Function at 0x57f560
Capabilities:
Create process on windows
Delete directory
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xf
push 0
push 0
dec ecx
jne 0x57f568
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x57ffba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [0x4cc2f0]
call fcn.0040402c
test al, al
je 0x57f59e
mov eax, ebx
call fcn.00403e94
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x988]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x98c]
jl 0x57f5e1
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x98c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x988]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0xc]
mov edx, 0x57ffd0
call fcn.0040512c
jne 0x57f610
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0057ec18
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x648]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x618]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
jmp 0x57ff9f
lea ecx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x98c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x988]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x57ffdc
call fcn.0040502c
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.004cf0dc
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x9f0]
cmp dword [ebx + 0x414], 0
je 0x57f680
mov eax, dword [ebx + 0x43c]
mov eax, dword [eax + 0x2b0]
mov edx, dword [ebx + 0x3cc]
call fcn.0040512c
je 0x57f680
mov edx, dword [ebx + 0x3cc]
mov eax, dword [ebx + 0x43c]
call fcn.004d46c8
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x98c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x988]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov dl, 0x24
call fcn.00499244
mov eax, dword [ebp - 0x18]
or edx, 0xffffffff
call fcn.00409b78
mov esi, eax
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x98c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x988]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 8]
mov dl, 0x24
call fcn.00499344
xor ebx, ebx
lea eax, [ebp - 0x24]
push eax
mov ecx, 1
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00405240
mov eax, dword [ebp - 0x24]
mov edx, 0x57fff0
call fcn.0040512c
jne 0x57f71d
mov eax, dword [ebp - 8]
cmp byte [eax], 0x4c
sete bl
lea eax, [ebp - 8]
mov ecx, 2
mov edx, 1
call fcn.00405280
mov eax, esi
add eax, 0xfffffff0
sub ax, 2
jb 0x57f781
add eax, 0xfffffff9
sub ax, 2
jb 0x57f781
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f8]
cmp byte [eax + 0xd9], 0
je 0x57f781
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 8]
mov edx, ebx
mov eax, esi
call fcn.0057ee70
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x57fffc
call fcn.0040502c
mov edx, dword [ebp - 0x28]
mov eax, dword [0x59263c]
mov eax, dword [eax]
mov ecx, dword [eax + 0x140]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9b0]
call fcn.00512430
movzx eax, si
cmp eax, 0x65
ja case.0x57f793.0
mov al, byte [eax + 0x57f79a]
jmp dword [eax*4 + 0x57f800]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4e4]
mov eax, dword [ebp - 4]
call fcn.005734f0
jmp case.0x57f793.0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4e0]
mov eax, dword [ebp - 4]
call fcn.005734f0
jmp case.0x57f793.0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4e8]
mov eax, dword [ebp - 4]
call fcn.005734f0
jmp case.0x57f793.0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x36c]
mov eax, dword [ebp - 4]
call fcn.005734f0
mov bl, 1
jmp case.0x57f793.0
mov eax, dword [ebp - 4]
call fcn.00564d48
jmp case.0x57f793.0
mov eax, dword [ebp - 4]
call fcn.00564d84
jmp case.0x57f793.0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x37c]
mov eax, dword [ebp - 4]
call fcn.005734f0
jmp case.0x57f793.0
mov eax, dword [ebp - 4]
inc dword [eax + 0x98c]
push 0
push 8
push 0x461
mov eax, dword [0x59254c]
mov eax, dword [eax]
push eax
call sub.user32.dll_PostMessageA
jmp 0x57ff9f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f8]
call fcn.0055b354
mov bl, 1
jmp case.0x57f793.0
test bl, bl
je 0x57f976
push ebp
lea ecx, [ebp - 0x30]
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.0057ecf8
pop ecx
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 8]
call fcn.00404d9c
mov eax, dword [ebp - 8]
call fcn.00498774
test al, al
je case.0x57f793.0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x634]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x144]
