Function at 0x5a0491
Capabilities:
Create thread
Delete file

Disassembly:
jae 0x59ffd1
jmp 0x59ffcc
call fcn.0059ffd3
jae 0x59ffcc
add esp, 4
jmp 0x59ffd8
dec dword [esp]
jno 0x59ffdd
jns 0x59ffc8
jp 0x59ffe1
add esp, 4
popf
jmp 0x59ffe8
clc
jae 0x59ffed
add byte cs:[eax + 0x52], dl
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x5a0006
jne 0x5a0006
add byte [ebx + eax - 0x15], bh
add eax, dword [eax]
jl 0x5a000b
jmp 0x5a000d
je 0x5a0008
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5a0027
jne 0x5a0026
call 0x835df0ae
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x5a0035
jne 0x5a0035
call 0xb54240a3
pop es
std
inc dword [ebx + 0x458904c4]
in al, dx
push 0x40
call fcn.005707f0
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0
je 0x5a005f
mov ecx, dword [ebp - 0x14]
call fcn.005a8a60
mov dword [ebp - 0x1dc], eax
jmp 0x5a0069
mov dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword [0x7a2af0], ecx
push 1
call fcn.005707f0
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x5a00ac
mov ecx, dword [ebp - 0x1c]
call fcn.005a89a0
mov dword [ebp - 0x1e0], eax
jmp 0x5a00b6
mov dword [ebp - 0x1e0], 0
mov edx, dword [ebp - 0x1e0]
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [0x7a2a44], eax
push 8
call fcn.005707f0
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0
je 0x5a00f8
mov ecx, dword [ebp - 0x24]
call fcn.005a3780
mov dword [ebp - 0x1e4], eax
jmp 0x5a0102
mov dword [ebp - 0x1e4], 0
mov ecx, dword [ebp - 0x1e4]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x20]
mov dword [0x7a29f4], edx
push 0x40
call fcn.005c6970
add esp, 4
mov dword [0x7a29ec], eax
push 0x310
call fcn.005c6970
add esp, 4
mov dword [0x7a29f0], eax
push 4
call fcn.005707f0
add esp, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 3
cmp dword [ebp - 0x2c], 0
je 0x5a0166
mov ecx, dword [ebp - 0x2c]
call fcn.005aab10
mov dword [ebp - 0x1e8], eax
jmp 0x5a0170
mov dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x28]
mov dword [0x7a2d34], ecx
push 4
call fcn.005707f0
add esp, 4
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 4
cmp dword [ebp - 0x34], 0
je 0x5a01b3
mov ecx, dword [ebp - 0x34]
call fcn.005a9fe0
mov dword [ebp - 0x1ec], eax
jmp 0x5a01bd
mov dword [ebp - 0x1ec], 0
mov edx, dword [ebp - 0x1ec]
mov dword [ebp - 0x30], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x30]
mov dword [0x7a2cfc], eax
push 4
call fcn.005707f0
add esp, 4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 5
cmp dword [ebp - 0x3c], 0
je 0x5a01ff
mov ecx, dword [ebp - 0x3c]
call fcn.005a9e40
mov dword [ebp - 0x1f0], eax
jmp 0x5a0209
mov dword [ebp - 0x1f0], 0
mov ecx, dword [ebp - 0x1f0]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x38]
mov dword [0x7a2cc4], edx
push 4
call fcn.005707f0
add esp, 4
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 6
cmp dword [ebp - 0x44], 0
je 0x5a024c
mov ecx, dword [ebp - 0x44]
call fcn.005a9e00
mov dword [ebp - 0x1f4], eax
jmp 0x5a0256
mov dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x40]
mov dword [0x7a2c84], ecx
push 4
call fcn.005707f0
add esp, 4
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], 7
cmp dword [ebp - 0x4c], 0
je 0x5a0299
mov ecx, dword [ebp - 0x4c]
call fcn.005a9a70
mov dword [ebp - 0x1f8], eax
jmp 0x5a02a3
mov dword [ebp - 0x1f8], 0
mov edx, dword [ebp - 0x1f8]
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x48]
mov dword [0x7a2c1c], eax
push 4
call fcn.005707f0
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 8
cmp dword [ebp - 0x54], 0
je 0x5a02e5
mov ecx, dword [ebp - 0x54]
call fcn.005a98f0
mov dword [ebp - 0x1fc], eax
jmp 0x5a02ef
mov dword [ebp - 0x1fc], 0
mov ecx, dword [ebp - 0x1fc]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x50]
mov dword [0x7a2be4], edx
