Function at 0x586c24
Capabilities:
Check for time delay via gettickcount
Create process on windows
Delete file
Write and execute a file
Write file on windows

Disassembly:
push 0x6c
mov eax, 0x60aed5
call fcn.004db48b
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x587375
cmp dword [edi], 0x1102
jne 0x586ef7
push dword [edi + 8]
lea ecx, [ebp - 0x10]
call fcn.0041ddcb
push 0x67476c
lea ecx, [ebp + 0x10]
call fcn.0040d2ee
mov esi, str.updater.exe
push esi
call fcn.00505bb3
pop ecx
push esi
push eax
lea ecx, [ebp + 0x10]
call fcn.0040f454
mov esi, dword [ebp + 0x10]
mov ecx, esi
call fcn.0059076d
xor ebx, ebx
test eax, eax
je 0x586e81
mov edi, dword [ebp - 0x10]
cmp dword [edi - 8], ebx
je 0x586e62
push 0x67476c
lea ecx, [ebp - 0x1c]
call fcn.0040d2ee
push str.packs_
mov edx, eax
lea ecx, [ebp - 0x18]
call fcn.0040ce1d
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff4
cmp ecx, 0x668010
je 0x586cc9
call fcn.00407965
mov edi, dword [ebp - 0x18]
mov ecx, edi
call fcn.00590f81
mov eax, dword [0x668294]
mov dword [ebp - 0x14], eax
call fcn.0051687d
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x14]
push str._u_u.dat
push eax
call fcn.0040cefd
mov eax, dword [0x668294]
lea ecx, [ebp - 0x1c]
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
push eax
push dword [eax - 8]
push edi
push dword [edi - 8]
call fcn.0040f4c7
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.00414841
lea ecx, [esi - 0xc]
mov dword [ebp - 0x1c], eax
cmp ecx, 0x668010
je 0x586d34
call fcn.00407965
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x586cdb
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push dword [eax - 8]
call fcn.0040f454
mov esi, dword [ebp - 0x18]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
je 0x586d93
push ebx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
push eax
push dword [edi - 8]
lea ecx, [ebp - 0x10]
push dword [edi - 8]
call fcn.0040cccd
mov edi, dword [ebp - 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x6366e4
push edi
call fcn.00505bb3
pop ecx
push edi
push eax
lea ecx, [ebp + 0x10]
call fcn.0040f454
push esi
push dword [esi - 8]
lea ecx, [ebp + 0x10]
call fcn.0040f454
push 0x44
pop edi
push edi
lea eax, [ebp - 0x78]
push ebx
push eax
call fcn.004e0bc0
add esp, 0xc
mov dword [ebp - 0x78], edi
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x4c], 1
lea ecx, [ebp - 0x2c]
push 0xa
pop eax
mov word [ebp - 0x48], ax
xor eax, eax
push ecx
stosd dword es:[edi], eax
lea ecx, [ebp - 0x78]
push ecx
push ebx
push ebx
stosd dword es:[edi], eax
lea ecx, [ebp + 0x10]
push ebx
push ebx
push ebx
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
push dword [eax - 8]
call fcn.0040ceb7
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x586e1d
push dword [ebp - 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x2c]
call edi
jmp 0x586e24
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
mov eax, 0x80004005
cmp dword [ebp - 0x1c], ecx
cmovne eax, ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff4
mov dword [ebp - 0x1c], eax
cmp ecx, 0x668010
je 0x586e47
call fcn.00407965
lea ecx, [esi - 0xc]
cmp ecx, 0x668010
je 0x586e57
call fcn.00407965
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp - 0x1c]
jmp 0x586e65
mov eax, dword [ebp + 0x10]
test eax, eax
js 0x586e81
lea ecx, [esi - 0xc]
cmp ecx, 0x668010
je 0x586e79
call fcn.00407965
lea ecx, [edi - 0xc]
jmp 0x587368
mov eax, dword [0x668294]
push 0x82a1
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
call fcn.0041129f
mov eax, dword [0x668294]
push 0x82a2
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
call fcn.0041129f
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
push 0x30
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esi - 0xc]
mov ebx, 0x668010
cmp ecx, ebx
je 0x586ecf
call fcn.00407965
lea ecx, [edi - 0xc]
cmp ecx, ebx
je 0x586edb
call fcn.00407965
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff4
cmp ecx, ebx
je 0x586eea
call fcn.00407965
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff4
cmp ecx, ebx
jmp 0x58736e
cmp dword [edi], 0x1101