jmp case.0x57f793.0
mov eax, dword [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f0]
mov edx, dword [eax + 0x414]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f8]
mov cl, 5
call fcn.00553110
jmp case.0x57f793.0
test bl, bl
je 0x57f9c6
push ebp
lea ecx, [ebp - 0x34]
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.0057ecf8
pop ecx
mov eax, dword [ebp - 0x34]
call fcn.004051e0
push eax
call sub.kernel32.dll_RemoveDirectoryA
jmp case.0x57f793.0
mov eax, dword [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f0]
mov edx, dword [eax + 0x414]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f8]
mov cl, 0xb
call fcn.00553110
jmp case.0x57f793.0
test bl, bl
je 0x57fa10
push ebp
lea ecx, [ebp - 0x38]
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.0057ecf8
pop ecx
mov eax, dword [ebp - 0x38]
call fcn.004d9574
jmp case.0x57f793.0
mov eax, dword [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f0]
mov edx, dword [eax + 0x414]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f8]
mov cl, 0xc
call fcn.00553110
jmp case.0x57f793.0
push 0
mov ecx, ebx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0057eb4c
test bl, bl
je 0x57fa8c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x634]
mov edx, dword [eax]
call dword [edx + 0xf0]
test eax, eax
jle 0x57fa77
push 0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x634]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.0056f2e4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x634]
xor edx, edx
call fcn.0045d08c
jmp case.0x57f793.0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f0]
mov edx, dword [eax]
call dword [edx + 0xf0]
test eax, eax
jle 0x57fab8
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x9f0]
mov dl, 6
mov eax, dword [ebp - 4]
call fcn.0056ef68
jmp 0x57faba
mov bl, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f0]
xor edx, edx
call fcn.0045d08c
jmp case.0x57f793.0
test bl, bl
je 0x57fb27
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x634]
mov eax, dword [eax + 0x3b0]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x634]
mov eax, dword [eax + 0x3b4]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x634]
mov eax, dword [eax + 0x3b0]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x634]
xor edx, edx
call fcn.0050f190
jmp case.0x57f793.0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f0]
mov eax, dword [eax + 0x3b0]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f0]
mov eax, dword [eax + 0x3b4]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f0]
mov eax, dword [eax + 0x3b0]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 1
push 0
push 1
push 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f0]
mov ecx, dword [eax + 0x3cc]
mov edx, dword [eax + 0x414]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f8]
call fcn.00552394
mov bl, 1
jmp case.0x57f793.0
test bl, bl
je 0x57fbf2
push ebp
lea ecx, [ebp - 0x40]
mov dl, 0x3a
mov eax, dword [ebp - 8]
call fcn.00499344
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x3c]
xor edx, edx
call fcn.0057ecf8
pop ecx
mov eax, dword [ebp - 0x3c]
call fcn.004051e0
push eax
push ebp
lea ecx, [ebp - 0x48]
mov dl, 0x3a
mov eax, dword [ebp - 8]
call fcn.00499244
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x44]
xor edx, edx
call fcn.0057ecf8
pop ecx
mov eax, dword [ebp - 0x44]
call fcn.004051e0
push eax
call sub.kernel32.dll_MoveFileA
jmp case.0x57f793.0
lea ecx, [ebp - 0x4c]
mov dl, 0x3a
mov eax, dword [ebp - 8]
call fcn.00499244
mov eax, dword [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x50]
mov dl, 0x3a
mov eax, dword [ebp - 8]
call fcn.00499344
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f0]
mov edx, dword [eax + 0x414]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f8]
mov cl, 9
call fcn.00553110
jmp case.0x57f793.0
push 0
mov eax, esi
add eax, 0xffffffed
sub ax, 2
jb 0x57fc53
cmp si, 0xe
jne 0x57fc4f
test bl, bl
jne 0x57fc53
xor ecx, ecx
jmp 0x57fc55
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0057eb4c
cmp si, 0x12
je 0x57fc70
cmp si, 0xe
jne 0x57fca8
test bl, bl
jne 0x57fca8
cmp si, 0xe
setne al
push eax
push 0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x634]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x9f0]
mov eax, dword [ebp - 4]
