Function at 0x4328c8
Capabilities:
Create process on windows
Delete file
Find taskbar
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 4], ecx
mov esi, eax
xor eax, eax
push ebp
push 0x4334e3
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040e52c
mov eax, 0x442c44
mov edx, 0x4334fc
call fcn.00403b60
mov eax, 0x442c48
mov edx, 0x43351c
call fcn.00403b60
mov eax, dword [esi + 0x38]
mov edx, 0x433540
call fcn.0040b6e8
mov eax, dword [esi + 0x44]
mov edx, 0x433558
call fcn.0040b6e8
mov eax, dword [esi + 0x40]
mov edx, 0x433570
call fcn.0040b6e8
mov eax, dword [esi + 0x3c]
mov edx, 0x433584
call fcn.0040b6e8
mov eax, dword [esi + 0x30]
mov edx, 0x433594
call fcn.0040b6e8
mov eax, dword [esi + 0x30]
mov edx, dword [eax + 0x24]
or edx, 0x1000
call fcn.0040b614
mov eax, dword [esi + 0x34]
mov edx, 0x4335ac
call fcn.0040b6e8
mov eax, dword [esi + 0x20]
mov ecx, 0x4335c0
xor edx, edx
call fcn.00407bc4
mov eax, dword [esi + 0x20]
mov ecx, 0x4335d0
mov edx, 2
call fcn.00407bc4
mov eax, dword [esi + 0x20]
mov ecx, 0x4335e4
mov edx, 3
call fcn.00407bc4
mov eax, dword [esi + 0x20]
mov ecx, 0x4335f4
mov edx, 4
call fcn.00407bc4
mov eax, dword [esi + 0x20]
mov ecx, 0x433608
mov edx, 5
call fcn.00407bc4
mov eax, dword [esi + 0x20]
mov ecx, 0x43361c
mov edx, 6
call fcn.00407bc4
mov eax, dword [esi + 0x20]
mov ecx, 0x433630
mov edx, 8
call fcn.00407bc4
cmp byte [0x442918], 7
jae 0x432a2c
push 0x50010
mov eax, dword [0x442c44]
call fcn.00403fa8
push eax
push 0x433638
mov eax, dword [0x4428a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
call fcn.00403a14
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jne 0x432a68
push 0x50010
mov eax, dword [0x442c44]
call fcn.00403fa8
push eax
push 0x433684
mov eax, dword [0x4428a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
call fcn.00403a14
push ebx
call sub.advapi32.dll_CloseServiceHandle
call fcn.004218e8
cmp byte [0x442b6c], 0
jne 0x432ad5
lea edx, [ebp - 0x4c]
mov eax, 1
call fcn.00406478
mov eax, dword [ebp - 0x4c]
mov edx, 0x4336b8
call fcn.00403ef4
jne 0x432aae
push 1
mov ecx, 0x4336cc
mov edx, 0x4336e0
mov eax, 0x4336e0
call fcn.0040f6d8
lea edx, [ebp - 0x50]
xor eax, eax
call fcn.00406478
mov eax, dword [ebp - 0x50]
mov edx, 0x4429ec
call fcn.0040e600
mov eax, esi
xor ecx, ecx
xor edx, edx
call fcn.0042cbd8
jmp 0x4334ba
mov dword [0x4429fc], fcn.00432114
mov dword [0x442a00], 0x4321cc
push 1
push 0x4336e0
mov eax, 0x4336e0
mov ecx, 0x4336cc
pop edx
call fcn.0040f6d8
mov edx, 0x4336f4
mov eax, dword [0x4429e8]
call fcn.004068e4
test al, al
je 0x432ba2
mov edx, 0x433708
mov eax, dword [0x4429e8]
call fcn.004068e4
test al, al
je 0x432ba2
mov edx, 0x433724
mov eax, dword [0x4429e8]
call fcn.004068e4
test al, al
je 0x432ba2
mov edx, 0x43373c
mov eax, dword [0x4429e8]
call fcn.004068e4
test al, al
je 0x432ba2
mov edx, 0x4336f4
mov eax, dword [0x4429e8]
call fcn.00406748
mov byte [0x442c34], al
