Function at 0x518a10
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x559329
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x5c2b80]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
call fcn.00456bd0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x518a5d
push 0x80004005
call fcn.00456ea0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x224], eax
mov dword [ebp - 4], 1
mov ecx, 0x5a8240
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x268]
call fcn.00457210
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x224]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0045c160
mov byte [ebp - 4], 1
or edi, 0xffffffff
mov edx, dword [ebp - 0x268]
mov eax, edi
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x518ac5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x5a8260
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x220]
call fcn.00457210
mov esi, eax
mov byte [ebp - 4], 4
mov ecx, 0x5a8280
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x26c]
call fcn.00457210
mov byte [ebp - 4], 5
mov edx, eax
push ebx
lea ecx, [ebp - 0x270]
call fcn.0045bbe0
mov byte [ebp - 4], 6
mov edx, eax
push esi
lea ecx, [ebp - 0x268]
call fcn.0045bbe0
add esp, 8
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x224]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0045c160
mov byte [ebp - 4], 6
mov ecx, edi
mov edx, dword [ebp - 0x268]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x518b56
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
mov ecx, edi
mov edx, dword [ebp - 0x270]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x518b79
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
mov ecx, edi
mov edx, dword [ebp - 0x26c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x518b9c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov ecx, edi
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x518bbf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x5a82b0
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x220]
call fcn.00457210
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x224]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0045c160
mov byte [ebp - 4], 1
mov ecx, edi
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x518c0d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x5a82e0
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x220]
call fcn.00457210
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x224]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0045c160
mov byte [ebp - 4], 1
mov ecx, edi
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x518c5b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x5a8300
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x220]
call fcn.00457210
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x224]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0045c160
mov byte [ebp - 4], 1
mov ecx, edi
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x518ca9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x5929a0
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x268]
call fcn.00457210
mov esi, eax
mov byte [ebp - 4], 0x12
mov ecx, 0x5a8340
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x270]
call fcn.00457210
mov byte [ebp - 4], 0x13
mov edx, eax
push ebx
lea ecx, [ebp - 0x26c]
call fcn.0045bbe0
mov byte [ebp - 4], 0x14
mov edx, eax
push esi
lea ecx, [ebp - 0x220]
call fcn.0045bbe0
add esp, 8
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x224]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0045c160
mov byte [ebp - 4], 0x14
mov ecx, edi
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x518d3a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x13
mov ecx, edi
mov edx, dword [ebp - 0x26c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x518d5d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x12
mov ecx, edi
mov edx, dword [ebp - 0x270]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x518d80
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov ecx, edi
mov edx, dword [ebp - 0x268]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x518da3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x5a8260
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x268]
call fcn.00457210
mov esi, eax
mov byte [ebp - 4], 0x1a
mov ecx, 0x5a8280
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x270]
call fcn.00457210
mov byte [ebp - 4], 0x1b
mov edx, eax
push ebx
lea ecx, [ebp - 0x26c]
call fcn.0045bbe0
mov byte [ebp - 4], 0x1c
mov edx, eax
push esi
lea ecx, [ebp - 0x220]
call fcn.0045bbe0
add esp, 8
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x224]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0045c160
mov byte [ebp - 4], 0x1c
mov ecx, edi
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x518e34
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x1b
mov ecx, edi
mov edx, dword [ebp - 0x26c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x518e57
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x1a
mov ecx, edi
mov edx, dword [ebp - 0x270]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x518e7a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov ecx, edi
mov edx, dword [ebp - 0x268]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x518e9d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x5a8370
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x220]
call fcn.00457210
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x224]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0045c160
mov byte [ebp - 4], 1
mov ecx, edi
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x518eeb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x5a83c0
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x220]
call fcn.00457210
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x224]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0045c160
mov byte [ebp - 4], 1
mov ecx, edi
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x518f39
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x5a83f0
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x220]
call fcn.00457210
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x224]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0045c160
mov byte [ebp - 4], 1
mov ecx, edi
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x518f87
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x5a8420
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x220]
call fcn.00457210
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x224]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0045c160
mov byte [ebp - 4], 1
mov ecx, edi
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x518fd5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x5a8440
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x220]
call fcn.00457210
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x224]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0045c160
mov byte [ebp - 4], 1
mov ecx, edi
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x519023
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.0052ebd0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x519091
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x519073
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052ab62
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x228], 0
push eax
lea ecx, [ebp - 0x228]
call fcn.00457210
mov byte [ebp - 4], 0x2d
mov eax, dword [ebp - 0x228]
mov edx, dword [eax - 0xc]
lea ecx, [edx - 1]
test ecx, ecx
js 0x519346
cmp ecx, edx
jg 0x519346
cmp word [eax + ecx*2], 0x5c
je 0x5190e6
push 1
push 0x5923e4
lea ecx, [ebp - 0x228]
call fcn.0045c160
mov ecx, 0x5a8460
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x270]
call fcn.00457210
mov esi, eax
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x26c]
call fcn.00457760
mov byte [ebp - 4], 0x2f
mov edx, eax
push esi
lea ecx, [ebp - 0x220]
call fcn.0045bbe0
add esp, 4
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x228]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0045c160
mov byte [ebp - 4], 0x2f
mov ecx, edi
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x51915a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x2e
mov ecx, edi
mov edx, dword [ebp - 0x26c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x51917d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x2d
mov ecx, edi
mov edx, dword [ebp - 0x270]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x5191a0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea edx, [ebp - 0x224]
lea ecx, [ebp - 0x288]
call fcn.00457010
mov byte [ebp - 4], 0x34
cmp dword [eax + 0x14], 0x10
jb 0x5191bd
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x268]
call fcn.0051ae40
mov byte [ebp - 4], 0x35
xor bl, bl
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x519240
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0x268]
lea ecx, [ebp - 0x220]
push 0
push ecx
mov dword [ebp - 0x220], 0
push dword [eax - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x519239
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
sete bl
mov byte [ebp - 4], 0x34
mov ecx, edi
mov edx, dword [ebp - 0x268]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x519268
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x2d
cmp dword [ebp - 0x274], 0x10
jb 0x519283
push dword [ebp - 0x288]
call fcn.0047c370
add esp, 4
mov dword [ebp - 0x274], 0xf
mov dword [ebp - 0x278], 0
mov byte [ebp - 0x288], 0
test bl, bl
je 0x5192ca
mov byte [ebp - 4], 1
mov ecx, edi
mov edx, dword [ebp - 0x228]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x5192c5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x51904f
push 0x3c
lea eax, [ebp - 0x264]
push 0
push eax
call fcn.0052ebd0
mov eax, dword [ebp - 0x228]
add esp, 0xc
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x264]
mov dword [ebp - 0x264], 0x3c
mov dword [ebp - 0x258], str.open
push eax
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x260], 0x440
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov byte [ebp - 4], 1
mov ecx, edi
mov edx, dword [ebp - 0x228]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x519341
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x51904f
push 0x80070057
call fcn.00456ea0
int3