Function at 0x57ed48
Capabilities:
Delete file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x15
push 0
push 0
dec ecx
jne 0x57ed50
push ecx
push ebx
push esi
push edi
mov ebx, 0x58e3f4
xor eax, eax
push ebp
push 0x57f402
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 1
xor eax, eax
call fcn.004a6b2c
mov edx, 2
mov eax, 0x57f41c
call fcn.004a6b2c
mov ecx, 0x57f448
mov edx, 0x57f464
mov eax, 0x80000002
call fcn.004a4dec
push 0
xor ecx, ecx
mov edx, 0x57f464
mov eax, 0x80000002
call fcn.004a4e94
push 0x57f494
push 0
call sub.user32.dll_FindWindowA
test eax, eax
je 0x57edd6
push 0
push 0
push 0x10
push eax
call sub.user32.dll_SendMessageA
push 0xfa0
call sub.kernel32.dll_Sleep_2
lea eax, [ebp - 4]
mov ecx, 0x57f4a8
mov edx, dword [ebx]
call fcn.004055fc
mov eax, dword [ebp - 4]
call fcn.0040a95c
test al, al
je 0x57ee2c
lea eax, [ebp - 0xc]
mov ecx, 0x57f4a8
mov edx, dword [ebx]
call fcn.004055fc
mov eax, dword [ebp - 0xc]
call fcn.00405774
mov edx, eax
lea eax, [ebp - 8]
call fcn.004054dc
mov esi, dword [ebp - 8]
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x10]
call fcn.00405774
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
lea eax, [ebp - 0x14]
mov ecx, 0x57f4c0
mov edx, dword [ebx]
call fcn.004055fc
mov eax, dword [ebp - 0x14]
call fcn.0040a95c
test al, al
je 0x57ee82
lea eax, [ebp - 0x1c]
mov ecx, 0x57f4c0
mov edx, dword [ebx]
call fcn.004055fc
mov eax, dword [ebp - 0x1c]
call fcn.00405774
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.004054dc
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x10]
call fcn.00405774
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
lea eax, [ebp - 0x20]
mov ecx, 0x57f4d8
mov edx, dword [ebx]
call fcn.004055fc
mov eax, dword [ebp - 0x20]
call fcn.0040a95c
test al, al
je 0x57eed8
lea eax, [ebp - 0x28]
mov ecx, 0x57f4d8
mov edx, dword [ebx]
call fcn.004055fc
mov eax, dword [ebp - 0x28]
call fcn.00405774
mov edx, eax
lea eax, [ebp - 0x24]
call fcn.004054dc
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x10]
call fcn.00405774
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
lea eax, [ebp - 0x2c]
mov ecx, 0x57f4f0
mov edx, dword [ebx]
call fcn.004055fc
mov eax, dword [ebp - 0x2c]
call fcn.0040a95c
test al, al
je 0x57ef2e
lea eax, [ebp - 0x34]
mov ecx, 0x57f4f0
mov edx, dword [ebx]
call fcn.004055fc
mov eax, dword [ebp - 0x34]
call fcn.00405774
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.004054dc
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x10]
call fcn.00405774
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
lea eax, [ebp - 0x38]
mov ecx, 0x57f508
mov edx, dword [ebx]
call fcn.004055fc
mov eax, dword [ebp - 0x38]
call fcn.0040a95c
test al, al
je 0x57ef84
lea eax, [ebp - 0x40]
mov ecx, 0x57f508
mov edx, dword [ebx]
call fcn.004055fc
mov eax, dword [ebp - 0x40]
call fcn.00405774
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004054dc
mov ebx, dword [ebp - 0x3c]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
call fcn.00405774
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
lea eax, [ebp - 0x44]
mov ecx, 0x57f520
mov edx, dword [0x58e404]
call fcn.004055fc
mov eax, dword [ebp - 0x44]
call fcn.0040a95c
test al, al
je 0x57efe2
lea eax, [ebp - 0x4c]
mov ecx, 0x57f520
mov edx, dword [0x58e404]
call fcn.004055fc
mov eax, dword [ebp - 0x4c]
call fcn.00405774
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.004054dc
mov ebx, dword [ebp - 0x48]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
call fcn.00405774
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
lea eax, [ebp - 0x50]
mov ecx, 0x57f540
mov edx, dword [0x58e404]
call fcn.004055fc
mov eax, dword [ebp - 0x50]
call fcn.0040a95c
test al, al
je 0x57f040
lea eax, [ebp - 0x58]
mov ecx, 0x57f540
mov edx, dword [0x58e404]
call fcn.004055fc
mov eax, dword [ebp - 0x58]
call fcn.00405774
mov edx, eax
lea eax, [ebp - 0x54]
call fcn.004054dc
mov ebx, dword [ebp - 0x54]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
call fcn.00405774
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov edi, 3
push 0x57f55c
push 0
call sub.user32.dll_FindWindowA
mov ebx, eax
push 0x57f568
push 0
call sub.user32.dll_FindWindowA
mov esi, eax
