Function at 0x5be16c
Capabilities:
Check for time delay via gettickcount
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x24
push 0
push 0
dec ecx
jne 0x5be174
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5bec50
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x697a44], 0
jne 0x5bec25
lea eax, [ebp - 0x54]
mov edx, 1
call fcn.005b3df4
mov eax, dword [0x697cb8]
mov dl, byte [ebp - 0x54]
mov byte [eax], dl
call fcn.005af7e0
test al, al
je 0x5bec25
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.005bc890
mov byte [0x697a44], 1
mov byte [ebp - 0x11], 1
mov eax, dword [0x697fa4]
mov eax, dword [eax]
call fcn.005a8988
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, dword [0x698204]
mov eax, dword [eax + 0x1c]
cmp byte [eax + 0x29], 0
je 0x5be219
call fcn.005c0acc
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
jmp 0x5be227
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x12], 1
xor eax, eax
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
mov eax, dword [0x697bb8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, 0x5bec68
call fcn.0040b3b0
mov byte [ebp - 0x52], al
mov edi, 0x10
mov esi, dword [0x698204]
mov eax, dword [esi]
cmp byte [eax + 0x28], 0
jne 0x5be970
cmp byte [0x697a3c], 0
jne 0x5be97a
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x13], 0
mov eax, dword [esi]
cmp byte [eax + 0x29], 0
je 0x5be293
lea edx, [ebp - 0x48]
mov eax, dword [0x698334]
call fcn.00407364
jmp 0x5be2a0
lea edx, [ebp - 0x48]
mov eax, dword [0x698388]
call fcn.00407364
mov ebx, dword [esi]
mov eax, dword [ebx + 0x58]
mov edx, dword [eax]
call dword [edx + 0x14]
push eax
mov eax, dword [ebp - 0x48]
call fcn.00405178
push eax
mov eax, dword [ebx + 4]
call fcn.00405178
push eax
push 0x5bec74
push 0x5bec78
call fcn.00550d44
mov eax, dword [esi]
mov eax, dword [eax + 0x58]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x5be8bb
push 0x5bec88
mov eax, dword [esi]
push dword [eax + 0x60]
push 0x5beca4
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x60]
call fcn.0040aedc
push dword [ebp - 0x60]
push 0x5becb4
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x64]
call fcn.0051f434
push dword [ebp - 0x64]
lea eax, [ebp - 0x5c]
mov edx, 6
call fcn.00405040
mov eax, dword [ebp - 0x5c]
xor edx, edx
call fcn.005bce38
mov dl, byte [ebp - 0x52]
mov eax, 0x5becc0
call fcn.005bce38
push 0x5becf4
call fcn.0040cf40
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x6c]
call fcn.0040db84
push dword [ebp - 0x6c]
push 0x5bed00
lea ecx, [ebp - 0x70]
mov eax, dword [esi]
mov al, byte [eax + 0x29]
xor edx, edx
call fcn.0040b1cc
push dword [ebp - 0x70]
push 0x5becb4
mov eax, dword [esi]
push dword [eax + 4]
lea eax, [ebp - 0x68]
mov edx, 6
call fcn.00405040
mov eax, dword [ebp - 0x68]
mov dl, byte [ebp - 0x52]
call fcn.005bce38
mov eax, dword [esi]
cmp byte [eax + 0x29], 0
je 0x5be887
mov byte [ebp - 0x13], 1
mov edx, dword [eax + 0x3c]
cmp edx, 9
jne 0x5be446
call fcn.005bdf78
test al, al
je 0x5be887
mov ecx, dword [esi]
mov eax, dword [ecx + 0x50]
mov edx, dword [ecx + 0x54]
add eax, dword [ebp - 0x20]
adc edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov eax, dword [ecx + 0x48]
mov edx, dword [ecx + 0x4c]
add eax, dword [ebp - 0x28]
adc edx, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ecx + 0x58]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x74]
mov eax, dword [esi]
call fcn.00552890
mov edx, dword [ebp - 0x74]
mov eax, dword [esi]
mov eax, dword [eax + 0x58]
