Function at 0x44ee58
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
push esp
pop ebp
mov ecx, 0x4e
push 0
push 0
dec ecx
jne 0x44ee60
push ecx
push ebx
push esi
push edi
lea ebx, [ebp - 0x1cc]
sub eax, eax
push ebp
push 0x44f7c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [0x45e3c4]
mov ecx, dword [ecx]
lea eax, [ebp - 0x1d0]
mov edx, 0x44f7dc
call fcn.004050a8
mov eax, dword [ebp - 0x1d0]
call fcn.0043b6d0
test al, al
jne 0x44f7a6
xor eax, eax
push ebp
push 0x44f795
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x45e434]
mov dword [eax], 1
call fcn.0044e394
push 0x32
call sub.KERNEL32.DLL_Sleep_1
mov eax, dword [0x45e3c0]
mov eax, dword [eax]
call fcn.0040525c
mov edx, eax
push ebx
pop eax
call fcn.00403188
push ebx
pop eax
call fcn.00402f18
call fcn.00402b74
mov edx, 0x44f810
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
mov edx, 0x44f824
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
mov edx, 0x44f844
mov eax, ebx
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f854
mov eax, dword [0x45df6c]
push dword [eax + 0x10]
push 0x44f870
lea eax, [ebp - 0x1d4]
mov edx, 3
call fcn.0040511c
mov edx, dword [ebp - 0x1d4]
mov eax, ebx
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f854
mov eax, dword [0x45e254]
push dword [eax]
push 0x44f87c
lea eax, [ebp - 0x1d8]
mov edx, 3
call fcn.0040511c
mov edx, dword [ebp - 0x1d8]
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f888
mov eax, dword [0x45e364]
push dword [eax]
push 0x44f898
lea eax, [ebp - 0x1dc]
push 3
pop edx
push eax
pop eax
call fcn.0040511c
mov edx, dword [ebp - 0x1dc]
mov eax, ebx
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f888
mov eax, dword [0x45e14c]
push dword [eax]
push 0x44f898
lea eax, [ebp - 0x1e0]
mov edx, 3
call fcn.0040511c
mov edx, dword [ebp - 0x1e0]
mov eax, ebx
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f888
mov eax, dword [0x45e048]
push dword [eax]
push 0x44f898
lea eax, [ebp - 0x1e4]
nop
nop
push 3
pop edx
call fcn.0040511c
mov edx, dword [ebp - 0x1e4]
mov eax, ebx
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f888
mov eax, dword [0x45e3b8]
push dword [eax]
push 0x44f898
lea eax, [ebp - 0x1e8]
pushal
popal
push 3
pop edx
call fcn.0040511c
mov edx, dword [ebp - 0x1e8]
mov eax, ebx
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f888
mov eax, dword [0x45e2dc]
push dword [eax]
push 0x44f898
lea eax, [ebp - 0x1ec]
nop
push 3
nop
pop edx
call fcn.0040511c
mov edx, dword [ebp - 0x1ec]
mov eax, ebx
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f888
mov eax, dword [0x45e16c]
push dword [eax]
push 0x44f898
lea eax, [ebp - 0x1f0]
push 3
pop edx
nop
nop
call fcn.0040511c
mov edx, dword [ebp - 0x1f0]
mov eax, ebx
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f888
mov eax, dword [0x45e054]
push dword [eax]
push 0x44f898
lea eax, [ebp - 0x1f4]
mov edx, 3
call fcn.0040511c
mov edx, dword [ebp - 0x1f4]
mov eax, ebx
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f888
mov eax, dword [0x45e040]
push dword [eax]
push 0x44f898
lea eax, [ebp - 0x1f8]
push 3
pop edx
push edi
pop edi
call fcn.0040511c
mov edx, dword [ebp - 0x1f8]
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f888
