Function at 0x5b30e1
Capabilities:
Create thread
Delete file

Disassembly:
jae 0x5b2c21
jmp 0x5b2c1c
call fcn.005b2c23
jae 0x5b2c1c
add esp, 4
jmp 0x5b2c28
dec dword [esp]
jno 0x5b2c2d
jns 0x5b2c18
jp 0x5b2c31
add esp, 4
popf
jmp 0x5b2c38
clc
jae 0x5b2c3d
mov dl, 0x37
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x5b2c56
jne 0x5b2c56
aaa
jl 0x5b2c5b
jmp 0x5b2c5d
je 0x5b2c58
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5b2c77
jne 0x5b2c76
call 0x835f1cfe
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x5b2c85
jne 0x5b2c85
call 0xa5436cf3
push es
std
inc dword [ebx + 0x458904c4]
in al, dx
push 0x40
call fcn.00583330
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0
je 0x5b2caf
mov ecx, dword [ebp - 0x14]
call fcn.005c24a0
mov dword [ebp - 0x19c], eax
jmp 0x5b2cb9
mov dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword [0x7fe884], ecx
push 1
call fcn.00583330
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x5b2cfc
mov ecx, dword [ebp - 0x1c]
call fcn.005cdff0
mov dword [ebp - 0x1a0], eax
jmp 0x5b2d06
mov dword [ebp - 0x1a0], 0
mov edx, dword [ebp - 0x1a0]
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [0x7feccc], eax
push 8
call fcn.00583330
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0
je 0x5b2d48
mov ecx, dword [ebp - 0x24]
call fcn.005c2b60
mov dword [ebp - 0x1a4], eax
jmp 0x5b2d52
mov dword [ebp - 0x1a4], 0
mov ecx, dword [ebp - 0x1a4]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x20]
mov dword [0x7fe894], edx
push 0x40
call fcn.00600d50
add esp, 4
mov dword [0x7fe88c], eax
push 0x310
call fcn.00600d50
add esp, 4
mov dword [0x7fe890], eax
push 4
call fcn.00583330
add esp, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 3
cmp dword [ebp - 0x2c], 0
je 0x5b2db6
mov ecx, dword [ebp - 0x2c]
call fcn.005cb880
mov dword [ebp - 0x1a8], eax
jmp 0x5b2dc0
mov dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x28]
mov dword [0x7fee24], ecx
push 4
call fcn.00583330
add esp, 4
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 4
cmp dword [ebp - 0x34], 0
je 0x5b2e03
mov ecx, dword [ebp - 0x34]
call fcn.005ce4e0
mov dword [ebp - 0x1ac], eax
jmp 0x5b2e0d
mov dword [ebp - 0x1ac], 0
mov edx, dword [ebp - 0x1ac]
mov dword [ebp - 0x30], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x30]
mov dword [0x7ff0ec], eax
push 4
call fcn.00583330
add esp, 4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 5
cmp dword [ebp - 0x3c], 0
je 0x5b2e4f
mov ecx, dword [ebp - 0x3c]
call fcn.005ca510
mov dword [ebp - 0x1b0], eax
jmp 0x5b2e59
mov dword [ebp - 0x1b0], 0
mov ecx, dword [ebp - 0x1b0]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x38]
mov dword [0x7feb8c], edx
push 4
call fcn.00583330
add esp, 4
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 6
cmp dword [ebp - 0x44], 0
je 0x5b2e9c
mov ecx, dword [ebp - 0x44]
call fcn.005cb810
mov dword [ebp - 0x1b4], eax
jmp 0x5b2ea6
mov dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x40]
mov dword [0x7fede4], ecx
push 4
call fcn.00583330
add esp, 4
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], 7
cmp dword [ebp - 0x4c], 0
je 0x5b2ee9
mov ecx, dword [ebp - 0x4c]
call fcn.005ca950
mov dword [ebp - 0x1b8], eax
jmp 0x5b2ef3
mov dword [ebp - 0x1b8], 0
mov edx, dword [ebp - 0x1b8]
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x48]
mov dword [0x7fec30], eax
push 4
call fcn.00583330
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 8
cmp dword [ebp - 0x54], 0
je 0x5b2f35
mov ecx, dword [ebp - 0x54]
call fcn.005ce470
mov dword [ebp - 0x1bc], eax
jmp 0x5b2f3f
mov dword [ebp - 0x1bc], 0