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [esi]
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov eax, dword [esi]
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
lea edx, [ebp - 0x7c]
mov eax, dword [esi]
call fcn.00552890
mov eax, dword [ebp - 0x7c]
lea ecx, [ebp - 0x78]
mov edx, 0x5bed10
call fcn.0040b668
mov eax, dword [ebp - 0x78]
call fcn.0040b5ac
mov byte [ebp - 0x11], 0
jmp 0x5be887
cmp edx, 8
jne 0x5be5f2
mov byte [ebp - 0x12], 0
push 0x5bed1c
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x84]
call fcn.0040aedc
push dword [ebp - 0x84]
push 0x5becb4
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x88]
call fcn.0051f434
push dword [ebp - 0x88]
lea eax, [ebp - 0x80]
mov edx, 4
call fcn.00405040
mov eax, dword [ebp - 0x80]
xor edx, edx
call fcn.005bce38
lea edx, [ebp - 0x8c]
mov eax, dword [esi]
call fcn.00552890
lea eax, [ebp - 0x8c]
mov edx, 0x5bed40
call fcn.00404f88
mov eax, dword [ebp - 0x8c]
lea edx, [ebp - 0x4c]
call fcn.005c0430
lea ecx, [ebp - 0x40]
mov eax, dword [esi]
add eax, 0x58
mov edx, dword [ebp - 0x4c]
call fcn.005c08a4
add eax, dword [ebp - 0x28]
adc edx, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
add dword [ebp - 0x20], eax
adc dword [ebp - 0x1c], edx
push 0x5bed50
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x94]
call fcn.0040aedc
push dword [ebp - 0x94]
push 0x5becb4
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x98]
call fcn.0051f434
push dword [ebp - 0x98]
push 0x5bed6c
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
lea eax, [ebp - 0x9c]
call fcn.0040aedc
push dword [ebp - 0x9c]
lea eax, [ebp - 0x90]
mov edx, 6
call fcn.00405040
mov eax, dword [ebp - 0x90]
xor edx, edx
call fcn.005bce38
mov eax, dword [esi]
mov eax, dword [eax + 0x58]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0xa0]
mov eax, dword [esi]
call fcn.00552890
mov edx, dword [ebp - 0xa0]
mov eax, dword [esi]
mov eax, dword [eax + 0x58]
mov ecx, dword [eax]
call dword [ecx + 0x74]
lea edx, [ebp - 0xa8]
mov eax, dword [esi]
call fcn.00552890
mov eax, dword [ebp - 0xa8]
lea ecx, [ebp - 0xa4]
mov edx, 0x5bed10
call fcn.0040b668
mov eax, dword [ebp - 0xa4]
call fcn.0040b5ac
lea edx, [ebp - 0xb0]
mov eax, dword [esi]
call fcn.00552890
mov eax, dword [ebp - 0xb0]
lea ecx, [ebp - 0xac]
mov edx, 0x5bed40
call fcn.0040b668
mov eax, dword [ebp - 0xac]
call fcn.0040b5ac
mov byte [ebp - 0x11], 0
jmp 0x5be887
cmp edx, 1
jne 0x5be64c
mov eax, dword [eax + 0x58]
call fcn.005bdff4
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x58]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0xb4]
mov eax, dword [esi]
call fcn.00552890
mov edx, dword [ebp - 0xb4]
mov eax, dword [esi]
mov eax, dword [eax + 0x58]
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov ebx, dword [0x698204]
mov ebx, dword [ebx + 4]
mov edx, dword [0x698204]
add edx, 4
xor ecx, ecx
mov eax, dword [ebx + 0x14]
call dword [ebx + 0x10]
mov byte [ebp - 0x11], 0
jmp 0x5be887
cmp edx, 0xe
jne 0x5be67d
mov eax, 0x5bed80
call fcn.005c0f58
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0x3e9
mov eax, dword [0x6981a8]
mov eax, dword [eax]
call fcn.00473ef4
push 1
call sub.kernel32.dll_Sleep_1
dec dword [ebp - 8]
jne 0x5be665
mov eax, dword [esi]
cmp dword [eax + 0x3c], 0xf
jne 0x5be6b1
mov eax, 0x5bed94
call fcn.005c0f58
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0x3e9
mov eax, dword [0x6981a8]
mov eax, dword [eax]
call fcn.00473ef4
push 1
call sub.kernel32.dll_Sleep_1