mov eax, dword [0x45e1a8]
push dword [eax]
push 0x44f898
lea eax, [ebp - 0x1fc]
nop
push 3
nop
pop edx
call fcn.0040511c
mov edx, dword [ebp - 0x1fc]
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f888
mov eax, dword [0x45e29c]
push dword [eax]
push 0x44f898
lea eax, [ebp - 0x200]
mov edx, 3
call fcn.0040511c
mov edx, dword [ebp - 0x200]
mov eax, ebx
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f888
mov eax, dword [0x45e2a4]
push dword [eax]
push 0x44f898
lea eax, [ebp - 0x204]
mov edx, 3
call fcn.0040511c
mov edx, dword [ebp - 0x204]
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f888
mov eax, dword [0x45e3a8]
push dword [eax]
push 0x44f898
lea eax, [ebp - 0x208]
push ecx
pop ecx
push 3
pop edx
call fcn.0040511c
mov edx, dword [ebp - 0x208]
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f888
mov eax, dword [0x45e254]
push dword [eax]
push 0x44f898
lea eax, [ebp - 0x20c]
mov edx, 3
call fcn.0040511c
mov edx, dword [ebp - 0x20c]
mov eax, ebx
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f888
mov eax, dword [0x45e46c]
push dword [eax]
push 0x44f898
lea eax, [ebp - 0x210]
nop
nop
push 3
pop edx
call fcn.0040511c
mov edx, dword [ebp - 0x210]
mov eax, ebx
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f8a8
mov eax, dword [0x45e034]
push dword [eax]
mov eax, dword [0x45e380]
push dword [eax]
push 0x44f8bc
lea eax, [ebp - 0x214]
mov edx, 4
call fcn.0040511c
mov edx, dword [ebp - 0x214]
mov eax, ebx
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f8a8
mov eax, dword [0x45df6c]
push dword [eax + 0x14]
push 0x44f8bc
lea eax, [ebp - 0x218]
push 3
pop edx
push eax
pop eax
call fcn.0040511c
mov edx, dword [ebp - 0x218]
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f8a8
lea edx, [ebp - 0x220]
mov eax, dword [0x45e254]
mov eax, dword [eax]
call fcn.0040943c
push dword [ebp - 0x220]
push 0x44f8bc
lea eax, [ebp - 0x21c]
nop
push 3
nop
pop edx
call fcn.0040511c
mov edx, dword [ebp - 0x21c]
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f8a8
lea eax, [ebp - 0x228]
push eax
mov eax, dword [0x45e334]
mov eax, dword [eax]
call fcn.0040505c
push eax
pop ecx
dec ecx
mov eax, dword [0x45e334]
mov eax, dword [eax]
pushfd
xor edx, edx
inc edx
popfd
call fcn.004052bc
push dword [ebp - 0x228]
push 0x44f8bc
lea eax, [ebp - 0x224]
push 3
pop edx
pushal
popal
call fcn.0040511c
mov edx, dword [ebp - 0x224]
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f8c8
mov eax, dword [0x45e14c]
push dword [eax]
push 0x44f8dc
lea eax, [ebp - 0x22c]
pushal
popal
push 3
pop edx
call fcn.0040511c
mov edx, dword [ebp - 0x22c]
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f8c8
mov eax, dword [0x45e048]
push dword [eax]
push 0x44f8dc
lea eax, [ebp - 0x230]
nop
push 3
nop
pop edx
call fcn.0040511c
mov edx, dword [ebp - 0x230]
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f8c8
mov eax, dword [0x45e16c]
push dword [eax]
push 0x44f8dc
lea eax, [ebp - 0x234]
nop
push 3
nop
pop edx
call fcn.0040511c
mov edx, dword [ebp - 0x234]
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f8c8
mov eax, dword [0x45e054]
push dword [eax]
push 0x44f8dc
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.0040511c
mov edx, dword [ebp - 0x238]