push 4
call fcn.005707f0
add esp, 4
mov dword [ebp - 0x5c], eax
mov dword [ebp - 4], 9
cmp dword [ebp - 0x5c], 0
je 0x5a0332
mov ecx, dword [ebp - 0x5c]
call fcn.005a95e0
mov dword [ebp - 0x200], eax
jmp 0x5a033c
mov dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x58], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x58]
mov dword [0x7a2b74], ecx
push 4
call fcn.005707f0
add esp, 4
mov dword [ebp - 0x64], eax
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x64], 0
je 0x5a037f
mov ecx, dword [ebp - 0x64]
call fcn.005a98b0
mov dword [ebp - 0x204], eax
jmp 0x5a0389
mov dword [ebp - 0x204], 0
mov edx, dword [ebp - 0x204]
mov dword [ebp - 0x60], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x60]
mov dword [0x7a2bac], eax
push 4
call fcn.005707f0
add esp, 4
mov dword [ebp - 0x6c], eax
mov dword [ebp - 4], 0xb
cmp dword [ebp - 0x6c], 0
je 0x5a03cb
mov ecx, dword [ebp - 0x6c]
call fcn.005a9340
mov dword [ebp - 0x208], eax
jmp 0x5a03d5
mov dword [ebp - 0x208], 0
mov ecx, dword [ebp - 0x208]
mov dword [ebp - 0x68], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x68]
mov dword [0x7a2af8], edx
pushf
push 0xa
jae 0x5a03fb
jmp 0x5a03f6
call 0x5a03fd
jae 0x5a03f6
add esp, 4
jmp 0x5a0402
dec dword [esp]
jno 0x5a0407
jns 0x5a03f2
jp 0x5a040b
add esp, 4
popf
jmp 0x5a0412
clc
jae 0x5a0417
xor dl, 0x50
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x5a0430
jne 0x5a0430
bnd jl 0x5a0435
jl 0x5a0435
jmp 0x5a0437
je 0x5a0432
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5a0451
jne 0x5a0450
call 0x835df4d8
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x5a045f
jne 0x5a045f
call 0x44507df
push ss
jl 0x5a0464
jmp 0x5a0466
je 0x5a0461
xor eax, eax
test eax, eax
je 0x5a046f
jne 0x5a046e
call 0x835df4f6
rol byte [ebx + eax*4], 0xf0
add eax, 0x270273f8
xor eax, 3
add eax, 4
xor eax, 5
clc
jae 0x5a047d
daa
push ss
je 0x5a0482
jne 0x5a0482
push ss
pushf
push 0xa
jae 0x5a048f
jmp 0x5a048a
call 0x5a0491
jae 0x5a048a
add esp, 4
jmp 0x5a0496
dec dword [esp]
jno 0x5a049b
jns 0x5a0486
jp 0x5a049f
add esp, 4
popf
jmp 0x5a04a6
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x5a04bf
jne 0x5a04bf
call 0x101a3813
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
cmp dword [0x7a2af0], 0
je 0x5a055e
cmp dword [0x7a2a44], 0
je 0x5a055e
cmp dword [0x7a29ec], 0
je 0x5a055e
cmp dword [0x7a29f0], 0
je 0x5a055e
cmp dword [0x7a2d34], 0
je 0x5a055e
cmp dword [0x7a29f4], 0
je 0x5a055e
cmp dword [0x7a2cfc], 0
je 0x5a055e
cmp dword [0x7a2cc4], 0
je 0x5a055e
cmp dword [0x7a2c84], 0
je 0x5a055e
cmp dword [0x7a2c1c], 0
je 0x5a055e
cmp dword [0x7a2be4], 0
je 0x5a055e
cmp dword [0x7a2bac], 0
je 0x5a055e
cmp dword [0x7a2b74], 0
je 0x5a055e
cmp dword [0x7a2af8], 0
je 0x5a055e
mov dword [ebp - 0x20c], 0
jmp 0x5a0568
mov dword [ebp - 0x20c], 1
movzx eax, byte [ebp - 0x20c]
test eax, eax
je 0x5a05bc
push 0
push 0
push 0xbb8
push 0x594910
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x92a8c10b
push ecx
lea ecx, [ebp - 0x8c]
call fcn.0059b290
mov dword [ebp - 0x210], eax
mov edx, dword [ebp - 0x210]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
lea ecx, [ebp - 0x8c]
call fcn.00594a20
pushf
push 0xa
jae 0x5a05c9
jmp 0x5a05c4
call 0x5a05cb
jae 0x5a05c4
add esp, 4
jmp 0x5a05d0
dec dword [esp]
jno 0x5a05d5
jns 0x5a05c0
jp 0x5a05d9
add esp, 4
popf
jmp 0x5a05e0
clc
jae 0x5a05e5
dec ebp
or edx, dword [eax + 0x52]
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x5a05fe
jne 0x5a05fe
or edi, dword [ebx + eax - 0x15]
add ecx, dword [ebx]
jl 0x5a0603
jmp 0x5a0605
je 0x5a0600
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5a061f
jne 0x5a061e
call 0x835df6a6
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x5a062d
jne 0x5a062d
call 0x44509ad
sal dword [ebx + edi*8 + 0x33], 1
