Function at 0x440780
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x47
push 0
push 0
dec ecx
jne 0x440788
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x440efa
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x440ecd
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x45b0e4]
mov dword [eax], 1
call fcn.0043fddc
xor eax, eax
push ebp
push 0x4407e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x45ac80]
mov eax, dword [eax + 0x24]
call fcn.00441d44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4407ee
push 0x32
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x45b080]
mov eax, dword [eax]
call fcn.004052ac
mov edx, eax
lea eax, [ebp - 0x1cc]
call fcn.004031c4
lea eax, [ebp - 0x1cc]
call fcn.00402f54
call fcn.00402bb0
mov edx, 0x440f10
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
mov edx, 0x440f24
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
mov edx, 0x440f44
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f54
mov eax, dword [0x45ae4c]
push dword [eax]
push 0x440f64
lea eax, [ebp - 0x1d0]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x1d0]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f54
mov eax, dword [0x45ad58]
push dword [eax]
push 0x440f64
lea eax, [ebp - 0x1d4]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f54
mov eax, dword [0x45b074]
push dword [eax]
push 0x440f64
lea eax, [ebp - 0x1d8]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x1d8]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f54
mov eax, dword [0x45ae60]
push dword [eax]
push 0x440f64
lea eax, [ebp - 0x1dc]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x1dc]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f54
mov eax, dword [0x45ad64]
push dword [eax]
push 0x440f64
lea eax, [ebp - 0x1e0]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x1e0]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f54
mov eax, dword [0x45ad50]
push dword [eax]
push 0x440f64
lea eax, [ebp - 0x1e4]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x1e4]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f54
mov eax, dword [0x45af84]
push dword [eax]
push 0x440f64
lea eax, [ebp - 0x1e8]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x1e8]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f54
mov eax, dword [0x45b068]
push dword [eax]
push 0x440f64
lea eax, [ebp - 0x1ec]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x1ec]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f54
mov eax, dword [0x45b124]
push dword [eax]
push 0x440f64
lea eax, [ebp - 0x1f0]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x1f0]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f74
mov eax, dword [0x45ad40]
push dword [eax]
mov eax, dword [0x45b048]
push dword [eax]
push 0x440f88
lea eax, [ebp - 0x1f4]
mov edx, 4
call fcn.0040516c
mov edx, dword [ebp - 0x1f4]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f74
mov eax, dword [0x45ac80]
push dword [eax + 0x14]
push 0x440f88
lea eax, [ebp - 0x1f8]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x1f8]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f74
lea edx, [ebp - 0x200]
mov eax, dword [0x45af34]
mov eax, dword [eax]
call fcn.0040942c
push dword [ebp - 0x200]
push 0x440f88
lea eax, [ebp - 0x1fc]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x1fc]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f74
mov eax, dword [0x45b00c]
push dword [eax]
push 0x440f88
lea eax, [ebp - 0x204]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x204]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f94
mov eax, dword [0x45ae4c]
push dword [eax]
push 0x440fa8
lea eax, [ebp - 0x208]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x208]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f94
mov eax, dword [0x45ad58]
push dword [eax]
push 0x440fa8
lea eax, [ebp - 0x20c]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x20c]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f94
mov eax, dword [0x45ae60]
push dword [eax]
push 0x440fa8
lea eax, [ebp - 0x210]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f94
mov eax, dword [0x45ad64]
push dword [eax]
push 0x440fa8
lea eax, [ebp - 0x214]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x214]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f94
mov eax, dword [0x45b074]
push dword [eax]
push 0x440fa8
lea eax, [ebp - 0x218]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x218]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f94
mov ecx, dword [0x45ac80]
mov ecx, dword [ecx + 0x10]
mov edx, dword [0x45ac80]
mov edx, dword [edx + 0x14]
lea eax, [ebp - 0x224]
call fcn.004050f8
mov eax, dword [ebp - 0x224]
call fcn.004052ac
mov edx, eax
lea eax, [ebp - 0x220]
call fcn.00404fe4
push dword [ebp - 0x220]
push 0x440fa8
lea eax, [ebp - 0x21c]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f94
mov eax, dword [0x45af34]
mov eax, dword [eax]
call fcn.004052ac
mov edx, eax
lea eax, [ebp - 0x22c]
call fcn.00404fe4
push dword [ebp - 0x22c]
push 0x440fa8
lea eax, [ebp - 0x228]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f54
mov eax, dword [0x45b124]
push dword [eax]
push 0x440f64
lea eax, [ebp - 0x230]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f54
mov eax, dword [0x45acb8]
push dword [eax]
push 0x440f64
lea eax, [ebp - 0x234]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x234]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f94
mov eax, dword [0x45b124]
push dword [eax]
push 0x440fa8
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x238]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
push 0x440f54
mov eax, dword [0x45b080]
push dword [eax]
push 0x440f64
lea eax, [ebp - 0x23c]
mov edx, 3
call fcn.0040516c
mov edx, dword [ebp - 0x23c]
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
mov edx, 0x440fbc
lea eax, [ebp - 0x1cc]
call fcn.00405440
call fcn.00403ae8
call fcn.00402bb0
lea eax, [ebp - 0x1cc]
call fcn.00403368
call fcn.00402bb0
push 0
mov eax, dword [0x45b080]
mov eax, dword [eax]
call fcn.004052ac
push eax
call sub.kernel32.dll_WinExec
push 0
mov eax, dword [0x45b080]
mov eax, dword [eax]
call fcn.004052ac
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x440ed7
call fcn.00404c78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440f01
lea eax, [ebp - 0x23c]
mov edx, 0x1c
call fcn.00404e10
ret