mov edx, 0x433708
mov eax, dword [0x4429e8]
call fcn.00406748
mov byte [0x442c35], al
mov edx, 0x433724
mov eax, dword [0x4429e8]
call fcn.00406748
mov byte [0x442c36], al
mov edx, 0x43373c
mov eax, dword [0x4429e8]
call fcn.00406748
mov byte [0x442c37], al
jmp 0x432ba9
mov al, 1
call fcn.0043250c
lea ecx, [ebp - 0x54]
mov edx, 0x433750
mov eax, dword [0x4429e8]
call fcn.004067d8
mov edx, dword [ebp - 0x54]
mov eax, 0x442c4c
call fcn.00403b60
cmp dword [0x442c4c], 0
je 0x432cf4
lea eax, [ebp - 0x58]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [0x442c4c]
call fcn.00404008
mov eax, dword [ebp - 0x58]
call fcn.0040cc04
mov ebx, eax
cmp bx, 0x3e2
jbe 0x432c20
push 0x50010
push 0x43375c
push 0x433768
mov eax, dword [0x4428a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
jmp 0x432cf4
call fcn.004271f8
mov dword [0x442bfc], eax
mov eax, dword [0x442bfc]
call fcn.00429dd4
mov eax, dword [0x442bfc]
mov edx, dword [0x442c4c]
call fcn.00427208
mov edx, 0x442c00
mov eax, dword [0x442bfc]
call fcn.00429ed4
mov eax, dword [0x442bfc]
call fcn.0040a220
movzx eax, bx
mov edi, eax
shl edi, 2
lea edx, [edi*8 + 0x4397bc]
mov eax, 0x442c00
mov ecx, 0x20
call fcn.004062d8
test al, al
je 0x432ca6
mov byte [0x442c28], 1
mov eax, dword [esi + 0x20]
xor ecx, ecx
mov edx, 4
call fcn.00407c08
mov eax, dword [esi + 0x20]
xor ecx, ecx
mov edx, 5
call fcn.00407c08
jmp 0x432cf4
lea eax, [edi*8 + 0x4397bc]
cmp dword [eax + 4], 0
jne 0x432cd7
cmp dword [eax], 0
jne 0x432cd7
push 0x50030
push 0x43375c
push 0x433784
mov eax, dword [0x4428a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
jmp 0x432cf4
push 0x50010
push 0x43375c
push 0x433768
mov eax, dword [0x4428a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
push 0x433860
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x432d23
push 0x433870
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x442c58], eax
cmp dword [0x442c58], 0
jne 0x432d23
push ebx
call sub.kernel32.dll_FreeLibrary_1
mov al, byte [0x442b6c]
dec eax
test al, al
jb 0x43318d
inc eax
mov byte [ebp - 0x15], al
mov edi, 0x442b70
mov eax, dword [edi]
mov ebx, eax
push dword [ebx + 0x4c]
push 0x43388c
push dword [ebx + 0x40]
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.00403e68
mov edx, dword [ebp - 0x5c]
mov eax, dword [0x4429e8]
call fcn.00406708
mov dword [ebx + 0x24], eax
mov edx, 0x433898
mov eax, dword [ebx + 0x24]
call fcn.004068e4
test al, al
jne 0x432da5
lea eax, [ebp - 0x26]
push eax
call sub.kernel32.dll_GetSystemTime
push 0x10
mov edx, 0x433898
lea ecx, [ebp - 0x26]
mov eax, dword [ebx + 0x24]
call fcn.00406988
push esi
push edi
lea esi, [ebp - 0x26]
lea edi, [ebx + 0x94]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
jmp 0x432dba
push 0x10
mov edx, 0x433898
lea ecx, [ebx + 0x94]
mov eax, dword [ebx + 0x24]
call fcn.00406948
cmp byte [ebx + 0x6be], 0
je 0x432df3
mov edx, 0x4338b4
mov eax, dword [ebx + 0x24]
