Function at 0x5765f320
Capabilities:
Create process on windows
Get hostname
Read .ini file
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0xa48
push ebx
push ebp
mov ebp, ecx
push str.SaveLogStart____
call fcn.57653a20
mov ebx, dword [esp + 0xa58]
add esp, 4
mov eax, dword [ebx + 0x42c]
mov dword [ebx + 0x428], 1
test eax, eax
jne 0x5765fbb3
mov dl, byte [0x576876ec]
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x135]
mov byte [esp + 0x134], dl
mov byte [esp + 0x30], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x31]
mov byte [esp + 0x544], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x545]
mov byte [esp + 0x440], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x441]
mov byte [esp + 0x238], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x239]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, ebp
stosb byte es:[edi], al
call fcn.57660350
mov ecx, dword [ebx + 0x41c]
lea edx, [esp + 0x238]
push ecx
push eax
push str.log_d__d.log
push edx
mov dword [esp + 0x20], eax
call sub.MSVCRT.dll_sprintf
add esp, 0x10
lea eax, [esp + 0x238]
lea ecx, [esp + 0x134]
push eax
push 0x576897b0
push 0x57684550
push ecx
call sub.MSVCRT.dll_sprintf
lea edx, [esp + 0x144]
push edx
call fcn.57661130
add esp, 0x14
test eax, eax
jne 0x5765f49e
push eax
push 0x80
push 1
push eax
push eax
lea eax, [esp + 0x148]
push 0x40000000
push eax
mov dword [esp + 0x44], 0xfeff
call fcn.57661420
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0x1c
lea ecx, [esp + 0x14]
lea edx, [esp + 0x28]
push 0
push ecx
mov esi, eax
push 2
push edx
push esi
call edi
lea eax, [esp + 0x14]
push 0
push eax
push str._LOG_
call sub.MSVCRT.dll_wcslen
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
push str._LOG_
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dx, word [0x576876e8]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x64a]
mov word [esp + 0x648], dx
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x64c]
lea ecx, [esp + 0x138]
push eax
push ecx
call fcn.57661060
add esp, 0xc
lea edx, [esp + 0x544]
push 0x576894a4
push 0x104
push edx
push 0
push str.SERIAL
push str.Setup
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [esp + 0x134]
lea ecx, [esp + 0x544]
push eax
push ecx
push 0x57686fc8
push 0x57684f78
call esi
lea edi, [ebx + 0x210]
push edi
call sub.MSVCRT.dll_wcslen
add esp, 4
test eax, eax
jne 0x5765f543
push str.UNKNOWN_FILENAME
push edi
call sub.MSVCRT.dll_swprintf
add esp, 8
lea edx, [esp + 0x648]
push edx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.FILENAME
push 0x57686f88
call edi
lea eax, [esp + 0x134]
lea ecx, [ebp + 0xc]
push eax
push ecx
push str.APPNAME
push 0x57684f78
call esi
lea edx, [esp + 0x134]
lea eax, [ebx + 0x10c]
push edx
push eax
push str.DRVNAME
push 0x57684f78
call esi
lea ecx, [esp + 0x134]
lea edx, [ebx + 8]
push ecx
push edx
push str.PRINTERNAME
push 0x57684f78
call esi
lea eax, [esp + 0x648]
push eax
push 0x576879dc
push str.SABEON
push 0x57686f88
call edi
lea ecx, [esp + 0x648]
lea edx, [ebp + 0x110]
push ecx
push edx
push str.DEPT
push 0x57686f88
call edi
lea eax, [ebp + 0x318]
test eax, eax
je 0x5765f5fc
lea ecx, [esp + 0x648]
push ecx
push eax
push str.DEPTENG
push 0x57686f88
call edi
lea edx, [esp + 0x648]
lea eax, [ebp + 0x520]
push edx
push eax
push str.NAME
push 0x57686f88
call edi
lea eax, [ebp + 0x728]
test eax, eax
je 0x5765f636
lea ecx, [esp + 0x648]
push ecx
push eax
push str.NAME_E
push 0x57686f88
call edi
lea edx, [esp + 0x648]
lea eax, [ebp + 0x930]
push edx
push eax
push str.SINGLEID
push 0x57686f88
call edi
mov cl, byte [0x576876ec]
xor edx, edx
mov dword [esp + 0x19], edx
mov byte [esp + 0x18], cl
mov dword [esp + 0x1d], edx
lea eax, [esp + 0x2c]
mov dword [esp + 0x21], edx
lea ecx, [esp + 0x18]
mov word [esp + 0x25], dx
push eax
push ecx
mov byte [esp + 0x2f], dl
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea edx, [esp + 0x134]
lea eax, [esp + 0x18]
push edx
push eax
push str.COMNAME
push 0x57684f78
call esi
mov cl, byte [0x576876ec]
xor eax, eax
mov byte [esp + 0x850], cl
mov ecx, 0x40
lea edi, [esp + 0x851]
lea edx, [esp + 0x850]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
mov ecx, ebp
stosb byte es:[edi], al
call fcn.576603b0
lea eax, [esp + 0x134]
lea ecx, [esp + 0x850]
push eax
push ecx
push 0x57686f04
push 0x57684f78
call esi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x30]
lea edx, [esp + 0x30]
push 0x57685074
push edx
rep stosd dword es:[edi], eax
call sub.MSVCRT.dll_sprintf
add esp, 8
lea eax, [esp + 0x134]
lea ecx, [esp + 0x30]
push eax
push ecx
push str.FILESIZE
push 0x57684f78
call esi
mov edx, dword [ebx + 0x420]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x34]
push 0x57686ef4
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea ecx, [esp + 0x134]
lea edx, [esp + 0x30]
push ecx
push edx
push str.PAGECOUNT
push 0x57684f78
call esi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 0x424]
lea ecx, [esp + 0x30]
push eax
push 0x57686ef4
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea edx, [esp + 0x134]
