Function at 0x560fa0
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x55
push 0
push 0
dec ecx
jne 0x560fa9
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405854
xor eax, eax
push ebp
push 0x5615db
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov edx, 0x5615ec
lea eax, [ebp - 0x54]
call fcn.00403a54
mov edx, esi
lea eax, [ebp - 0x54]
mov cl, 0x45
call fcn.00403a24
lea edx, [ebp - 0x54]
lea eax, [ebp - 0xc]
call fcn.00405638
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00561898
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00560410
mov eax, dword [ebp - 4]
push eax
push 0x56185c
lea ecx, [ebp - 0x68]
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0055f194
lea eax, [ebp - 0x68]
lea edx, [ebp - 0x58]
call fcn.0055f0ec
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x6c]
lea edx, [esi + 0x23a]
call fcn.00405638
mov edx, dword [ebp - 0x6c]
pop eax
call fcn.0040a0f4
test eax, eax
je 0x5610b4
mov edx, 0x5615f8
lea eax, [ebp - 0xb4]
call fcn.00403a54
mov edx, esi
lea eax, [ebp - 0xb4]
mov cl, 0x41
call fcn.00403a24
lea edx, [ebp - 0xb4]
lea eax, [ebp - 0x100]
call fcn.00403a54
mov edx, 0x561600
lea eax, [ebp - 0x100]
mov cl, 0x49
call fcn.00403a24
lea edx, [ebp - 0x100]
lea eax, [ebp - 0x70]
call fcn.00405638
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 4]
call fcn.00561898
xor ebx, ebx
jmp 0x561575
movzx eax, byte [esi + 0x25b]
dec al
je 0x5610cc
sub al, 2
je 0x561213
jmp 0x56154f
cmp byte [esi + 0x130], 0
je 0x561164
push ebp
lea eax, [ebp - 0x104]
lea edx, [esi + 0x3d]
call fcn.00405638
mov eax, dword [ebp - 0x104]
call fcn.00560dd0
pop ecx
mov ebx, eax
test bl, bl
jne 0x56154f
mov edx, 0x56160c
lea eax, [ebp - 0x14c]
call fcn.00403a54
mov edx, esi
lea eax, [ebp - 0x14c]
mov cl, 0x43
call fcn.00403a24
lea edx, [ebp - 0x14c]
lea eax, [ebp - 0x198]
call fcn.00403a54
mov edx, 0x561614
lea eax, [ebp - 0x198]
mov cl, 0x4a
call fcn.00403a24
lea edx, [ebp - 0x198]
lea eax, [ebp - 0x108]
call fcn.00405638
mov edx, dword [ebp - 0x108]
mov eax, dword [ebp - 4]
call fcn.00561898
jmp 0x56154f
push ebp
lea edx, [esi + 0x3d]
lea eax, [ebp - 0x22c]
call fcn.00403a54
lea edx, [esi + 0xa2]
lea eax, [ebp - 0x22c]
mov cl, 0x8c
call fcn.00403a24
lea edx, [ebp - 0x22c]
lea eax, [ebp - 0x19c]
call fcn.00405638
mov eax, dword [ebp - 0x19c]
call fcn.00560f14
pop ecx
test al, al
jne 0x56154f
xor ebx, ebx
mov edx, 0x56161c
lea eax, [ebp - 0xb4]
call fcn.00403a54
mov edx, esi
lea eax, [ebp - 0xb4]
mov cl, 0x41
call fcn.00403a24
lea edx, [ebp - 0xb4]
lea eax, [ebp - 0x27c]
call fcn.00403a54
mov edx, 0x561624
lea eax, [ebp - 0x27c]
mov cl, 0x48
call fcn.00403a24
lea edx, [ebp - 0x27c]
lea eax, [ebp - 0x230]
call fcn.00405638
mov edx, dword [ebp - 0x230]
mov eax, dword [ebp - 4]
call fcn.00561898
jmp 0x56154f
lea eax, [ebp - 0x280]
lea edx, [esi + 0xa2]
call fcn.00405638
mov eax, dword [ebp - 0x280]
mov edx, 0x561634
call fcn.0040a0f4
test eax, eax
jne 0x56128c
mov eax, dword [ebp - 8]
test eax, eax
je 0x561244
sub eax, 4
mov eax, dword [eax]
inc eax
call fcn.00402fb4
mov esi, eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x561258
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
call fcn.004058c4
lea ecx, [ebx + 1]
mov edx, esi
call fcn.004032f0
push esi
push 0
push 0x7eb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
push eax
call sub.user32.dll_SendMessageA
mov eax, esi
call fcn.00402fd0
xor ebx, ebx
jmp 0x56154f
lea eax, [ebp - 0x288]
lea edx, [esi + 0xa2]
call fcn.00405638
mov eax, dword [ebp - 0x288]