call fcn.00406748
mov dword [ebx + 0x6c0], eax
cmp dword [ebx + 0x6c0], 0
je 0x432df3
mov eax, dword [ebx + 0x6c4]
xor edx, edx
div dword [ebx + 0x6c0]
mov dword [ebx + 0x6c4], eax
cmp byte [ebx + 0x8f], 0
jne 0x432e0f
mov edx, 0x4338cc
mov eax, dword [ebx + 0x24]
call fcn.00406748
mov byte [ebx + 0x8f], al
cmp byte [ebx + 0x8f], 0
jne 0x432e24
mov al, byte [ebx + 0x8e]
mov byte [ebx + 0x8f], al
mov edx, 0x4338e4
mov eax, dword [ebx + 0x24]
call fcn.00406748
mov byte [ebx + 0x90], al
mov edx, 0x433904
mov eax, dword [ebx + 0x24]
call fcn.00406748
mov byte [ebx + 0xa6], al
mov edx, 0x433920
mov eax, dword [ebx + 0x24]
call fcn.00406748
mov byte [ebx + 0xa9], al
mov edx, 0x433938
mov eax, dword [ebx + 0x24]
call fcn.004068e4
test al, al
je 0x432f8a
mov edx, 0x433954
mov eax, dword [ebx + 0x24]
call fcn.004068e4
test al, al
je 0x432f8a
mov edx, 0x433974
mov eax, dword [ebx + 0x24]
call fcn.004068e4
test al, al
je 0x432f8a
mov edx, 0x433990
mov eax, dword [ebx + 0x24]
call fcn.004068e4
test al, al
je 0x432f8a
mov edx, 0x4339ac
mov eax, dword [ebx + 0x24]
call fcn.004068e4
test al, al
je 0x432f8a
mov edx, 0x4339c4
mov eax, dword [ebx + 0x24]
call fcn.004068e4
test al, al
je 0x432f8a
mov edx, 0x4339e0
mov eax, dword [ebx + 0x24]
call fcn.004068e4
test al, al
je 0x432f8a
mov edx, 0x433974
mov eax, dword [ebx + 0x24]
call fcn.00406748
mov word [ebx + 0x6b2], ax
mov edx, 0x433990
mov eax, dword [ebx + 0x24]
call fcn.00406748
mov word [ebx + 0x6b4], ax
mov edx, 0x4339ac
mov eax, dword [ebx + 0x24]
call fcn.00406748
mov word [ebx + 0x6b6], ax
mov edx, 0x4339c4
mov eax, dword [ebx + 0x24]
call fcn.00406748
mov word [ebx + 0x6b8], ax
mov edx, 0x4339e0
mov eax, dword [ebx + 0x24]
call fcn.00406748
mov word [ebx + 0x6bc], ax
mov edx, 0x433938
mov eax, dword [ebx + 0x24]
call fcn.00406748
mov byte [ebx + 0x6b0], al
mov edx, 0x433954
mov eax, dword [ebx + 0x24]
call fcn.00406748
mov byte [ebx + 0x6b1], al
mov byte [ebx + 0x6e6], 0
mov byte [ebx + 0x6e7], 0
jmp 0x432f98
mov byte [ebx + 0x6e6], 1
mov byte [ebx + 0x6e7], 1
mov edx, 0x4339f8
mov eax, dword [ebx + 0x24]
call fcn.00406748
mov byte [ebx + 0x6e5], al
mov edx, 0x433a1c
mov eax, dword [ebx + 0x24]
call fcn.00406748
mov byte [ebx + 0x6d4], al
mov edx, 0x433a38
mov eax, dword [ebx + 0x24]
call fcn.004068e4
test al, al
je 0x433181
mov edx, 0x433a38
mov eax, dword [ebx + 0x24]
call fcn.00406748
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
cmp al, byte [ebx + 0x7b]
je 0x433058
mov byte [ebx + 0x6e0], 1
test al, al
je 0x43302e
lea eax, [ebp - 0xd]
xor ecx, ecx
mov edx, 8
call fcn.00402b54
mov byte [ebp - 7], 0xef
mov byte [ebp - 0xd], 0x42
mov edx, 0x433a44
mov eax, dword [ebx + 0x24]
call fcn.00406748
mov byte [ebp - 0xc], al
xor ecx, ecx
lea edx, [ebp - 0xd]
mov eax, ebx
call fcn.0041ee14
mov byte [ebx + 0x7b], al
jmp 0x4330aa
lea eax, [ebp - 0xd]
xor ecx, ecx
mov edx, 8
call fcn.00402b54
mov byte [ebp - 7], 0xef