mov ecx, dword [ebp - 0x1bc]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x50]
mov dword [0x7ff0b4], edx
push 4
call fcn.00583330
add esp, 4
mov dword [ebp - 0x5c], eax
mov dword [ebp - 4], 9
cmp dword [ebp - 0x5c], 0
je 0x5b2f82
mov ecx, dword [ebp - 0x5c]
call fcn.005cd440
mov dword [ebp - 0x1c0], eax
jmp 0x5b2f8c
mov dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x58], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x58]
mov dword [0x7fee90], ecx
push 4
call fcn.00583330
add esp, 4
mov dword [ebp - 0x64], eax
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x64], 0
je 0x5b2fcf
mov ecx, dword [ebp - 0x64]
call fcn.005ce400
mov dword [ebp - 0x1c4], eax
jmp 0x5b2fd9
mov dword [ebp - 0x1c4], 0
mov edx, dword [ebp - 0x1c4]
mov dword [ebp - 0x60], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x60]
mov dword [0x7ff07c], eax
push 4
call fcn.00583330
add esp, 4
mov dword [ebp - 0x6c], eax
mov dword [ebp - 4], 0xb
cmp dword [ebp - 0x6c], 0
je 0x5b301b
mov ecx, dword [ebp - 0x6c]
call fcn.005cdb10
mov dword [ebp - 0x1c8], eax
jmp 0x5b3025
mov dword [ebp - 0x1c8], 0
mov ecx, dword [ebp - 0x1c8]
mov dword [ebp - 0x68], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x68]
mov dword [0x7ff000], edx
pushf
push 0xa
jae 0x5b304b
jmp 0x5b3046
call 0x5b304d
jae 0x5b3046
add esp, 4
jmp 0x5b3052
dec dword [esp]
jno 0x5b3057
jns 0x5b3042
jp 0x5b305b
add esp, 4
popf
jmp 0x5b3062
clc
jae 0x5b3067
or dword [eax + edx*2], ebp
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x5b3080
jne 0x5b3080
sub al, 0x7c
add ebp, ebx
add ebp, dword [esp + esi*2]
sti
jl 0x5b3085
jmp 0x5b3087
je 0x5b3082
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5b30a1
jne 0x5b30a0
call 0x835f2128
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x5b30af
jne 0x5b30af
call 0x446342f
bnd je 0x5b30b1
jl 0x5b30b4
jmp 0x5b30b6
je 0x5b30b1
xor eax, eax
test eax, eax
je 0x5b30bf
jne 0x5b30be
call 0x835f2146
rol byte [ebx + eax*4], 0xf0
add eax, 0xb00273f8
bnd je 0x5b30d2
xor eax, 3
add eax, 4
xor eax, 5
clc
jae 0x5b30cd
mov al, 0xf2
je 0x5b30d2
jne 0x5b30d2
pushf
pushf
push 0xa
jae 0x5b30df
jmp 0x5b30da
call 0x5b30e1
jae 0x5b30da
add esp, 4
jmp 0x5b30e6
dec dword [esp]
jno 0x5b30eb
jns 0x5b30d6
jp 0x5b30ef
add esp, 4
popf
jmp 0x5b30f6
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x5b310f
jne 0x5b310f
call 0x101b6463
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.005b3530
movzx eax, al
test eax, eax
je 0x5b3175
push 0
push 0
push 0xbb8
push 0x5b2bc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x92ad20cb
push ecx
lea ecx, [ebp - 0x8c]
call fcn.005bed70
mov dword [ebp - 0x1cc], eax
mov edx, dword [ebp - 0x1cc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
lea ecx, [ebp - 0x8c]
call fcn.005bf300
pushf
push 0xa
jae 0x5b3182
jmp 0x5b317d
call 0x5b3184
jae 0x5b317d
add esp, 4
jmp 0x5b3189
dec dword [esp]
jno 0x5b318e
jns 0x5b3179
jp 0x5b3192
add esp, 4
popf
jmp 0x5b3199
clc
jae 0x5b319e
rol dword [edx + 0x50], 1
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x5b31b7
jne 0x5b31b7
inc edx
jl 0x5b31bc
jmp 0x5b31be
je 0x5b31b9
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5b31d8
jne 0x5b31d7
call 0x835f225f
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x5b31e6
jne 0x5b31e6
call 0x4463566
or esi, dword [ebx + edi*8 + 0x33]
rol byte [ebp + 0x750374c0], 0
jl 0x5b31eb
jmp 0x5b31ed
je 0x5b31e8
xor eax, eax
test eax, eax
je 0x5b31f6
jne 0x5b31f5
call 0x835f227d
rol byte [ebx + eax*4], 0xf0
add eax, 0x7b0273f8
or esi, dword [ebx + eax + 0x75]
add dword [ebx], ecx
xor eax, 3
add eax, 4
xor eax, 5