lea ecx, [ebp - 0x284]
mov edx, 5
call fcn.00440a58
mov eax, dword [ebp - 0x284]
mov edx, 0x561644
call fcn.004057fc
jne 0x561357
lea eax, [ebp - 0x290]
lea edx, [esi + 0xa2]
call fcn.00405638
mov eax, dword [ebp - 0x290]
lea ecx, [ebp - 0x28c]
movzx edx, byte [esi + 0xa2]
sub edx, 5
call fcn.00440a74
mov edx, dword [ebp - 0x28c]
mov eax, dword [0x59a4d8]
call fcn.00405428
mov eax, dword [ebp - 8]
test eax, eax
je 0x561311
sub eax, 4
mov eax, dword [eax]
inc eax
call fcn.00402fb4
mov esi, eax
mov edi, dword [ebp - 8]
test edi, edi
je 0x561325
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 8]
call fcn.004058c4
lea ecx, [edi + 1]
mov edx, esi
call fcn.004032f0
push esi
push 0
push 0x7ee
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
push eax
call sub.user32.dll_SendMessageA
mov eax, esi
call fcn.00402fd0
jmp 0x56154f
cmp byte [esi + 0x130], 0
je 0x5614a9
push ebp
lea eax, [ebp - 0x294]
lea edx, [esi + 0x3d]
call fcn.00405638
mov eax, dword [ebp - 0x294]
call fcn.00560dd0
pop ecx
mov ebx, eax
lea eax, [ebp - 0x298]
lea edx, [esi + 0xa2]
call fcn.00405638
mov edx, dword [ebp - 0x298]
mov eax, 0x561654
call fcn.004059b0
test eax, eax
jg 0x5613cb
lea eax, [ebp - 0x29c]
lea edx, [esi + 0xa2]
call fcn.00405638
mov edx, dword [ebp - 0x29c]
mov eax, 0x561664
call fcn.004059b0
test eax, eax
jle 0x56143b
lea edx, [esi + 0x3d]
lea eax, [ebp - 0x22c]
call fcn.00403a54
lea edx, [esi + 0xa2]
lea eax, [ebp - 0x22c]
mov cl, 0x8c
call fcn.00403a24
lea edx, [ebp - 0x22c]
mov eax, dword [0x59a4d8]
call fcn.00405638
lea eax, [ebp - 0x2a0]
lea edx, [esi + 0xa2]
call fcn.00405638
mov eax, dword [ebp - 0x2a0]
call fcn.0055f394
test al, al
jne 0x56143b
push 6
push 0
push 0
mov eax, dword [0x59a4d8]
mov eax, dword [eax]
call fcn.00405864
push eax
push 0x56166c
push 0
call sub.shell32.dll_ShellExecuteA
test bl, bl
jne 0x56154f
mov edx, 0x56160c
lea eax, [ebp - 0x14c]
call fcn.00403a54
mov edx, esi
lea eax, [ebp - 0x14c]
mov cl, 0x43
call fcn.00403a24
lea edx, [ebp - 0x14c]
lea eax, [ebp - 0x198]
call fcn.00403a54
mov edx, 0x561614
lea eax, [ebp - 0x198]
mov cl, 0x4a
call fcn.00403a24
lea edx, [ebp - 0x198]
lea eax, [ebp - 0x2a4]
call fcn.00405638
mov edx, dword [ebp - 0x2a4]
mov eax, dword [ebp - 4]
call fcn.00561898
jmp 0x56154f
push ebp
lea edx, [esi + 0x3d]
lea eax, [ebp - 0x22c]
call fcn.00403a54
lea edx, [esi + 0xa2]
lea eax, [ebp - 0x22c]
mov cl, 0x8c
call fcn.00403a24
lea edx, [ebp - 0x22c]
lea eax, [ebp - 0x2a8]
call fcn.00405638
mov eax, dword [ebp - 0x2a8]
call fcn.00560f14
pop ecx
test al, al
jne 0x56154f
xor ebx, ebx
mov edx, 0x56161c
lea eax, [ebp - 0xb4]
call fcn.00403a54
mov edx, esi
lea eax, [ebp - 0xb4]
mov cl, 0x41
call fcn.00403a24
lea edx, [ebp - 0xb4]
lea eax, [ebp - 0x27c]
call fcn.00403a54
mov edx, 0x561624
lea eax, [ebp - 0x27c]
mov cl, 0x48
call fcn.00403a24
lea edx, [ebp - 0x27c]
lea eax, [ebp - 0x2ac]
call fcn.00405638
mov edx, dword [ebp - 0x2ac]
mov eax, dword [ebp - 4]
call fcn.00561898
mov eax, dword [ebp - 8]
call fcn.00405864
mov edx, eax
lea eax, [ebp - 0x2b0]
call fcn.004055cc
mov eax, dword [ebp - 0x2b0]
call fcn.00405864
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5615e2
lea eax, [ebp - 0x2b0]
mov edx, 0xd
call fcn.004053f8
lea eax, [ebp - 0x230]
call fcn.004053d4
lea eax, [ebp - 0x19c]
call fcn.004053d4
lea eax, [ebp - 0x108]
mov edx, 2
call fcn.004053f8
lea eax, [ebp - 0x70]
mov edx, 2
call fcn.004053f8
lea eax, [ebp - 0x58]
call fcn.004053d4
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004053f8
ret