Function at 0x573c1c
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x13
push 0
push 0
dec ecx
jne 0x573c24
push ebx
push esi
xor eax, eax
push ebp
push 0x57444f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x6d2064
mov edx, 0x574464
call fcn.00405908
mov eax, 0x6d2060
mov edx, 0x574464
call fcn.00405908
mov eax, 0x6d205c
mov edx, 0x574464
call fcn.00405908
mov eax, 0x6d2058
mov edx, 0x574464
call fcn.00405908
mov eax, 0x6d2054
mov edx, 0x574464
call fcn.00405908
mov eax, 0x6d2050
mov edx, 0x574464
call fcn.00405908
cmp byte [0x6d1ec4], 0
je 0x573cac
mov eax, dword [0x5a2e90]
cmp byte [eax], 0
jne 0x574414
lea eax, [ebp - 4]
call fcn.005149b4
lea edx, [ebp - 0x64]
mov eax, dword [0x5a2e20]
mov eax, dword [eax]
call fcn.00478dfc
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.0040b320
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.0040a034
mov eax, dword [ebp - 0x5c]
mov edx, 0x574470
call fcn.00405cd4
jne 0x574414
lea eax, [ebp - 0x20]
call fcn.00515cd8
test al, al
je 0x574414
push 0
push 0
push 1
push 1
lea eax, [ebp - 0x68]
mov ecx, 0x574488
mov edx, dword [ebp - 4]
call fcn.00405bd4
mov ecx, dword [ebp - 0x68]
mov eax, dword [0x5a3218]
mov eax, dword [eax]
mov edx, 0x57449c
call fcn.00538d10
test al, al
je 0x57440f
mov eax, dword [0x5a2f20]
mov eax, dword [eax]
cmp byte [eax + 0x57], 0
je 0x573d54
mov eax, dword [0x5a2f20]
mov eax, dword [eax]
mov eax, dword [eax + 0x368]
mov edx, 0x5744c8
call fcn.0045a1f0
lea eax, [ebp - 0x6c]
mov ecx, 0x574488
mov edx, dword [ebp - 4]
call fcn.00405bd4
mov ecx, dword [ebp - 0x6c]
mov dl, 1
mov eax, dword [0x426cc0]
call fcn.00426d78
mov ebx, eax
push 0x5744f8
lea eax, [ebp - 8]
push eax
mov ecx, 0x574508
mov edx, 0x57451c
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
push 0x574464
lea eax, [ebp - 0x70]
push eax
mov ecx, 0x57452c
mov edx, 0x57451c
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
mov edx, dword [ebp - 0x70]
mov eax, 0x6d2060
call fcn.00405908
push 0x574464
lea eax, [ebp - 0x74]
push eax
mov ecx, 0x574544
mov edx, 0x57451c
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
mov edx, dword [ebp - 0x74]
mov eax, 0x6d2058
call fcn.00405908
push 0x574464
lea eax, [ebp - 0x78]
push eax
mov ecx, 0x57455c
mov edx, 0x57451c
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
mov edx, dword [ebp - 0x78]
mov eax, 0x6d2050
call fcn.00405908
push 0x574574
lea eax, [ebp - 0x7c]
push eax
mov ecx, 0x574508
mov edx, 0x574584
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
mov ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x10]
mov edx, 0x574594
call fcn.00405bd4
push 0x574574
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x5745a0
mov edx, 0x574584
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
cmp dword [ebp - 0x14], 0
je 0x573e65
push dword [ebp - 0x10]
push 0x5745b4
push 0x574594
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405c48
push 0x574574
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x5745c0
mov edx, 0x574584
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
cmp dword [ebp - 0x14], 0
je 0x573ea1
push dword [ebp - 0x10]
push 0x5745b4
push 0x574594
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405c48
push 0x574574
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x5745d4
mov edx, 0x574584
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
cmp dword [ebp - 0x14], 0
je 0x573edd
push dword [ebp - 0x10]
push 0x5745b4
push 0x574594
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405c48
cmp byte [0x6d1ea1], 0
je 0x573f0a
cmp dword [0x6d1f68], 1
jle 0x573f0a
push 0x5744f8
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x5745e8
mov edx, 0x5745fc
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
jmp 0x573f23
push 0x5744f8
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x574508
mov edx, 0x5745fc
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
lea eax, [ebp - 0x1c]
call fcn.00515418
lea eax, [ebp - 0x18]
call fcn.004058b4
push 0x574574
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x574614
mov edx, dword [ebp - 0x1c]
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
mov eax, dword [ebp - 0x24]
mov edx, 0x574574
call fcn.00405cd4
je 0x573f64
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x24]
call fcn.0040594c
push 0x574574
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x574620
mov edx, dword [ebp - 0x1c]
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
mov eax, dword [ebp - 0x24]
mov edx, 0x574574
call fcn.00405cd4
je 0x573fa2
push dword [ebp - 0x18]
push 0x5745b4
push dword [ebp - 0x24]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405c48
push 0x574574
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x57462c
mov edx, dword [ebp - 0x1c]
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
mov eax, dword [ebp - 0x24]
mov edx, 0x574574
call fcn.00405cd4
je 0x573fe0
push dword [ebp - 0x18]
push 0x5745b4
push dword [ebp - 0x24]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405c48
mov eax, ebx
call fcn.004049b4
lea eax, [ebp - 0x80]
mov ecx, 0x574488
mov edx, dword [ebp - 4]
call fcn.00405bd4
mov eax, dword [ebp - 0x80]
call fcn.00405d88
push eax
call sub.kernel32.dll_DeleteFileA
cmp dword [ebp - 0x18], 0
je 0x574085
push dword [ebp - 0x18]
push 0x5745b4
push 0x5745b4
push 0x574638
push 0x5745b4
push 0x574670
push 0x57469c
push 0x5745b4
push 0x5746e8
lea eax, [ebp - 0x18]
mov edx, 9
call fcn.00405c48
push 0
push 1
movzx ecx, word [0x57470c]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.0044afc8
cmp eax, 6
jne 0x574085
lea eax, [ebp - 0x18]
mov edx, 0x574718
call fcn.0040594c
push 1
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.00405d88
push eax
push 0x574778
push 0
call sub.shell32.dll_ShellExecuteA
lea eax, [ebp - 0xc]
call fcn.004058b4
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 8]
test eax, eax
je 0x5740a0
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x57414b
mov ebx, 1
mov eax, dword [ebp - 8]
cmp byte [eax + ebx - 1], 0x2e
jne 0x5740bd
mov al, 1
jmp 0x5740ce
mov eax, dword [ebp - 8]
test eax, eax
je 0x5740c9
sub eax, 4
mov eax, dword [eax]
cmp eax, ebx
sete al
test al, al
je 0x574122
mov eax, dword [ebp - 8]
test eax, eax
je 0x5740de
sub eax, 4
mov eax, dword [eax]
cmp eax, ebx
jne 0x574103
lea eax, [ebp - 0x84]
mov edx, dword [ebp - 8]
movzx edx, byte [edx + ebx - 1]
call fcn.00405a9c
mov edx, dword [ebp - 0x84]
lea eax, [ebp - 0xc]
call fcn.00405b90
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0xc]
call fcn.00403d84
mov edx, dword [ebp - 0x2c]
mov dword [ebp + edx*4 - 0x5c], eax
inc dword [ebp - 0x2c]
lea eax, [ebp - 0xc]
call fcn.004058b4
jmp 0x574143
lea eax, [ebp - 0x88]
mov edx, dword [ebp - 8]
movzx edx, byte [edx + ebx - 1]
call fcn.00405a9c
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 0xc]
call fcn.00405b90
inc ebx
dec esi
jne 0x5740af
lea eax, [ebp - 0xc]
call fcn.004058b4
mov dword [ebp - 0x2c], 4
mov eax, dword [0x5a2e34]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
test eax, eax
je 0x574176
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x57424f
