Function at 0x56da60
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x56da68
push ecx
push ebx
push esi
push edi
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x56ddc3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x56dda0
mov eax, dword [ebp - 8]
mov byte [eax + 0x5c], 1
call fcn.0040cf80
mov eax, dword [ebp - 8]
fstp qword [eax + 0x20]
wait
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0056d8ac
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x58]
call fcn.00405528
mov eax, dword [ebp - 8]
cmp dword [eax + 0x3c], 0
jne 0x56db3c
xor eax, eax
push ebp
push 0x56db2d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
add eax, 4
call fcn.00411b68
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x58]
call fcn.0040ac10
test al, al
jne 0x56dafd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56dda0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x58]
call fcn.00405954
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.00405688
mov eax, dword [ebp - 0x10]
call fcn.00405954
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56dda0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
call fcn.00404574
push 0
movzx eax, byte [ebp - 9]
xor al, 1
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x38]
lea edx, [ebp - 4]
mov eax, dword [0x5559bc]
call fcn.00555b48
xor eax, eax
push ebp
push 0x56db95
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x58]
mov dl, 1
mov eax, dword [0x41bd8c]
call fcn.00421c20
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56dc0b
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x56dc6b
xor eax, eax
push ebp
push 0x56dc34
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0056de38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56dc3e
xor eax, eax
push ebp
push 0x56dc61
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
call fcn.00404574
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56dc6b
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x58]
call fcn.0040ac10
test al, al
je 0x56dda0
cmp dword [ebp - 4], 0
je 0x56dc95
mov eax, dword [ebp - 8]
cmp dword [eax + 0x3c], 0
jne 0x56dcd0
xor eax, eax
push ebp
push 0x56dcc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x58]
call fcn.00405954
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56dda0
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00409d38
mov eax, dword [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x58]
call fcn.00409d38
mov edx, dword [ebp - 0x20]
pop eax
call fcn.004058a0
je 0x56dda0
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.00405954
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x58]
call fcn.00405954
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x56dd41
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x58]
call fcn.00405954
mov edx, eax
lea eax, [ebp - 0x24]
call fcn.00405688
mov eax, dword [ebp - 0x24]
call fcn.00405954
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x56dda0
push 0
push 0
push dword [ebp - 4]
push 0x56dddc
push 0x56dde8
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00405814
mov eax, dword [ebp - 0x28]
movzx ecx, word [0x56ddfc]
xor edx, edx
call fcn.0057fa74
push 0x56de08
push dword [ebp - 4]
push 0x56de34
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00405814
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x5bff58]
mov eax, dword [eax]
mov cl, 1
call fcn.004a1964
jmp 0x56db3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56ddca
lea eax, [ebp - 0x2c]
mov edx, 8
call fcn.004054b4
lea eax, [ebp - 4]
call fcn.00405490
ret