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f8c8
mov eax, dword [0x45e3b8]
push dword [eax]
push 0x44f8dc
lea eax, [ebp - 0x23c]
mov edx, 3
call fcn.0040511c
mov edx, dword [ebp - 0x23c]
mov eax, ebx
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f8c8
mov eax, dword [0x45e2dc]
push dword [eax]
push 0x44f8dc
lea eax, [ebp - 0x240]
push 3
pop edx
pushal
popal
call fcn.0040511c
mov edx, dword [ebp - 0x240]
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f8c8
mov ecx, dword [0x45df6c]
mov ecx, dword [ecx + 0x10]
mov edx, dword [0x45df6c]
mov edx, dword [edx + 0x14]
lea eax, [ebp - 0x24c]
call fcn.004050a8
mov eax, dword [ebp - 0x24c]
call fcn.0040525c
push eax
pop edx
lea eax, [ebp - 0x248]
call fcn.00404f94
push dword [ebp - 0x248]
push 0x44f8dc
lea eax, [ebp - 0x244]
mov edx, 3
call fcn.0040511c
mov edx, dword [ebp - 0x244]
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f8c8
mov eax, dword [0x45e254]
mov eax, dword [eax]
call fcn.0040525c
mov edx, eax
lea eax, [ebp - 0x254]
call fcn.00404f94
push dword [ebp - 0x254]
push 0x44f8dc
lea eax, [ebp - 0x250]
nop
push 3
nop
pop edx
call fcn.0040511c
mov edx, dword [ebp - 0x250]
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f8c8
mov eax, dword [0x45e334]
push dword [eax]
mov eax, dword [0x45dfb8]
push dword [eax]
lea edx, [ebp - 0x264]
mov eax, 0x44f8f0
call fcn.00458fb8
push dword [ebp - 0x264]
lea eax, [ebp - 0x260]
push 3
pop edx
push ecx
pop ecx
call fcn.0040511c
mov eax, dword [ebp - 0x260]
call fcn.0040525c
push eax
pop edx
lea eax, [ebp - 0x25c]
call fcn.00404f94
push dword [ebp - 0x25c]
push 0x44f8dc
lea eax, [ebp - 0x258]
mov edx, 3
call fcn.0040511c
mov edx, dword [ebp - 0x258]
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f888
mov eax, dword [0x45e46c]
push dword [eax]
push 0x44f898
lea eax, [ebp - 0x268]
mov edx, 3
call fcn.0040511c
mov edx, dword [ebp - 0x268]
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f888
mov eax, dword [0x45dfa4]
push dword [eax]
push 0x44f898
lea eax, [ebp - 0x26c]
push 3
pop edx
push ebx
pop ebx
call fcn.0040511c
mov edx, dword [ebp - 0x26c]
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f8c8
mov eax, dword [0x45e46c]
push dword [eax]
push 0x44f8dc
lea eax, [ebp - 0x270]
push 3
pop edx
nop
nop
call fcn.0040511c
mov edx, dword [ebp - 0x270]
mov eax, ebx
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push 0x44f888
mov eax, dword [0x45e3c0]
push dword [eax]
push 0x44f898
lea eax, [ebp - 0x274]
push edi
pop edi
push 3
pop edx
call fcn.0040511c
mov edx, dword [ebp - 0x274]
mov eax, ebx
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
mov edx, 0x44f91c
push ebx
pop eax
call fcn.004053f0
call fcn.00403aa0
call fcn.00402b74
push ebx
pop eax
call fcn.0040332c
call fcn.00402b74
push 0
mov eax, dword [0x45e3c0]
mov eax, dword [eax]
call fcn.0040525c
push eax
call sub.KERNEL32.DLL_WinExec
push 0
mov eax, dword [0x45e3c0]
mov eax, dword [eax]
call fcn.0040525c
push eax
call sub.KERNEL32.DLL_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44f79f
push 0
call sub.KERNEL32.DLL_ExitProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f7cb
lea eax, [ebp - 0x274]
pushal
popal
push 0x2a
pop edx
call fcn.00404dc0
ret