clc
jae 0x5b3204
jnp 0x5b320f
je 0x5b3209
jne 0x5b3209
or esp, dword [esi - 0x64]
pushf
push 0xa
jae 0x5b3216
jmp 0x5b3211
call 0x5b3218
jae 0x5b3211
add esp, 4
jmp 0x5b321d
dec dword [esp]
jno 0x5b3222
jns 0x5b320d
jp 0x5b3226
add esp, 4
popf
jmp 0x5b322d
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x5b3246
jne 0x5b3246
call 0x101b659a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov eax, 0xa9da3c56
push eax
lea ecx, [ebp - 0xa3]
call fcn.005b4480
mov dword [ebp - 0x1d0], eax
mov ecx, dword [ebp - 0x1d0]
push ecx
call sub.MSVCR90.dll_remove
add esp, 4
lea ecx, [ebp - 0xa3]
call fcn.005b3c40
mov edx, 0xb082a9c2
push edx
lea ecx, [ebp - 0xb7]
call fcn.005b4400
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 4], 0xc
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xa8], esp
mov edx, dword [ebp - 0x1d8]
push edx
call fcn.00416410
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x1e0], eax
mov byte [ebp - 4], 0xd
push 0
mov ecx, 0xa9da3c7e
push ecx
lea ecx, [ebp - 0xd3]
call fcn.005b4480
mov dword [ebp - 0x1e4], eax
mov edx, dword [ebp - 0x1e4]
mov dword [ebp - 0x1e8], edx
mov byte [ebp - 4], 0xe
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov eax, dword [ebp - 0x1e8]
push eax
call fcn.00416410
mov dword [ebp - 0x1ec], eax
mov byte [ebp - 4], 0xf
mov ecx, dword [0x7fe884]
call fcn.005c25c0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xd3]
call fcn.005b3c40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb7]
call fcn.005d38d0
mov ecx, dword [0x7fe894]
call fcn.005c2bd0
push 0x48a9174
lea ecx, [ebp - 0x103]
call fcn.005bedf0
mov dword [ebp - 0x1f0], eax
mov ecx, dword [ebp - 0x1f0]
mov dword [ebp - 0x1f4], ecx
mov dword [ebp - 4], 0x10
mov edx, dword [ebp - 0x1f4]
push edx
push 0
mov eax, dword [0x7fe884]
push eax
call fcn.005c2740
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x103]
call fcn.005b4250
push 0x32fe1aa1
lea ecx, [ebp - 0x135]
call fcn.005bee70
mov dword [ebp - 0x1f8], eax
mov ecx, dword [ebp - 0x1f8]
mov dword [ebp - 0x1fc], ecx
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x1fc]
push edx
push 0
mov eax, dword [0x7fe884]
push eax
call fcn.005c2740
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x135]
call fcn.005b4220
push 0x1bf29e0c
lea ecx, [ebp - 0x163]
call fcn.005beef0
mov dword [ebp - 0x200], eax
mov ecx, dword [ebp - 0x200]
mov dword [ebp - 0x204], ecx
mov dword [ebp - 4], 0x12
mov edx, dword [ebp - 0x204]
push edx
push 0
mov eax, dword [0x7fe884]
push eax
call fcn.005c2740
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x163]
call fcn.005b3f40
mov ecx, 0xc83c38de
push ecx
lea ecx, [ebp - 0x193]
call fcn.005bef70
mov dword [ebp - 0x208], eax
mov edx, dword [ebp - 0x208]
mov dword [ebp - 0x20c], edx
mov dword [ebp - 4], 0x13
mov eax, dword [ebp - 0x20c]
push eax
push 0
mov ecx, dword [0x7fe884]
push ecx
call fcn.005c2740
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x193]
call fcn.005b4250
pushf
push 0xa
jae 0x5b34b7
jmp 0x5b34b2
call 0x5b34b9
jae 0x5b34b2
add esp, 4
jmp 0x5b34be
dec dword [esp]
jno 0x5b34c3
jns 0x5b34ae
jp 0x5b34c7
add esp, 4
popf
jmp 0x5b34ce
clc
jae 0x5b34d3
push 0x8152508f
nop
add byte [eax], al
add byte [edx - 0x7f], dl
ljmp 0x358
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x5b34ec
jne 0x5b34ec
invalid
jl 0x5b34f1
jmp 0x5b34f3
je 0x5b34ee
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5b350d
jne 0x5b350c
call 0x835f2594
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x5b351b
jne 0x5b351b
call 0x654f82aa
mov dword [0], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret