Function at 0x524cd0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create process on windows
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3254
mov eax, dword fs:[0]
push eax
sub esp, 0x9d4
mov eax, dword [0x60ef40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x410
push 0
lea eax, [ebp - 0x458]
push eax
call fcn.00537090
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x458]
push ecx
call fcn.0052b380
add esp, 8
movzx edx, al
test edx, edx
jne 0x524d36
mov eax, 0x10300001
jmp 0x52561f
push 0x410
push 0
lea eax, [ebp - 0x868]
push eax
call fcn.00537090
add esp, 0xc
push 0x410
lea ecx, [ebp - 0x458]
push ecx
lea edx, [ebp - 0x868]
push edx
call fcn.00536b10
add esp, 0xc
push 0x5d522c
push 0x410
lea eax, [ebp - 0x868]
push eax
call fcn.00521780
lea ecx, [ebp - 0x868]
push ecx
call fcn.0052b190
add esp, 4
movzx edx, al
test edx, edx
je 0x524da0
lea eax, [ebp - 0x868]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
push 0x40
push 0xa
lea ecx, [ebp - 0x868]
push ecx
lea ecx, [ebp - 0x9e0]
call fcn.00526b90
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x9e0]
mov eax, dword [edx + 4]
lea ecx, [ebp + eax - 0x9e0]
call fcn.004ee0e0
and eax, 2
je 0x524e0b
lea ecx, [ebp - 0x9e0]
call fcn.00528ae0
mov dword [ebp - 0x8a0], 0x10300002
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e0]
call fcn.00527660
mov eax, dword [ebp - 0x8a0]
jmp 0x52561f
push 0x40
push 0x3000
push 0x1000
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x86c], eax
cmp dword [ebp - 0x86c], 0
jne 0x524e6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
lea ecx, [ebp - 0x9e0]
call fcn.00528ae0
mov dword [ebp - 0x8a4], 0x10300003
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e0]
call fcn.00527660
mov eax, dword [ebp - 0x8a4]
jmp 0x52561f
mov dword [ebp - 0x880], 0
lea eax, [ebp - 0x880]
push eax
push str.CallNextHookEx
push str.user32.dll
mov ecx, dword [ebp + 8]
push ecx
call fcn.0051fd10
add esp, 0x10
cmp dword [ebp - 0x880], 0
jne 0x524ede
push 0x8000
push 0
mov edx, dword [ebp - 0x86c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [ebp - 0x8a8], 0x10300004
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e0]
call fcn.00527660
mov eax, dword [ebp - 0x8a8]
jmp 0x52561f
mov byte [ebp - 0x48], 0
mov byte [ebp - 0x47], 0
mov byte [ebp - 0x46], 0
mov byte [ebp - 0x45], 0
mov byte [ebp - 0x44], 0
mov byte [ebp - 0x43], 0
mov byte [ebp - 0x42], 0
mov byte [ebp - 0x41], 0
mov byte [ebp - 0x40], 0x55
mov byte [ebp - 0x3f], 0x8b
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], 0xff
mov byte [ebp - 0x3c], 0x75
mov byte [ebp - 0x3b], 0x10
mov byte [ebp - 0x3a], 0xff
mov byte [ebp - 0x39], 0x75
mov byte [ebp - 0x38], 0xc
mov byte [ebp - 0x37], 0xff
mov byte [ebp - 0x36], 0x75
mov byte [ebp - 0x35], 8
mov byte [ebp - 0x34], 0x6a
mov byte [ebp - 0x33], 0
mov byte [ebp - 0x32], 0xe8
mov byte [ebp - 0x31], 0
mov byte [ebp - 0x30], 0
mov byte [ebp - 0x2f], 0
mov byte [ebp - 0x2e], 0
mov byte [ebp - 0x2d], 0xeb
mov byte [ebp - 0x2c], 0
mov byte [ebp - 0x2b], 0x50
mov byte [ebp - 0x2a], 0x53
mov byte [ebp - 0x29], 0xbb
mov byte [ebp - 0x28], 0
mov byte [ebp - 0x27], 0
mov byte [ebp - 0x26], 0
mov byte [ebp - 0x25], 0
mov byte [ebp - 0x24], 0xc6
mov byte [ebp - 0x23], 0x43
mov byte [ebp - 0x22], 0x1c
mov byte [ebp - 0x21], 0x14
mov byte [ebp - 0x20], 0xff
mov byte [ebp - 0x1f], 0x33
mov byte [ebp - 0x1e], 0xff
mov byte [ebp - 0x1d], 0x53
mov byte [ebp - 0x1c], 4
mov byte [ebp - 0x1b], 0x89
mov byte [ebp - 0x1a], 3
mov byte [ebp - 0x19], 0x5b
mov byte [ebp - 0x18], 0x58
mov byte [ebp - 0x17], 0x5d
mov byte [ebp - 0x16], 0xc2
mov byte [ebp - 0x15], 0xc
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x878], 8
mov ecx, dword [ebp - 0x878]
add ecx, 0x14
mov dword [ebp - 0x8c8], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x878]
mov edx, dword [ebp - 0x86c]
lea eax, [edx + ecx + 0xe]
mov ecx, dword [ebp - 0x880]
sub ecx, eax
sub ecx, 5
mov edx, dword [ebp - 0x878]
mov dword [ebp + edx - 0x39], ecx
mov eax, dword [ebp - 0x878]
mov ecx, dword [ebp - 0x86c]
mov dword [ebp + eax - 0x30], ecx
push 0
push 0x35
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x86c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x525073
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
push 0x8000
push 0
mov eax, dword [ebp - 0x86c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [ebp - 0x8ac], 0x10300005
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e0]
call fcn.00527660
mov eax, dword [ebp - 0x8ac]
jmp 0x52561f
push 0x5266b0
mov edx, dword [ebp - 0x86c]
add edx, dword [ebp - 0x878]
push edx
push 0x529d50
push 0x21
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
push 0x528b10
lea ecx, [ebp - 0x9e0]
call fcn.00527540
mov ecx, eax
call fcn.005273c0
push eax
call fcn.005259a0
add esp, 8
mov ecx, eax
call fcn.00527540
mov ecx, eax
call fcn.005273c0
mov ecx, eax
call fcn.004df900
lea ecx, [ebp - 0x9e0]
call fcn.00528ae0
push 0x5d524c
push 0x410
lea ecx, [ebp - 0x458]
push ecx
call fcn.00521780
xor edx, edx
mov dword [ebp - 0x89c], edx
mov dword [ebp - 0x898], edx
mov dword [ebp - 0x894], edx
mov dword [ebp - 0x890], edx
push 0x44
push 0
lea eax, [ebp - 0x930]
push eax
call fcn.00537090
add esp, 0xc
mov dword [ebp - 0x930], 0x44
mov dword [ebp - 0x904], 1
