Function at 0x54ee80
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2308
call fcn.00554650
mov eax, dword [0x5c04b4]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x2298], ecx
mov dword [ebp - 0x22b8], eax
call fcn.0050a830
mov esi, dword [edi + 0x88]
dec esi
mov dword [ebp - 0x22b0], eax
cmp esi, 3
ja case.default.0x54eec2
jmp dword [esi*4 + 0x54f5f0]
mov dword [ebp - 0x2294], 1
jmp 0x54ef14
mov dword [ebp - 0x2294], 1
mov ebx, 1
jmp 0x54ef16
xor ebx, ebx
mov dword [ebp - 0x2294], 1
lea esi, [ebx + 1]
jmp 0x54ef18
mov ebx, 1
mov dword [ebp - 0x2294], 1
mov esi, ebx
jmp 0x54ef18
mov dword [ebp - 0x2294], 0
xor ebx, ebx
xor esi, esi
lea eax, [ebp - 0x2290]
mov dword [ebp - 0x2290], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x5c0090]
test eax, eax
je 0x54f1e3
cmp dword [ebp - 0x2290], 0
setne al
test al, al
je 0x54f1e3
push 0x44
lea eax, [ebp - 0x2304]
push 0
push eax
call sub.MSVCR120.dll_memset
xor eax, eax
mov dword [ebp - 0x2304], 0x44
add esp, 8
mov dword [ebp - 0x22ac], eax
mov edx, 0x104
mov dword [ebp - 0x22a8], eax
lea ecx, [ebp - 0x454]
mov dword [ebp - 0x22a4], eax
mov dword [ebp - 0x22a0], eax
call fcn.0050a4d0
add esp, 4
test al, al
je 0x54f148
push str.SysInspector.exe
mov edx, 0x104
lea ecx, [ebp - 0x454]
call fcn.0052fae0
add esp, 4
lea eax, [ebp - 0xa6c]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
push ecx
lea ecx, [ebp - 0x65c]
call fcn.0054e760
lea eax, [ebp - 0x65c]
mov edx, 0x208
push eax
lea ecx, [ebp - 0xa6c]
call fcn.0052fae0
add esp, 0xc
mov dword [ebp - 0x2290], str._privacy
cmp dword [edi + 0x80], 0
je 0x54f011
mov dword [ebp - 0x2290], 0x574c4c
cmp dword [edi + 0x90], 1
mov dword [ebp - 0x2298], str._wantcloud
je 0x54f02e
mov dword [ebp - 0x2298], 0x574c4c
mov edx, str._fastlistskipmodules
cmp esi, 1
je 0x54f03d
mov edx, 0x574c4c
mov ecx, str._fastlistnorepo
cmp ebx, 1
je 0x54f04c
mov ecx, 0x574c4c
cmp dword [ebp - 0x2294], 1
mov eax, str._fastlist
je 0x54f05f
mov eax, 0x574c4c
push dword [ebp - 0x2290]
push dword [ebp - 0x2298]
push edx
push ecx
push eax
lea eax, [ebp - 0xa6c]
push eax
lea eax, [ebp - 0x454]
push eax
push str.__s___gen__s___supersilent__s__s__s__s__s
lea eax, [ebp - 0x1a8c]
push 0x410
push eax
call fcn.0052fc70
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x126c], ax
lea eax, [ebp - 0x126a]
push eax
call sub.MSVCR120.dll_memset
add esp, 0x34
lea eax, [ebp - 0x126c]
push str.USERCTXX
push 0x400
push eax
call dword [sym.imp.MSVCR120.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x126c]
push dword [edi + 0x8c]
push 0x400
push eax
call dword [sym.imp.MSVCR120.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x126c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x126c]
lea edx, [eax*2 + 2]
call fcn.0054edf0
mov esi, eax
xor eax, eax
test esi, esi
je 0x54f111
mov eax, 0x400
lea ecx, [ebp - 0x22ac]
push ecx
lea ecx, [ebp - 0x2304]
push ecx
push 0
push esi
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x1a8c]
push eax
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push esi
test eax, eax
jne 0x54f15b
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00553510
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0xffffffffffffffff
push dword [ebp - 0x22ac]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x54f148
lea eax, [ebp - 0x22b0]
push eax
push dword [ebp - 0x22ac]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x54f148
push dword [ebp - 0x22a8]
mov esi, dword [0x5c001c]
call esi
push dword [ebp - 0x22ac]
call esi
cmp dword [ebp - 0x22b0], 1
jne 0x54f148
mov edx, dword [ebp - 0x22b8]