mov byte [ebp - 0xd], 0xc2
xor ecx, ecx
lea edx, [ebp - 0xd]
mov eax, ebx
call fcn.0041ee14
xor al, 1
mov byte [ebx + 0x7b], al
jmp 0x4330aa
mov edx, 0x433a44
mov eax, dword [ebx + 0x24]
call fcn.00406748
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
cmp al, byte [ebx + 0x7c]
je 0x4330aa
mov byte [ebx + 0x6e1], 1
lea eax, [ebp - 0xd]
xor ecx, ecx
mov edx, 8
call fcn.00402b54
mov byte [ebp - 7], 0xef
mov byte [ebp - 0xd], 0x42
mov al, byte [ebp - 5]
mov byte [ebp - 0xc], al
xor ecx, ecx
lea edx, [ebp - 0xd]
mov eax, ebx
call fcn.0041ee14
test al, al
je 0x4330aa
mov al, byte [ebp - 5]
mov byte [ebx + 0x7c], al
mov edx, 0x433a58
mov eax, dword [ebx + 0x24]
call fcn.00406748
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
cmp al, byte [ebx + 0x78]
je 0x43312f
mov byte [ebx + 0x6e2], 1
test al, al
je 0x433105
lea eax, [ebp - 0xd]
xor ecx, ecx
mov edx, 8
call fcn.00402b54
mov byte [ebp - 7], 0xef
mov byte [ebp - 0xd], 5
mov edx, 0x433a64
mov eax, dword [ebx + 0x24]
call fcn.00406748
mov byte [ebp - 0xc], al
xor ecx, ecx
lea edx, [ebp - 0xd]
mov eax, ebx
call fcn.0041ee14
mov byte [ebx + 0x78], al
jmp 0x433181
lea eax, [ebp - 0xd]
xor ecx, ecx
mov edx, 8
call fcn.00402b54
mov byte [ebp - 7], 0xef
mov byte [ebp - 0xd], 0x85
xor ecx, ecx
lea edx, [ebp - 0xd]
mov eax, ebx
call fcn.0041ee14
xor al, 1
mov byte [ebx + 0x78], al
jmp 0x433181
mov edx, 0x433a64
mov eax, dword [ebx + 0x24]
call fcn.00406748
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
cmp al, byte [ebx + 0x79]
je 0x433181
mov byte [ebx + 0x6e3], 1
lea eax, [ebp - 0xd]
xor ecx, ecx
mov edx, 8
call fcn.00402b54
mov byte [ebp - 7], 0xef
mov byte [ebp - 0xd], 5
mov al, byte [ebp - 5]
mov byte [ebp - 0xc], al
xor ecx, ecx
lea edx, [ebp - 0xd]
mov eax, ebx
call fcn.0041ee14
test al, al
je 0x433181
mov al, byte [ebp - 5]
mov byte [ebx + 0x79], al
add edi, 4
dec byte [ebp - 0x15]
jne 0x432d3a
cmp byte [0x442b6c], 0
je 0x43319b
call fcn.004304bc
mov eax, dword [esi + 0x18]
mov edx, dword [eax + 0x24]
and edx, 0xfffeffff
and edx, 0xfffbffff
call fcn.0040b614
call fcn.00430058
cmp byte [0x442c36], 0
je 0x4331c5
call fcn.00432418
mov edx, 0x433a78
mov eax, dword [0x4429e8]
call fcn.004068e4
test al, al
jne 0x433420
mov edx, 0x433a78
mov ecx, 1
mov eax, dword [0x4429e8]
call fcn.0040683c
call fcn.00432650
test al, al
jne 0x4333d0
mov dl, 1
mov eax, 0x433a94
call fcn.0040d758
test al, al
je 0x4333d0
push 0
push 0x433aa8
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x4333d0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 0x14]
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x14], eax
push 0x50030
mov eax, dword [0x442c44]
call fcn.00403fa8
push eax
push 0x433ab8
mov eax, dword [0x4428a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
push 0
push 0
push 0x5b4
push ebx
call sub.user32.dll_PostMessageA
push 0x2710
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x4333d0