dec dword [ebp - 8]
jne 0x5be699
mov eax, dword [esi]
mov eax, dword [eax + 0x58]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x5be7d8
inc eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 8], 0
lea ecx, [ebp - 0xb8]
mov eax, dword [esi]
mov eax, dword [eax + 0x58]
mov edx, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0xb8]
lea edx, [ebp - 0x51]
call fcn.005c008c
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
cmp byte [ebp - 0x51], 0
je 0x5be745
push 0x5beda8
lea ecx, [ebp - 0xbc]
mov eax, dword [esi]
mov eax, dword [eax + 0x58]
mov edx, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0xbc]
push 0x5bedb8
push dword [ebp - 0x34]
push dword [ebp - 0x38]
lea eax, [ebp - 0xc0]
call fcn.0040aedc
push dword [ebp - 0xc0]
lea eax, [ebp - 0x50]
mov edx, 4
call fcn.00405040
jmp 0x5be78c
push 0x5bedc4
lea ecx, [ebp - 0xc4]
mov eax, dword [esi]
mov eax, dword [eax + 0x58]
mov edx, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0xc4]
push 0x5bedb8
push dword [ebp - 0x34]
push dword [ebp - 0x38]
lea eax, [ebp - 0xc8]
call fcn.0040aedc
push dword [ebp - 0xc8]
lea eax, [ebp - 0x50]
mov edx, 4
call fcn.00405040
mov dl, byte [ebp - 0x52]
mov eax, dword [ebp - 0x50]
call fcn.005bce38
cmp byte [ebp - 0x51], 0
je 0x5be7b7
add dword [ebp - 0x20], 1
adc dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
add eax, dword [ebp - 0x38]
adc edx, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov eax, dword [0x6981a8]
mov eax, dword [eax]
call fcn.00473ef4
cmp byte [0x697a3c], 0
jne 0x5be7d8
inc dword [ebp - 8]
dec dword [ebp - 0x58]
jne 0x5be6cf
mov eax, dword [esi]
cmp dword [eax + 0x3c], 0xe
jne 0x5be803
cmp dword [ebp - 0xc], 0
jle 0x5be803
push 1
push 0x5bedcc
push 0x5bedd0
push 0x5bede8
push 0x5bedf4
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [esi]
cmp dword [eax + 0x3c], 0xf
jne 0x5be82e
cmp dword [ebp - 0xc], 0
jle 0x5be82e
push 1
push 0x5bedcc
push 0x5bedcc
push 0x5bedfc
push 0x5bedf4
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [esi]
mov eax, dword [eax + 0x58]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0xcc]
mov eax, dword [esi]
call fcn.00552890
mov edx, dword [ebp - 0xcc]
mov eax, dword [esi]
mov eax, dword [eax + 0x58]
mov ecx, dword [eax]
call dword [ecx + 0x74]
lea edx, [ebp - 0xd4]
mov eax, dword [esi]
call fcn.00552890
mov eax, dword [ebp - 0xd4]
lea ecx, [ebp - 0xd0]
mov edx, 0x5bed10
call fcn.0040b668
mov eax, dword [ebp - 0xd0]
call fcn.0040b5ac
mov byte [ebp - 0x11], 0
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
cmp byte [ebp - 0x13], 0
je 0x5be8bb
push 1
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
call fcn.00405178
mov ebx, eax
push ebx
push 0x5bee08
push 0x5bee10
push ebx
call fcn.00550e5c
push 0x5bee24
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0xdc]
call fcn.0040aedc
push dword [ebp - 0xdc]
push 0x5bee34
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea eax, [ebp - 0xe0]
call fcn.0040aedc
push dword [ebp - 0xe0]
lea eax, [ebp - 0xd8]
mov edx, 4
call fcn.00405040
mov eax, dword [ebp - 0xd8]
mov dl, byte [ebp - 0x52]
call fcn.005bce38
push 0x5bee44
mov eax, dword [esi]
push dword [eax + 0x60]
push 0x5beca4
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0xe8]
call fcn.0040aedc
push dword [ebp - 0xe8]
push 0x5becb4
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0xec]
call fcn.0051f434
push dword [ebp - 0xec]
lea eax, [ebp - 0xe4]
mov edx, 6
call fcn.00405040
mov eax, dword [ebp - 0xe4]