lea eax, [ebp - 0x229c]
push ecx
push eax
lea ecx, [ebp - 0xa6c]
call fcn.0054ec10
add esp, 8
test eax, eax
je 0x54f148
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00553510
mov esp, ebp
pop ebp
ret
cmp byte [0x5c6e48], 0
jne 0x54f22f
push ecx
mov ecx, dword [ebp - 0x2298]
lea eax, [ebp - 0x24c]
push eax
mov edx, 1
call fcn.0054ed60
add esp, 8
lea eax, [ebp - 0x24c]
push 0
push 0
push 0x80
push 0x5c6e48
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [0x5c6ec7], 0
cmp byte [0x5c6f48], 0
jne 0x54f27b
push ecx
mov ecx, dword [ebp - 0x2298]
lea eax, [ebp - 0x24c]
push eax
mov edx, 7
call fcn.0054ed60
add esp, 8
lea eax, [ebp - 0x24c]
push 0
push 0
push 0x80
push 0x5c6f48
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [0x5c6fc7], 0
cmp byte [0x5c6ec8], 0
jne 0x54f2c7
push ecx
mov ecx, dword [ebp - 0x2298]
lea eax, [ebp - 0x24c]
push eax
mov edx, 0xa
call fcn.0054ed60
add esp, 8
lea eax, [ebp - 0x24c]
push 0
push 0
push 0x80
push 0x5c6ec8
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [0x5c6f47], 0
xor eax, eax
lea ecx, [ebp - 0x8c]
mov word [ebp - 0x8c], ax
lea edx, [eax + 0x40]
call fcn.0050aa70
push 0x587600
mov edx, 0x40
lea ecx, [ebp - 0x8c]
call fcn.0052fae0
mov edx, 0x20
lea ecx, [ebp - 0xcc]
call fcn.0050a950
add esp, 4
lea eax, [ebp - 0xcc]
mov edx, 0x40
lea ecx, [ebp - 0x8c]
push eax
call fcn.0052fae0
add esp, 4
lea eax, [ebp - 0x8c]
push 0x40
push eax
call dword [sym.imp.MSVCR120.dll__wcsupr_s]
push 0x59b3c0
mov edx, 0x40
lea ecx, [ebp - 0x8c]
call fcn.0052fae0
add esp, 0xc
lea ecx, [ebp - 0x8c]
mov edx, 0x40
push edi
call fcn.0052fae0
add esp, 4
lea ecx, [ebp - 0x8c]
mov edx, 0x40
push 0x587130
call fcn.0052fae0
add esp, 4
lea eax, [ebp - 0x14c]
push 0
push 0
push 0x80
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x8c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [ebp - 0x22a4]
mov byte [ebp - 0xcd], 0
call fcn.0043f510
test al, al
je 0x54f3bf
cmp dword [ebp - 0x22a4], 0
mov dword [ebp - 0x2290], 1
jne 0x54f3c9
mov dword [ebp - 0x2290], 0
lea ecx, [ebp - 0x22a4]
call fcn.0043f510
test al, al
je 0x54f3eb
cmp dword [ebp - 0x22a0], 0
mov dword [ebp - 0x229c], 1
jne 0x54f3f5
mov dword [ebp - 0x229c], 0
lea ecx, [ebp - 0x22a4]
call fcn.0043f510
test al, al
je 0x54f41d
cmp dword [ebp - 0x22a4], 0
jne 0x54f416
cmp dword [ebp - 0x22a0], 0
je 0x54f41d
mov ecx, 1
jmp 0x54f41f
xor ecx, ecx
push dword [edi + 0x90]
xor eax, eax
test ecx, ecx
push dword [edi + 0x8c]
setne al
push esi
push ebx
push dword [ebp - 0x2294]
push 1
push 1
push 1
push dword [ebp - 0x2290]
push dword [ebp - 0x229c]
push 0
push 0x5c6ec8
push 0x5c6f48
push 0x5c6e48
push eax
push dword [edi + 0x84]
xor eax, eax
cmp dword [edi + 0x80], eax
setne al
push eax
push dword [ebp - 0x22b0]
lea eax, [ebp - 0x14c]
push eax
push str.__xml_version_1.0__encoding_utf_8____r_n_SYSTEMSTATUS__r_n___SECTION_ID_SOME_NUMBER___r_n_____GENERATE__r_n_______NODE_NAME_GUI_Version__VALUE__s__TYPE_STRING_____r_n_______NODE_NAME_Language__VALUE__x__TYPE_DWORD_____r_n_______NODE_NAME_Personal__VALUE__d__TYPE_DWORD_____r_n_______NODE_NAME_AntiStealth__VALUE__d__TYPE_DWORD_____r_n_______NODE_NAME_SelfDefense__VALUE__d__TYPE_DWORD_____r_n_______NODE_NAME_VersionLoader__VALUE__s__TYPE_STRING_____r_n_______NODE_NAME_VersionAntiStealth__VALUE__s__TYPE_STRING_____r_n_______NODE_NAME_VersionSysInspector__VALUE__s__TYPE_STRING_____r_n_______NODE_NAME_StandAlone__VALUE__x__TYPE_DWORD_____r_n_______NODE_NAME_SD_RegistryProtected__VALUE__x__TYPE_DWORD_____r_n_______NODE_NAME_SD_ProcessesProtected__VALUE__x__TYPE_DWORD_____r_n_______NODE_NAME_Feature_Node_TaskScheduler__VALUE__x__TYPE_DWORD_____r_n_______NODE_NAME_Feature_Node_Rootkits__VALUE__x__TYPE_DWORD_____r_n_______NODE_NAME_Feature_Script_RebootRequest__VALUE__x__TYPE_DWORD_____r_n_______NODE_NAME_FastList__VALUE__d__TYPE_DWORD_____r_n_______NODE_NAME_FastListNoRepo__VALUE__d__TYPE_DWORD_____r_n_______NODE_NAME_FastListSkipModules__VALUE__d__TYPE_DWORD_____r_n_______NODE_NAME_UserCtx__VALUE__ls__TYPE_STRING_____r_n_______NODE_NAME_WantCloud__VALUE__d__TYPE_DWORD__VALID_1_____r_n______GENERATE__r_n____SECTION__r_n__SYSTEMSTATUS__r_n
call dword [sym.imp.MSVCR120.dll__scprintf]
inc eax
add esp, 0x50
cmp eax, 0x800
ja 0x54f148
lea ecx, [ebp - 0x22a4]
call fcn.0043f510
test al, al
je 0x54f4b9
cmp dword [ebp - 0x22a4], 0
mov dword [ebp - 0x229c], 1
jne 0x54f4c3
mov dword [ebp - 0x229c], 0
lea ecx, [ebp - 0x22a4]
call fcn.0043f510
test al, al
je 0x54f4e5
cmp dword [ebp - 0x22a0], 0
mov dword [ebp - 0x2290], 1
jne 0x54f4ef
mov dword [ebp - 0x2290], 0
lea ecx, [ebp - 0x22a4]
call fcn.0043f510
test al, al
je 0x54f517
cmp dword [ebp - 0x22a4], 0
jne 0x54f510
cmp dword [ebp - 0x22a0], 0
je 0x54f517
mov ecx, 1
jmp 0x54f519
xor ecx, ecx
push dword [edi + 0x90]
xor eax, eax
test ecx, ecx
push dword [edi + 0x8c]
setne al
push esi
push ebx
push dword [ebp - 0x2294]
push 1
push 1
push 1
push dword [ebp - 0x229c]
push dword [ebp - 0x2290]
push 0
push 0x5c6ec8
push 0x5c6f48
push 0x5c6e48
push eax
push dword [edi + 0x84]
xor eax, eax
cmp dword [edi + 0x80], eax
setne al
push eax
push dword [ebp - 0x22b0]
lea eax, [ebp - 0x14c]
push eax
push str.__xml_version_1.0__encoding_utf_8____r_n_SYSTEMSTATUS__r_n___SECTION_ID_SOME_NUMBER___r_n_____GENERATE__r_n_______NODE_NAME_GUI_Version__VALUE__s__TYPE_STRING_____r_n_______NODE_NAME_Language__VALUE__x__TYPE_DWORD_____r_n_______NODE_NAME_Personal__VALUE__d__TYPE_DWORD_____r_n_______NODE_NAME_AntiStealth__VALUE__d__TYPE_DWORD_____r_n_______NODE_NAME_SelfDefense__VALUE__d__TYPE_DWORD_____r_n_______NODE_NAME_VersionLoader__VALUE__s__TYPE_STRING_____r_n_______NODE_NAME_VersionAntiStealth__VALUE__s__TYPE_STRING_____r_n_______NODE_NAME_VersionSysInspector__VALUE__s__TYPE_STRING_____r_n_______NODE_NAME_StandAlone__VALUE__x__TYPE_DWORD_____r_n_______NODE_NAME_SD_RegistryProtected__VALUE__x__TYPE_DWORD_____r_n_______NODE_NAME_SD_ProcessesProtected__VALUE__x__TYPE_DWORD_____r_n_______NODE_NAME_Feature_Node_TaskScheduler__VALUE__x__TYPE_DWORD_____r_n_______NODE_NAME_Feature_Node_Rootkits__VALUE__x__TYPE_DWORD_____r_n_______NODE_NAME_Feature_Script_RebootRequest__VALUE__x__TYPE_DWORD_____r_n_______NODE_NAME_FastList__VALUE__d__TYPE_DWORD_____r_n_______NODE_NAME_FastListNoRepo__VALUE__d__TYPE_DWORD_____r_n_______NODE_NAME_FastListSkipModules__VALUE__d__TYPE_DWORD_____r_n_______NODE_NAME_UserCtx__VALUE__ls__TYPE_STRING_____r_n_______NODE_NAME_WantCloud__VALUE__d__TYPE_DWORD__VALID_1_____r_n______GENERATE__r_n____SECTION__r_n__SYSTEMSTATUS__r_n
lea eax, [ebp - 0x228c]
push 0x800
push eax
call fcn.0052fc30
add esp, 0x58
call fcn.00439c70
mov esi, eax
mov eax, dword [ebp - 0x2298]
mov ecx, dword [eax + 0x58]
mov eax, dword [ecx + 8]
test eax, eax
je 0x54f5c5
lea ecx, [ebp - 0x22b4]
push ecx
push dword [ebp - 0x22b8]
lea ecx, [ebp - 0x228c]
push ecx
push 0x2ee0
call eax
add esp, 0x10
test esi, esi
je 0x54f5d9
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
push esi
call dword [0x5c001c]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x22b4]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00553510
mov esp, ebp
pop ebp
ret