rol byte [ebp + 0x750374c0], 0
jl 0x5a0632
jmp 0x5a0634
je 0x5a062f
xor eax, eax
test eax, eax
je 0x5a063d
jne 0x5a063c
call 0x835df6c4
rol byte [ebx + eax*4], 0xf0
add eax, 0xf40273f8
sal dword [ebx + eax + 0x75], 1
add ecx, edx
xor eax, 3
add eax, 4
xor eax, 5
clc
jae 0x5a064b
hlt
je 0x5a0650
jne 0x5a0650
shl dword [esi - 0x64], 1
pushf
push 0xa
jae 0x5a065d
jmp 0x5a0658
call 0x5a065f
jae 0x5a0658
add esp, 4
jmp 0x5a0664
dec dword [esp]
jno 0x5a0669
jns 0x5a0654
jp 0x5a066d
add esp, 4
popf
jmp 0x5a0674
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x5a068d
jne 0x5a068d
call 0x101a39e1
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov eax, 0xa9d5cbae
push eax
lea ecx, [ebp - 0xa3]
call fcn.00594d40
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x214]
push ecx
call sub.MSVCR90.dll_remove
add esp, 4
lea ecx, [ebp - 0xa3]
call fcn.005a2070
mov edx, 0xb07e38f2
push edx
lea ecx, [ebp - 0xb7]
call fcn.00594cf0
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0xc
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xa8], esp
mov edx, dword [ebp - 0x21c]
push edx
call fcn.00406ec0
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 0xd
push 0
mov ecx, 0xa9d5cbae
push ecx
lea ecx, [ebp - 0xd3]
call fcn.00594d40
mov dword [ebp - 0x228], eax
mov edx, dword [ebp - 0x228]
mov dword [ebp - 0x22c], edx
mov byte [ebp - 4], 0xe
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xbc], esp
mov eax, dword [ebp - 0x22c]
push eax
call fcn.00406ec0
mov dword [ebp - 0x230], eax
mov byte [ebp - 4], 0xf
mov ecx, dword [0x7a2af0]
call fcn.005a8ae0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xd3]
call fcn.005a2070
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb7]
call fcn.005adb80
mov ecx, dword [0x7a29f4]
call fcn.005a8790
push 0x4863124
lea ecx, [ebp - 0x103]
call fcn.0059b2e0
mov dword [ebp - 0x234], eax
mov ecx, dword [ebp - 0x234]
mov dword [ebp - 0x238], ecx
mov dword [ebp - 4], 0x10
mov edx, dword [ebp - 0x238]
push edx
push 0
mov eax, dword [0x7a2af0]
push eax
call fcn.005a8fe0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x103]
call fcn.00594bd0
push 0x32f9b9ed
lea ecx, [ebp - 0x135]
call fcn.0059b330
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp - 0x23c]
mov dword [ebp - 0x240], ecx
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x240]
push edx
push 0
mov eax, dword [0x7a2af0]
push eax
call fcn.005a8fe0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x135]
call fcn.00594bc0
push 0x1bee3cf4
lea ecx, [ebp - 0x163]
call fcn.0059b380
mov dword [ebp - 0x244], eax
mov ecx, dword [ebp - 0x244]
mov dword [ebp - 0x248], ecx
mov dword [ebp - 4], 0x12
mov edx, dword [ebp - 0x248]
push edx
push 0
mov eax, dword [0x7a2af0]
push eax
call fcn.005a8fe0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x163]
call fcn.00594b60
mov ecx, 0xc837d766
push ecx
lea ecx, [ebp - 0x193]
call fcn.0059b3d0
mov dword [ebp - 0x24c], eax
mov edx, dword [ebp - 0x24c]
mov dword [ebp - 0x250], edx
mov dword [ebp - 4], 0x13
mov eax, dword [ebp - 0x250]
push eax
push 0
mov ecx, dword [0x7a2af0]
push ecx
call fcn.005a8fe0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x193]
call fcn.00594bd0
pushf
push 0xa
jae 0x5a08fe
jmp 0x5a08f9
call 0x5a0900
jae 0x5a08f9
add esp, 4
jmp 0x5a0905
dec dword [esp]
jno 0x5a090a
jns 0x5a08f5
jp 0x5a090e
add esp, 4
popf
jmp 0x5a0915
clc
jae 0x5a091a
xor al, 0xc6
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x5a0933
jne 0x5a0933
invalid
jl 0x5a0938
jmp 0x5a093a
je 0x5a0935
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5a0954
jne 0x5a0953
call 0x835df9db
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x5a0962
jne 0x5a0962
call 0x654e56f1
mov dword [0], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret