658]
push dword [eax]
push 0x426550
lea eax, [ebp - 0x254]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x254]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x4264fc
mov eax, dword [0x43f6f4]
push dword [eax]
push 0x426550
lea eax, [ebp - 0x258]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x258]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x4264fc
mov eax, dword [0x43f640]
push dword [eax]
push 0x426550
lea eax, [ebp - 0x25c]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x25c]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x4264fc
mov eax, dword [0x43f640]
push dword [eax]
push 0x426598
lea eax, [ebp - 0x260]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x260]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x426518
mov eax, dword [0x43f640]
mov eax, dword [eax]
call fcn.00405294
mov edx, eax
lea eax, [ebp - 0x268]
call fcn.00404fcc
push dword [ebp - 0x268]
push 0x42652c
lea eax, [ebp - 0x264]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x264]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x426518
lea edx, [ebp - 0x274]
mov eax, dword [0x43f48c]
mov eax, dword [eax]
call fcn.00421438
mov eax, dword [ebp - 0x274]
call fcn.00405294
mov edx, eax
lea eax, [ebp - 0x270]
call fcn.00404fcc
push dword [ebp - 0x270]
push 0x42652c
lea eax, [ebp - 0x26c]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x26c]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x4265ac
lea eax, [ebp - 0x27c]
call fcn.00420f60
push dword [ebp - 0x27c]
push 0x4265c0
lea eax, [ebp - 0x278]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x278]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
mov ecx, dword [esi + 0x10]
lea eax, [ebp - 0x280]
mov edx, 0x4265ac
call fcn.004050e0
mov edx, dword [ebp - 0x280]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
push 0x4264fc
mov eax, dword [0x43f66c]
push dword [eax]
push 0x426550
lea eax, [ebp - 0x284]
mov edx, 3
call fcn.00405154
mov edx, dword [ebp - 0x284]
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
mov edx, 0x4265d0
mov eax, ebx
call fcn.00405428
call fcn.00403ae8
call fcn.00402bb0
mov eax, ebx
call fcn.00403368
call fcn.00402bb0
mov edi, 0x3e8
cmp edi, 0x3e8
jl 0x425c35
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x43f66c]
mov eax, dword [eax]
call fcn.004090d0
test al, al
je 0x426489
push 0
mov eax, dword [0x43f66c]
mov eax, dword [eax]
call fcn.00405294
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42649d
call fcn.00404c60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4264c7
lea eax, [ebp - 0x284]
mov edx, 0x2e
call fcn.00404df8
ret