test ebx, ebx
je 0x57f071
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendMessageA
test esi, esi
je 0x57f081
push 0
push 0
push 0x10
push esi
call sub.user32.dll_SendMessageA
push 0x3e8
call sub.kernel32.dll_Sleep_2
dec edi
jne 0x57f045
lea eax, [ebp - 0x5c]
mov ecx, 0x57f584
mov edx, dword [0x58e404]
call fcn.004055fc
mov eax, dword [ebp - 0x5c]
call fcn.0040a95c
test al, al
je 0x57f0ec
lea eax, [ebp - 0x64]
mov ecx, 0x57f584
mov edx, dword [0x58e404]
call fcn.004055fc
mov eax, dword [ebp - 0x64]
call fcn.00405774
mov edx, eax
lea eax, [ebp - 0x60]
call fcn.004054dc
mov ebx, dword [ebp - 0x60]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
call fcn.00405774
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
lea eax, [ebp - 0x68]
mov ecx, 0x57f5a8
mov edx, dword [0x58e404]
call fcn.004055fc
mov eax, dword [ebp - 0x68]
call fcn.0040a95c
test al, al
je 0x57f14a
lea eax, [ebp - 0x70]
mov ecx, 0x57f5a8
mov edx, dword [0x58e404]
call fcn.004055fc
mov eax, dword [ebp - 0x70]
call fcn.00405774
mov edx, eax
lea eax, [ebp - 0x6c]
call fcn.004054dc
mov ebx, dword [ebp - 0x6c]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
call fcn.00405774
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
lea eax, [ebp - 0x74]
mov ecx, 0x57f5cc
mov edx, dword [0x58e404]
call fcn.004055fc
mov eax, dword [ebp - 0x74]
call fcn.0040a95c
test al, al
je 0x57f1a8
lea eax, [ebp - 0x7c]
mov ecx, 0x57f5cc
mov edx, dword [0x58e404]
call fcn.004055fc
mov eax, dword [ebp - 0x7c]
call fcn.00405774
mov edx, eax
lea eax, [ebp - 0x78]
call fcn.004054dc
mov ebx, dword [ebp - 0x78]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
call fcn.00405774
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
push 0x3e8
call sub.kernel32.dll_Sleep_2
lea eax, [ebp - 0x80]
push eax
mov ecx, 0x57f5f0
mov edx, 0x57f614
mov eax, dword [0x58e3f0]
call fcn.004a42ac
mov ecx, dword [ebp - 0x80]
mov edx, 0x57f464
mov eax, 0x80000002
call fcn.004a4dec
lea eax, [ebp - 0x84]
mov ecx, 0x57f624
mov edx, dword [0x58e404]
call fcn.004055fc
mov eax, dword [ebp - 0x84]
call fcn.0040a95c
test al, al
je 0x57f24c
lea eax, [ebp - 0x8c]
mov ecx, 0x57f624
mov edx, dword [0x58e404]
call fcn.004055fc
mov eax, dword [ebp - 0x8c]
call fcn.00405774
mov edx, eax
lea eax, [ebp - 0x88]
call fcn.004054dc
mov ebx, dword [ebp - 0x88]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
call fcn.00405774
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov edx, 0x57f648
mov eax, 0x80000000
call fcn.004a4d7c
mov edx, 0x57f654
mov eax, 0x80000000
call fcn.004a4d7c
mov edx, 0x57f67c
mov eax, 0x80000000
call fcn.004a4d7c
lea eax, [ebp - 0x94]
push eax
mov ecx, 0x57f6a0
mov edx, 0x57f614
mov eax, dword [0x58e3f0]
call fcn.004a42ac
mov ecx, dword [ebp - 0x94]
lea eax, [ebp - 0x90]
mov edx, 0x57f6bc
call fcn.004055fc
mov edx, dword [ebp - 0x90]
mov eax, 0x80000000
call fcn.004a4d7c
lea eax, [ebp - 0x9c]
push eax
mov ecx, 0x57f6a0
mov edx, 0x57f614
mov eax, dword [0x58e3f0]
call fcn.004a42ac
mov ecx, dword [ebp - 0x9c]
lea eax, [ebp - 0x98]
mov edx, 0x57f6d0
call fcn.004055fc
mov edx, dword [ebp - 0x98]
mov eax, 0x80000000
call fcn.004a4d7c
push dword [0x58e3f8]
lea eax, [ebp - 0xa4]
push eax
mov ecx, 0x57f6e8
mov edx, 0x57f614
mov eax, dword [0x58e3f0]
call fcn.004a42ac
push dword [ebp - 0xa4]
push 0x57f6fc
lea eax, [ebp - 0xa0]
mov edx, 3
call fcn.00405678
mov eax, dword [ebp - 0xa0]
call fcn.0040a95c
test al, al
je 0x57f39f
push dword [0x58e3f8]
lea eax, [ebp - 0xac]
push eax
mov ecx, 0x57f6e8
mov edx, 0x57f614
mov eax, dword [0x58e3f0]
call fcn.004a42ac
push dword [ebp - 0xac]
push 0x57f6fc
lea eax, [ebp - 0xa8]
mov edx, 3
call fcn.00405678
mov ebx, dword [ebp - 0xa8]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
call fcn.00405774
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov edx, 0x57f70c
mov eax, 0x80000000
call fcn.004a4d7c
mov edx, 0x57f724
mov eax, 0x80000000
call fcn.004a4d7c
mov edx, 0x57f754
mov eax, 0x80000000
call fcn.004a4d7c
xor edx, edx
xor eax, eax
call fcn.004a6b2c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57f409
lea eax, [ebp - 0xac]
mov edx, 0x27
call fcn.00405308
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405308
ret