Function at 0x5333dc
Capabilities:
Create process on windows
Create process suspended
Delete file
Print debug messages
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x14
push 0
push 0
dec ecx
jne 0x5333e4
mov eax, 0x532e34
call fcn.00406918
xor eax, eax
push ebp
push 0x533ad7
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [0x533ae4]
push eax
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [0x53d04c]
mov eax, dword [eax]
call fcn.0046a9fc
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00409bb4
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov edx, 0x533af0
call fcn.0040e528
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x533afc
call fcn.00404848
mov eax, dword [ebp - 0x18]
call fcn.004049fc
push eax
push 0xffffffffffffffff
push 0
call fcn.00406b78
mov dword [0x53f680], eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x533500
xor eax, eax
call fcn.00532bf4
test al, al
je 0x533484
mov eax, 0x533b1c
call fcn.00532a34
jmp 0x533500
push 0x40
mov ecx, 0x533b2c
mov edx, 0x533b34
mov eax, dword [0x53d04c]
mov eax, dword [eax]
call fcn.0046a57c
push 0
push 0x533b74
call sub.user32.dll_FindWindowA
mov dword [0x53f684], eax
cmp dword [0x53f684], 0
jbe 0x5334c6
mov eax, dword [0x53f684]
push eax
call sub.user32.dll_SetForegroundWindow
jmp 0x533aa4
push 0x533b80
push 0x533b90
call sub.user32.dll_FindWindowA
mov dword [0x53f684], eax
cmp dword [0x53f684], 0
jbe 0x533aa4
push 0
push 0
push 0xd8e
mov eax, dword [0x53f684]
push eax
call sub.user32.dll_PostMessageA
jmp 0x533aa4
call fcn.00402bf8
test eax, eax
jl 0x53353c
inc eax
mov dword [ebp - 0x14], eax
mov dword [0x53f688], 0
lea edx, [ebp - 0x28]
mov eax, dword [0x53f688]
call fcn.00402c58
mov edx, dword [ebp - 0x28]
mov eax, 0x53f68c
call fcn.00404804
inc dword [0x53f688]
dec dword [ebp - 0x14]
jne 0x533517
lea eax, [ebp - 0x2c]
mov ecx, dword [0x53f68c]
mov edx, 0x533ba0
call fcn.00404848
mov eax, dword [ebp - 0x2c]
call fcn.004049fc
push eax
call sub.kernel32.dll_OutputDebugStringA
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.00402c58
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00409bb4
mov edx, dword [ebp - 0x30]
mov eax, 0x53f614
call fcn.00404590
lea edx, [ebp - 0x3c]
mov eax, dword [0x53d04c]
mov eax, dword [eax]
call fcn.0046a9fc
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.00409c3c
mov edx, dword [ebp - 0x38]
mov eax, 0x53f61c
call fcn.00404590
push 1
lea eax, [ebp - 0x40]
push eax
mov eax, 0x53f61c
mov cl, 1
mov edx, 0x533bc4
call fcn.00470940
mov edx, dword [ebp - 0x40]
mov eax, 0x53f618
call fcn.00404590
push dword [0x53f614]
push dword [0x53f618]
push 0x533bd0
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.004048bc
mov eax, dword [ebp - 0x44]
call fcn.00409770
test al, al
je 0x533812
push dword [0x53f614]
push dword [0x53f618]
push 0x533bd0
lea eax, [ebp - 0x58]
mov edx, 3
call fcn.004048bc
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
call fcn.004fea30
lea eax, [ebp - 0x54]
push eax
lea edx, [ebp - 0x6c]
mov eax, dword [0x53d04c]
mov eax, dword [eax]
call fcn.0046a9fc
mov eax, dword [ebp - 0x6c]
lea edx, [ebp - 0x68]
call fcn.004fea30
lea eax, [ebp - 0x68]
pop edx
call fcn.004fec4c
test al, al
jne 0x533812
mov dl, 1
mov eax, dword [0x418518]
call fcn.004035f8
mov dword [0x53f624], eax
push 0x533be0
push dword [0x53f614]
push dword [0x53f618]
push 0x533bf0
lea eax, [ebp - 0x70]
mov edx, 4
call fcn.004048bc
mov edx, dword [ebp - 0x70]
mov eax, dword [0x53f624]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x533c00
push dword [0x53f614]
push dword [0x53f618]
push 0x533c10
push dword [0x53f614]
push dword [0x53f618]
push 0x533bf0
lea eax, [ebp - 0x74]
mov edx, 7
call fcn.004048bc
mov edx, dword [ebp - 0x74]
mov eax, dword [0x53f624]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x533c24
push dword [0x53f614]
push dword [0x53f618]
push 0x533c30
lea edx, [ebp - 0x7c]
mov eax, dword [0x53ce9c]
mov eax, dword [eax]
call fcn.00500654
push dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
mov edx, 5
call fcn.004048bc
mov edx, dword [ebp - 0x78]
mov eax, dword [0x53f624]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x533be0
push dword [0x53f614]
push 0x533c40