xor ecx, ecx
mov word [ebp - 0x900], cx
cmp dword [ebp + 0x18], 0xffffffff
je 0x5253c0
mov dword [ebp - 0x874], 0
lea edx, [ebp - 0x874]
push edx
mov eax, dword [ebp + 0x18]
push eax
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x5251a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
push 0x8000
push 0
mov edx, dword [ebp - 0x86c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [ebp - 0x8b0], 0x10300006
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e0]
call fcn.00527660
mov eax, dword [ebp - 0x8b0]
jmp 0x52561f
mov dword [ebp - 0x87c], 0
lea ecx, [ebp - 0x87c]
push ecx
push 1
push 1
push 0
push 0x2000000
mov edx, dword [ebp - 0x874]
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x52522d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov edx, dword [ebp - 0x874]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
mov eax, dword [ebp - 0x86c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [ebp - 0x8e8], 0x10300007
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e0]
call fcn.00527660
mov eax, dword [ebp - 0x8e8]
jmp 0x52561f
mov dword [ebp - 0x8e4], 0
xor edx, edx
mov dword [ebp - 0x88c], edx
lea eax, [ebp - 0x8e4]
push eax
push 4
lea ecx, [ebp - 0x88c]
push ecx
push 0x13
mov edx, dword [ebp - 0x87c]
push edx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x5252c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov edx, dword [ebp - 0x87c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x874]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
mov ecx, dword [ebp - 0x86c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [ebp - 0x8ec], 0x10300008
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e0]
call fcn.00527660
mov eax, dword [ebp - 0x8ec]
jmp 0x52561f
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0x884], eax
mov dword [ebp - 0x930], 0x44
mov dword [ebp - 0x904], 1
xor ecx, ecx
mov word [ebp - 0x900], cx
lea edx, [ebp - 0x89c]
push edx
lea eax, [ebp - 0x930]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x458]
push ecx
mov edx, dword [ebp - 0x884]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x525397
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov edx, dword [ebp - 0x884]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x87c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x874]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
mov edx, dword [ebp - 0x86c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [ebp - 0x8b4], 0x10300009
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e0]
call fcn.00527660
mov eax, dword [ebp - 0x8b4]
jmp 0x52561f
mov ecx, dword [ebp - 0x884]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x87c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x874]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x52543a
lea ecx, [ebp - 0x89c]
push ecx
lea edx, [ebp - 0x930]
push edx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x52543a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
push 0x8000
push 0
mov edx, dword [ebp - 0x86c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [ebp - 0x8b8], 0x10300009
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e0]
call fcn.00527660
mov eax, dword [ebp - 0x8b8]
jmp 0x52561f
push 0x4e20
mov ecx, dword [ebp - 0x89c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x8bc], eax
cmp dword [ebp - 0x8bc], 0
je 0x52549c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
push 0
mov eax, dword [ebp - 0x89c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x8c0], 0x1030000a
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e0]
call fcn.00527660
mov eax, dword [ebp - 0x8c0]
jmp 0x52561f
mov dword [ebp - 0x888], 0
lea ecx, [ebp - 0x888]
push ecx
mov edx, dword [ebp - 0x89c]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x89c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x898]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x888], 0
je 0x52551e
push 0x8000
push 0
mov edx, dword [ebp - 0x86c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, dword [ebp - 0x888]
mov dword [ebp - 0x8c4], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e0]
call fcn.00527660
mov eax, dword [ebp - 0x8c4]
jmp 0x52561f
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [ebp - 0x8d8], eax
mov dword [ebp - 0x8d4], edx
mov byte [ebp - 0x86d], 0
movzx edx, byte [ebp - 0x86d]
test edx, edx
jne 0x5255cc
push 0
push 1
lea eax, [ebp - 0x86d]
push eax
mov ecx, dword [ebp - 0x86c]
add ecx, dword [ebp - 0x8c8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [ebp - 0x8d8]
sbb edx, dword [ebp - 0x8d4]
mov dword [ebp - 0x8e0], eax
mov dword [ebp - 0x8dc], edx
cmp dword [ebp - 0x8dc], 0
ja 0x5255a3
cmp dword [ebp - 0x8e0], 0x4e20
jbe 0x5255c7
mov dword [ebp - 0x8cc], 0x1030000b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e0]
call fcn.00527660
mov eax, dword [ebp - 0x8cc]
jmp 0x52561f
jmp 0x525537
push 0
push 4
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp - 0x86c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x8000
push 0
mov eax, dword [ebp - 0x86c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [ebp - 0x8d0], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e0]
call fcn.00527660
mov eax, dword [ebp - 0x8d0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00534c20
mov esp, ebp
pop ebp
ret