lea eax, [esp + 0x30]
push edx
push eax
push str.COPY
push 0x57684f78
call esi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x30]
lea edx, [esp + 0x30]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
push ecx
push 0x57686ef4
push edx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea eax, [esp + 0x134]
lea ecx, [esp + 0x30]
push eax
push ecx
push str.TIME
push 0x57684f78
call esi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
mov eax, dword [0x57683808]
test eax, eax
je 0x5765f807
mov eax, dword [ebx + 0x434]
test eax, eax
jne 0x5765f807
push 0x4e
lea edx, [esp + 0x34]
push 0x57686ef4
push edx
jmp 0x5765f813
push 0x59
lea eax, [esp + 0x34]
push 0x57686ef4
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea ecx, [esp + 0x134]
lea edx, [esp + 0x30]
push ecx
push edx
push str.FORCE
push 0x57684f78
call esi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x30]
push 0x57686edc
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push eax
call sub.MSVCRT.dll_sprintf
add esp, 8
lea ecx, [esp + 0x134]
lea edx, [esp + 0x30]
push ecx
push edx
push 0x57686ed8
push 0x57684f78
call esi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x30]
lea edx, [esp + 0x30]
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 0x418]
mov ecx, dword [0x576887c4]
push eax
push ecx
push str._05d_d
push edx
call sub.MSVCRT.dll_sprintf
add esp, 0x10
lea eax, [esp + 0x134]
lea ecx, [esp + 0x30]
push eax
push ecx
push str.BNUM
push 0x57684f78
call esi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
mov al, byte [0x57687ec2]
cmp al, 0x44
jne 0x5765f8d6
push 2
lea edx, [esp + 0x34]
push 0x57686ef4
push edx
jmp 0x5765f8f4
cmp al, 0x4c
jne 0x5765f8e8
push 4
lea eax, [esp + 0x34]
push 0x57686ef4
push eax
jmp 0x5765f8f4
push 1
lea ecx, [esp + 0x34]
push 0x57686ef4
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea edx, [esp + 0x134]
lea eax, [esp + 0x30]
push edx
push eax
push str.SAVE
push 0x57684f78
call esi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x30]
lea edx, [esp + 0x30]
rep stosd dword es:[edi], eax
movsx ecx, word [0x5768813c]
push ecx
push 0x57686ef4
push edx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea eax, [esp + 0x134]
lea ecx, [esp + 0x30]
push eax
push ecx
push str.SAVETYPE
push 0x57684f78
call esi
mov edx, dword [0x5768813c]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x30]
and edx, 2
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x34]
push 0x57686ef4
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea ecx, [esp + 0x134]
lea edx, [esp + 0x30]
push ecx
push edx
push str.IMAGE
push 0x57684f78
call esi
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x544]
push eax
push ecx
push ebx
mov ecx, ebp
call fcn.57660710
mov eax, dword [0x5768946c]
test eax, eax
je 0x5765fa84
lea edx, [esp + 0x134]
push edx
push 0x57686edc
push str.ONOFF
push 0x57684f78
call esi
cmp dword [0x5768a0d4], 5
jb 0x5765f9f7
lea eax, [esp + 0x238]
mov ecx, ebp
push eax
call fcn.5765fbc0
test eax, eax
je 0x5765fa84
jmp 0x5765fba7
lea ecx, [esp + 0x238]
lea edx, [esp + 0x440]
push ecx
push 0x576898b4
push str._sSecuLog.exe___s_
push edx
call sub.MSVCRT.dll_sprintf
mov al, byte [0x576876ec]
mov ecx, 0x40
mov byte [esp + 0x34c], al
xor eax, eax
lea edi, [esp + 0x34d]
add esp, 0x10
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x238]
lea edx, [esp + 0x33c]
stosw word es:[edi], ax
push ecx
push str.__s_
push edx
stosb byte es:[edi], al
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea eax, [esp + 0x440]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jbe 0x5765fa84
lea ecx, [esp + 0x440]
push ecx
push str.strExeName_:__s
call fcn.57653a20
add esp, 8
jmp 0x5765fba7
lea edx, [esp + 0x134]
push edx
push 0x57685074
push str.ONOFF
push 0x57684f78
call esi
lea eax, [esp + 0x238]
lea ecx, [esp + 0x134]
push eax
push 0x5768352c
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x238]
push 0x576897b0
lea edx, [esp + 0x23c]
push str._soffline.log
push edx
rep stosd dword es:[edi], eax
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea eax, [esp + 0x238]
push eax
push 0
push str.COUNT
push str.FILE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov cl, byte [0x576876ec]
mov ebp, eax
mov byte [esp + 0x954], cl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x955]
rep stosd dword es:[edi], eax
inc ebp
lea edx, [esp + 0x954]
stosw word es:[edi], ax
push ebp
push str.NUM_d
push edx
stosb byte es:[edi], al
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea eax, [esp + 0x238]
lea ecx, [esp + 0x134]
lea edx, [esp + 0x954]
push eax
push ecx
push edx
push str.LIST
call esi
mov al, byte [0x576876ec]
mov ecx, 0x40
mov byte [esp + 0x33c], al
xor eax, eax
lea edi, [esp + 0x33d]
push ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x340]
push 0x57686ef4
push ecx
stosb byte es:[edi], al
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea edx, [esp + 0x238]
lea eax, [esp + 0x33c]
push edx
push eax
push str.COUNT
push str.FILE
call esi
pop edi
mov dword [ebx + 0x420], 0
pop esi
pop ebp
pop ebx
add esp, 0xa48
ret 4