lea eax, [ebp - 0x80]
mov edx, 3
call fcn.004048bc
mov edx, dword [ebp - 0x80]
mov eax, dword [0x53f624]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x84]
mov ecx, 0x533c54
mov edx, dword [0x53f614]
call fcn.00404848
mov edx, dword [ebp - 0x84]
mov eax, dword [0x53f624]
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [0x53f624]
call fcn.00403628
call sub.kernel32.dll_GetCurrentProcessId
push eax
push 0
push 0x200
call sub.kernel32.dll_OpenProcess
mov dword [0x53f628], eax
push 0x80
mov eax, dword [0x53f628]
push eax
call sub.kernel32.dll_SetPriorityClass
mov eax, dword [0x53f628]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, 0x53f62c
xor ecx, ecx
mov edx, 0x44
call fcn.00402fb4
mov eax, 0x53f670
xor ecx, ecx
mov edx, 0x10
call fcn.00402fb4
push 0x53f670
push 0x53f62c
mov eax, dword [0x53f614]
call fcn.004049fc
push eax
push 0
push 0x8000000
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x88]
mov ecx, 0x533c54
mov edx, dword [0x53f614]
call fcn.00404848
mov eax, dword [ebp - 0x88]
call fcn.004049fc
push eax
call sub.kernel32.dll_CreateProcessA
jmp 0x533aa4
call fcn.00402bf8
test eax, eax
lea eax, [ebp - 0x8c]
mov ecx, 0x533c68
mov edx, dword [0x53f614]
call fcn.00404848
mov eax, dword [ebp - 0x8c]
call fcn.004049fc
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [0x53d04c]
mov eax, dword [eax]
call fcn.0046a354
mov eax, dword [0x53d04c]
mov eax, dword [eax]
mov edx, 0x533c80
call fcn.00469f4c
mov ecx, dword [0x53d230]
mov eax, dword [0x53d04c]
mov eax, dword [eax]
mov edx, dword [0x52ce04]
call fcn.0046a36c
lea eax, [ebp - 0x90]
mov ecx, 0x533c94
mov edx, dword [0x53f614]
call fcn.00404848
mov eax, dword [ebp - 0x90]
call fcn.0050181c
lea eax, [ebp - 0x94]
mov ecx, 0x533c94
mov edx, dword [0x53f614]
call fcn.00404848
mov eax, dword [ebp - 0x94]
call fcn.00501734
mov edx, 0x533b1c
xor ecx, ecx
mov eax, 1
call fcn.00471754
mov eax, dword [0x53ce9c]
mov eax, dword [eax]
mov edx, 0x533ca4
call fcn.005007cc
test eax, eax
setge al
mov edx, dword [0x53d230]
mov edx, dword [edx]
mov byte [edx + 0x418], al
mov eax, dword [0x53d230]
mov eax, dword [eax]
cmp byte [eax + 0x418], 0
je 0x533a46
mov eax, dword [0x53d04c]
mov eax, dword [eax]
mov byte [eax + 0x5b], 0
mov eax, dword [0x53cc64]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x98]
push eax
mov eax, dword [0x53d230]
mov eax, dword [eax]
mov edx, dword [eax + 0x414]
lea eax, [ebp - 0x9c]
mov ecx, 0x533cb4
call fcn.00404848
mov edx, dword [ebp - 0x9c]
mov ecx, 0x533cc8
mov eax, dword [0x50ed48]
call fcn.0050fbb4
mov eax, dword [ebp - 0x98]
mov edx, dword [0x53cc0c]
mov dl, byte [edx]
call fcn.0050f2ec
test al, al
je 0x533973
mov eax, dword [0x53d230]
mov eax, dword [eax]
xor edx, edx
call fcn.0052fb58
lea ecx, [ebp - 0xa0]
mov eax, dword [0x53ce9c]
mov eax, dword [eax]
mov edx, 0x533cd8
call fcn.00500750
mov edx, dword [ebp - 0xa0]
mov eax, dword [0x53d230]
mov eax, dword [eax]
call fcn.00531a80
mov byte [0x53f690], al
cmp byte [0x53f690], 0
je 0x5339cb
push dword [0x53f614]
push 0x533c94
push 0x533cec
mov eax, 0x53f61c
mov edx, 3
call fcn.004048bc
jmp 0x5339ea
push dword [0x53f614]
push 0x533c94
push 0x533cec
mov eax, 0x53f61c
mov edx, 3
call fcn.004048bc
mov eax, dword [0x53f61c]
call fcn.00500a8c
mov eax, 0x53f620
mov ecx, 0x533d00
mov edx, dword [0x53f614]
call fcn.00404848
mov eax, dword [0x53f620]
call fcn.00500a8c
mov eax, 0x53f620
mov ecx, 0x533d24
mov edx, dword [0x53f614]
call fcn.00404848
mov eax, dword [0x53f620]
call fcn.00500a8c
mov eax, dword [0x53d230]
mov eax, dword [eax]
mov cl, 1
mov edx, dword [0x53f61c]
call fcn.0052ecc0
mov eax, 0x53f620
mov ecx, 0x533d38
mov edx, dword [0x53f614]
call fcn.00404848
mov eax, dword [0x53f620]
call fcn.00500a8c
mov eax, 0x53f620
mov ecx, 0x533d50
mov edx, dword [0x53f614]
call fcn.00404848
mov eax, dword [0x53f620]
call fcn.00500a8c
mov eax, dword [0x53d04c]
mov eax, dword [eax]
call fcn.0046a3ec
cmp dword [0x53f680], 0
jbe 0x533aa4
mov eax, dword [0x53f680]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x533ade
lea eax, [ebp - 0xa0]
mov edx, 0xe
call fcn.00404560
lea eax, [ebp - 0x58]
call fcn.0040453c
lea eax, [ebp - 0x44]
mov edx, 0xc
call fcn.00404560
ret