xor edx, edx
call fcn.005bce38
add esi, 4
dec edi
jne 0x5be257
push 0x5bee5c
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0xf4]
call fcn.0040aedc
push dword [ebp - 0xf4]
push 0x5becb4
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0xf8]
call fcn.0051f434
push dword [ebp - 0xf8]
lea eax, [ebp - 0xf0]
mov edx, 4
call fcn.00405040
mov eax, dword [ebp - 0xf0]
xor edx, edx
call fcn.005bce38
mov eax, dword [0x698204]
mov eax, dword [eax + 0x1c]
cmp byte [eax + 0x29], 0
je 0x5be9f0
call fcn.005c0acc
sub eax, dword [ebp - 0x30]
sbb edx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
jmp 0x5be9fe
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
cmp dword [ebp - 0x24], 0
jne 0x5bea36
cmp dword [ebp - 0x28], 0
jne 0x5bea36
cmp dword [ebp - 0x1c], 0
jne 0x5bea18
cmp dword [ebp - 0x20], 0
jbe 0x5bea36
jmp 0x5bea1a
jle 0x5bea36
cmp dword [ebp - 0x2c], 0
jne 0x5bea28
cmp dword [ebp - 0x30], 0
jbe 0x5bea36
jmp 0x5bea2a
jle 0x5bea36
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
push 0x5bee78
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x100]
call fcn.0040aedc
push dword [ebp - 0x100]
push 0x5becb4
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x104]
call fcn.0051f434
push dword [ebp - 0x104]
lea eax, [ebp - 0xfc]
mov edx, 4
call fcn.00405040
mov eax, dword [ebp - 0xfc]
xor edx, edx
call fcn.005bce38
cmp dword [ebp - 0x24], 0
jne 0x5bea99
cmp dword [ebp - 0x28], 0
jbe 0x5beabb
jmp 0x5bea9b
jle 0x5beabb
cmp dword [ebp - 0x1c], 0
jne 0x5beabb
cmp dword [ebp - 0x20], 0
jne 0x5beabb
cmp byte [ebp - 0x12], 0
je 0x5beabb
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
push 0x5bee9c
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x10c]
call fcn.0040aedc
push dword [ebp - 0x10c]
push 0x5becb4
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x110]
call fcn.0051f434
push dword [ebp - 0x110]
lea eax, [ebp - 0x108]
mov edx, 4
call fcn.00405040
mov eax, dword [ebp - 0x108]
xor edx, edx
call fcn.005bce38
push 0x5beec0
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x118]
call fcn.0040aedc
push dword [ebp - 0x118]
push 0x5becb4
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x11c]
call fcn.0051f434
push dword [ebp - 0x11c]
push 0x5beed4
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea eax, [ebp - 0x120]
call fcn.0040aedc
push dword [ebp - 0x120]
lea eax, [ebp - 0x114]
mov edx, 6
call fcn.00405040
mov eax, dword [ebp - 0x114]
xor edx, edx
call fcn.005bce38
cmp byte [ebp - 0x11], 0
jne 0x5beba7
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
mov eax, dword [0x697fa4]
mov eax, dword [eax]
mov cl, byte [ebp - 0x11]
mov edx, dword [ebp - 0x10]
call fcn.005a881c
jmp 0x5bebf9
mov eax, dword [0x697fa4]
mov eax, dword [eax]
mov eax, dword [eax + 0x344]
call fcn.00558094
mov eax, dword [0x697fa4]
mov eax, dword [eax]
call fcn.004709cc
cmp byte [0x697a34], 0
jne 0x5bebf9
mov byte [0x697a34], 1
lea edx, [ebp - 0x124]
mov eax, dword [0x697f54]
call fcn.00407364
mov eax, dword [ebp - 0x124]
mov cx, word [0x5beee0]
mov dl, 2
call fcn.00590da0
mov eax, dword [0x697bb8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_ReleaseMutex
mov byte [0x697a44], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
call fcn.00536a04
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.005bc890
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bec57
lea eax, [ebp - 0x124]
mov edx, 0x33
call fcn.00404cd0
lea eax, [ebp - 0x50]
mov edx, 3
call fcn.00404cd0
ret