Function at 0x405b4b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0xc
call fcn.0046273d
pop ecx
mov ecx, eax
xor edx, edx
test ecx, ecx
je 0x405b69
mov edi, ecx
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jmp 0x405b6b
mov ecx, edx
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ecx + 8], eax
lea eax, [ebp - 4]
push eax
push edx
push ecx
push 0x405c13
push edx
push edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x405b9b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
push 0x40
xor esi, esi
lea eax, [ebp - 0x50]
xorps xmm0, xmm0
push esi
push eax
movdqu xmmword [ebp - 0x10], xmm0
call fcn.004653c0
add esp, 0xc
mov dword [ebp - 0x54], 0x44
lea eax, [ebp - 0x10]
xor edi, edi
inc edi
mov dword [ebp - 0x28], edi
push eax
lea eax, [ebp - 0x54]
mov word [ebp - 0x24], di
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x405bfd
push edi
push esi
push esi
push dword [ebp + 8]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x405c0d
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x405c7e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x22c
mov ebx, ecx
push edi
call fcn.0046273d
mov esi, eax
pop ecx
test esi, esi
je 0x405ca7
push edi
xor edi, edi
push edi
push esi
call fcn.004653c0
add esp, 0xc
jmp 0x405cab
xor edi, edi
mov esi, edi
mov dword [0x4b62b4], esi
mov dword [esi], edi
mov eax, dword [0x4b62b4]
mov byte [eax + 0x210], 1
mov eax, dword [0x4b62b4]
add eax, 0x214
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.0045c745
push dword [0x4b62b4]
mov ecx, esi
call fcn.0045c772
mov eax, dword [0x4b62b4]
mov ecx, esi
add eax, 0x200
push eax
call fcn.0045c75b
mov eax, dword [0x4b62b4]
mov ecx, esi
add eax, 0x204
push eax
call fcn.0045c75b
mov eax, dword [0x4b62b4]
mov ecx, esi
add eax, 0x208
push eax
call fcn.0045c75b
mov eax, dword [0x4b62b4]
mov ecx, esi
add eax, 0x20c
push eax
call fcn.0045c75b
movzx eax, byte [ebx]
mov esi, edi
mov byte [ebx + 1], 1
sub eax, edi
je 0x405d5b
dec eax
je 0x405d54
dec eax
je 0x405d4d
dec eax
jne 0x405d60
mov esi, 0x40609a
jmp 0x405d60
mov esi, 0x405ed9
jmp 0x405d60
mov esi, 0x4061e9
jmp 0x405d60
mov esi, 0x406382
mov eax, dword [0x4b62b4]
mov ebx, edi
cmp dword [eax + 0x208], edi
jle 0x405d90
push edi
push edi
push eax
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4b62b4]
inc ebx
cmp ebx, dword [eax + 0x208]
jl 0x405d6f
pop edi
pop esi
pop ebx
pop ebp
ret 4