mov edx, 0x433b00
mov eax, 0x80000001
call fcn.004066d8
mov ebx, eax
mov edx, 0x433b60
mov eax, ebx
call fcn.0040691c
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4328a8]
call fcn.00404854
add esp, 4
mov eax, dword [ebp - 4]
call fcn.00404680
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x433b60
mov eax, ebx
call fcn.00406948
mov eax, 0x441474
mov eax, dword [eax]
mov edx, dword [ebp - 4]
call fcn.00404048
test eax, eax
je 0x433322
mov edx, dword [ebp - 4]
cmp byte [edx + eax + 0x20f], 2
je 0x433303
mov edx, dword [ebp - 4]
mov byte [edx + eax + 0x20f], 2
mov eax, dword [ebp - 4]
call fcn.00404680
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x433b60
mov eax, ebx
call fcn.00406988
mov eax, ebx
call fcn.004068b4
push 0
push 0
push 0x433b6c
lea edx, [ebp - 0x60]
mov eax, 0x433b78
call fcn.0040e550
lea eax, [ebp - 0x60]
mov edx, 0x433b88
call fcn.00403db0
mov eax, dword [ebp - 0x60]
call fcn.00403fa8
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov al, byte [0x442b6c]
dec eax
test al, al
jb 0x43337f
inc eax
mov byte [ebp - 0x15], al
mov bl, 0
xor eax, eax
mov al, bl
mov edx, dword [0x442c54]
mov eax, dword [edx + eax*4]
call fcn.0040a220
inc ebx
dec byte [ebp - 0x15]
jne 0x433367
call fcn.00430058
cmp byte [0x442c36], 0
je 0x4333d0
mov eax, dword [0x442c7c]
call fcn.00406be4
mov eax, dword [0x442c74]
call fcn.0040a220
mov eax, dword [0x442c78]
call fcn.00408fa4
mov edx, eax
mov eax, dword [0x4428a8]
call fcn.0040c1cc
mov dword [0x442c74], eax
mov eax, dword [0x442c74]
call fcn.0042fe1c
mov eax, dword [0x442c7c]
call fcn.00406bb8
push 0x50044
mov eax, dword [0x442c44]
call fcn.00403fa8
push eax
push 0x433b98
mov eax, dword [0x4428a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
cmp eax, 6
jne 0x43340c
push 5
push 0
push 0
push 0x433c4c
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov ecx, 1
mov edx, 0x433c7c
mov eax, 0x4334fc
call fcn.00432588
mov dword [ebp - 0x48], 0x20
mov dword [ebp - 0x44], 5
push esi
mov esi, 0x4363b4
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_RegisterDeviceNotificationA_1
mov eax, dword [esi + 0x18]
xor edx, edx
mov dword [eax + 0xf2], edx
lea eax, [ebp - 0x68]
call fcn.0040cda4
push dword [ebp - 0x68]
push 0x4336e0
push 0x433ca4
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 0x64]
call fcn.00403fa8
push eax
call sub.kernel32.dll_DeleteFileA
push 0xffffffffffffffff
push 0xffffffffffffffff
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetProcessWorkingSetSize
mov eax, dword [esi + 0x24]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 8]
push pe_nt_image_headers32
push 0
push 0x513
mov eax, dword [esi + 0x2c]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_SendMessageA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4334ea
lea eax, [ebp - 0x68]
mov edx, 8
call fcn.00403b30
lea eax, [ebp - 4]
mov edx, dword [0x4328a8]
call fcn.00404860
ret