call fcn.005785d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f0]
xor edx, edx
call fcn.0045d08c
jmp 0x57fce4
cmp si, 0xe
setne al
push eax
push 0
cmp si, 0x14
sete al
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x9f0]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x634]
mov eax, dword [ebp - 4]
call fcn.005785d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x634]
xor edx, edx
call fcn.0045d08c
cmp si, 0xe
jne case.0x57f793.0
mov bl, 1
jmp case.0x57f793.0
push 1
mov ecx, ebx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0057eb4c
test al, al
jne 0x57fd71
jmp 0x57fd57
lea ecx, [ebp - 0x58]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x98c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x988]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x54]
mov dl, 0x24
call fcn.00499244
mov eax, dword [ebp - 0x54]
mov edx, 0x580010
call fcn.0040512c
je 0x57fd71
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x98c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x988]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x988]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x98c]
jg 0x57fd0a
mov bl, 1
jmp case.0x57f793.0
push 0
lea ecx, [ebp - 0x5c]
mov dl, 0x3a
mov eax, dword [ebp - 8]
call fcn.00499344
mov edx, dword [ebp - 0x5c]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.0057eb4c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f0]
mov edx, dword [eax]
call dword [edx + 0xf0]
test eax, eax
jle 0x57fde2
lea ecx, [ebp - 0x60]
mov dl, 0x3a
mov eax, dword [ebp - 8]
call fcn.00499244
mov eax, dword [ebp - 0x60]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x9f0]
mov dl, 8
mov eax, dword [ebp - 4]
call fcn.0056ef68
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f0]
xor edx, edx
call fcn.0045d08c
jmp case.0x57f793.0
mov bl, 1
jmp case.0x57f793.0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f8]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.0055b20c
jmp case.0x57f793.0
push 0
push 0
push 0
push 0
push 1
push 1
push 0
push 0
push 1
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00570a28
jmp case.0x57f793.0
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00409b78
imul ecx, eax, 0x3e8
mov dl, 1
mov eax, dword [0x4cc2f0]
call fcn.004cc350
mov edi, eax
mov eax, dword [ebp - 4]
push eax
push fcn.0057f560
mov eax, edi
call fcn.004cc4a4
mov dl, 1
mov eax, edi
call fcn.004cc484
jmp case.0x57f793.0
mov eax, dword [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f0]
mov edx, dword [eax + 0x414]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9f8]
mov cl, 0xa
call fcn.00553110
jmp case.0x57f793.0
push 1
mov eax, dword [ebp - 8]
call fcn.004051e0
push eax
call sub.kernel32.dll_WinExec
mov bl, 1
jmp case.0x57f793.0
cmp si, 0x1d
jne 0x57febf
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9e8]
mov ecx, eax
mov edx, dword [ebp - 8]
call fcn.00501d54
jmp 0x57fed2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9e8]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.005019f0
mov bl, 1
jmp case.0x57f793.0
mov bl, 1
jmp case.0x57f793.0
lea ecx, [ebp - 0x64]
mov dl, 0x24
mov eax, dword [ebp - 8]
call fcn.00499344
mov eax, dword [ebp - 0x64]
call fcn.00409b3c
mov ebx, eax
lea ecx, [ebp - 0x6c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x988]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x6c]
lea ecx, [ebp - 0x68]
mov dl, 0x24
call fcn.00499344
mov eax, dword [ebp - 0x68]
call fcn.00409b3c
dec eax
jle 0x57ff7f
lea ecx, [ebp - 0x7c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x988]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x7c]
lea ecx, [ebp - 0x78]
mov dl, 0x24
call fcn.00499344
mov eax, dword [ebp - 0x78]
call fcn.00409b3c
dec eax
lea edx, [ebp - 0x74]
call fcn.00409a00
mov ecx, dword [ebp - 0x74]
lea eax, [ebp - 0x70]
mov edx, 0x58001c
call fcn.0040502c
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x988]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0x20]
mov eax, dword [ebp - 4]
mov dword [eax + 0x98c], ebx
mov bl, 1
mov eax, dword [ebp - 4]
inc dword [eax + 0x98c]
cmp si, 5
jbe 0x57ff94
test bl, bl
je 0x57ff9f
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
call fcn.0057f560
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57ffc1
lea eax, [ebp - 0x7c]
mov edx, 0x1e
call fcn.00404d28
ret