mov ebx, 1
mov eax, dword [0x5a2e34]
mov eax, dword [eax]
cmp byte [eax + ebx - 1], 0x2e
jne 0x574197
mov al, 1
jmp 0x5741b8
mov eax, dword [0x5a2e34]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
test eax, eax
je 0x5741b3
sub eax, 4
mov eax, dword [eax]
cmp eax, ebx
sete al
test al, al
je 0x574221
mov eax, dword [0x5a2e34]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
test eax, eax
je 0x5741d8
sub eax, 4
mov eax, dword [eax]
cmp eax, ebx
jne 0x574202
lea eax, [ebp - 0x90]
mov edx, dword [0x5a2e34]
mov edx, dword [edx]
movzx edx, byte [edx + ebx - 1]
call fcn.00405a9c
mov edx, dword [ebp - 0x90]
lea eax, [ebp - 0xc]
call fcn.00405b90
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0xc]
call fcn.00403d84
mov edx, dword [ebp - 0x2c]
mov dword [ebp + edx*4 - 0x5c], eax
inc dword [ebp - 0x2c]
lea eax, [ebp - 0xc]
call fcn.004058b4
jmp 0x574247
lea eax, [ebp - 0x94]
mov edx, dword [0x5a2e34]
mov edx, dword [edx]
movzx edx, byte [edx + ebx - 1]
call fcn.00405a9c
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 0xc]
call fcn.00405b90
inc ebx
dec esi
jne 0x574185
imul ebx, dword [ebp - 0x58], 0x2710
imul eax, dword [ebp - 0x54], 0x64
add ebx, eax
add ebx, dword [ebp - 0x50]
imul eax, dword [ebp - 0x4c], 0x2710
imul edx, dword [ebp - 0x48], 0x64
add eax, edx
add eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x5a2e90]
cmp byte [eax], 0
je 0x57429f
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x4c]
je 0x57429f
mov eax, 0x574788
call fcn.0044b124
mov byte [0x6d1ec4], 1
call fcn.005739a4
jmp 0x574414
cmp byte [0x6d1ea1], 0
je 0x5742c4
mov eax, dword [ebp - 0x2c]
cdq
idiv dword [0x6d1f68]
mov ecx, eax
mov eax, ebx
cdq
idiv dword [0x6d1f68]
cmp ecx, eax
jge 0x5742c4
mov dword [ebp - 0x2c], ebx
cmp ebx, dword [ebp - 0x2c]
jle 0x5743c3
mov eax, dword [0x5a2e34]
mov eax, dword [eax]
mov edx, 0x5744f8
call fcn.00405cd4
je 0x5743c3
mov eax, dword [0x5a2d94]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5a89e4]
call fcn.0057a3d0
mov eax, dword [0x5a2f20]
mov eax, dword [eax]
mov eax, dword [eax + 0x384]
xor edx, edx
call fcn.004466c0
mov byte [ebp - 0x31], 0
cmp byte [0x6d1ec1], 0
jne 0x574388
push 0
push 0
push 0x57481c
mov eax, dword [0x5a2e34]
push dword [eax]
push 0x5745b4
push 0x574864
push dword [ebp - 8]
push 0x5745b4
push 0x5745b4
push 0x574888
push 0x5745b4
push dword [ebp - 0x10]
push 0x5745b4
push 0x5745b4
push 0x57489c
lea eax, [ebp - 0x98]
mov edx, 0xd
call fcn.00405c48
mov eax, dword [ebp - 0x98]
movzx ecx, word [0x57470c]
xor edx, edx
call fcn.0044afc8
cmp eax, 6
jne 0x574388
mov byte [ebp - 0x31], 1
movzx eax, byte [0x6d1ec1]
or al, byte [ebp - 0x31]
je 0x5743f8
mov eax, dword [ebp - 0x20]
mov edx, 0x5748b4
call fcn.00405cd4
je 0x5743b3
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5a89e4]
call fcn.00572a70
jmp 0x5743f8
xor ecx, ecx
xor edx, edx
mov eax, dword [0x5a89e4]
call fcn.00572a70
jmp 0x5743f8
mov word [0x6d203a], 0
call fcn.0040d080
fstp qword [ebp - 0x40]
wait
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov edx, dword [0x5a2a70]
mov edx, dword [edx]
lea eax, [ebp - 0x28]
call fcn.0040dce0
mov eax, 0x6d2044
mov edx, dword [ebp - 0x28]
call fcn.00405908
cmp ebx, dword [ebp - 0x2c]
jge 0x57440f
cmp ebx, 0x2710
jle 0x57440f
mov eax, 0x5748cc
call fcn.0044b124
call fcn.005738f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x574456
lea eax, [ebp - 0x98]
mov edx, 3
call fcn.004058d8
lea eax, [ebp - 0x88]
mov edx, 0xc
call fcn.004058d8
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.004058d8
ret