jne 0x587134
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x587375
lea ecx, [ebp - 0x50]
call fcn.00408615
mov eax, dword [0x668294]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], ebx
lea ecx, [ebp + 0x10]
push dword [edi + 8]
call fcn.0040d2ee
push 0x63a810
lea ecx, [ebp - 0x14]
call fcn.0040d2ee
push ecx
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x10]
mov esi, dword [ebp - 0x14]
push esi
call fcn.0040cf21
mov dword [ebp - 0x18], eax
mov edi, 0x668010
test eax, eax
js 0x58711e
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0x10]
call fcn.0040d197
push eax
lea ecx, [ebp - 0x50]
call fcn.0040d242
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff4
cmp ecx, edi
je 0x586f7f
call fcn.00407965
mov eax, dword [ebp + 0x10]
lea ecx, [ebp + 0x10]
mov eax, dword [eax - 8]
sub eax, dword [esi - 8]
sub eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0042a0b3
push eax
lea ecx, [ebp + 0x10]
call fcn.0040d242
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff4
cmp ecx, edi
je 0x586fb0
call fcn.00407965
push ecx
push esi
lea ecx, [ebp + 0x10]
call fcn.0040cf21
mov dword [ebp - 0x18], eax
test eax, eax
js 0x58711e
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0x10]
call fcn.0040d197
push eax
lea ecx, [ebp - 0x4c]
call fcn.0040d242
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff4
cmp ecx, edi
je 0x586fea
call fcn.00407965
mov eax, dword [ebp + 0x10]
lea ecx, [ebp + 0x10]
mov eax, dword [eax - 8]
sub eax, dword [esi - 8]
sub eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0042a0b3
push eax
lea ecx, [ebp + 0x10]
call fcn.0040d242
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff4
cmp ecx, edi
je 0x58701b
call fcn.00407965
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp - 0x48]
call fcn.0040d242
mov eax, dword [0x668294]
push 0x8148
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
call fcn.0041129f
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040d242
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff4
cmp ecx, edi
je 0x587058
call fcn.00407965
lea ecx, [ebp - 0x2c]
call fcn.00435fbf
push str.Artist
lea ecx, [ebp - 0x1c]
call fcn.0041ddcb
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00421da7
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff4
cmp ecx, edi
je 0x587090
call fcn.00407965
push str.Title
lea ecx, [ebp - 0x1c]
call fcn.0041ddcb
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00421da7
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff4
cmp ecx, edi
je 0x5870c4
call fcn.00407965
mov edi, dword [ebp - 0x10]
push ebx
push dword [ebp - 0x3c]
lea ecx, [edi + 0x3a18]
call fcn.005a5af5
push ecx
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x48]
lea ecx, [edi + 0x3a18]
call fcn.005a493f
lea ecx, [ebp - 0x2c]
call fcn.0042b585
lea ecx, [esi - 0xc]
mov ebx, 0x668010
cmp ecx, ebx
je 0x587102
call fcn.00407965
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff4
cmp ecx, ebx
je 0x587111
call fcn.00407965
lea ecx, [ebp - 0x50]
call fcn.00409a93
jmp 0x587375
lea ecx, [esi - 0xc]
cmp ecx, edi
je 0x58712a
call fcn.00407965
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff4
cmp ecx, edi
jmp 0x58710a
push dword [esi + 0x3a1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x587375
push dword [edi + 8]
lea ecx, [ebp - 0x14]
call fcn.0040d2ee
mov dword [ebp - 4], 6
mov ecx, dword [edi]
cmp ecx, 2
jne 0x5871c6
and dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x44]
call fcn.004112ec
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x58]
push eax
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
push eax
call fcn.0040d36e
call fcn.00589311
test eax, eax
je 0x5871bc
cmp dword [ebp + 0x10], 1
je 0x5871a8
cmp dword [ebp + 0x10], 2
je 0x5871a8
cmp dword [ebp + 0x10], 3
jne 0x5871bc
lea eax, [ebp - 0x58]
push eax
push 0xa
jmp 0x5871ae
lea eax, [ebp - 0x58]
push eax
push 3
push 0x784
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x44]
call fcn.004113dc
jmp 0x5871fc
cmp ecx, 3
jne 0x587207
mov edi, dword [edi + 8]
xor ebx, ebx
test edi, edi
jne 0x5871d8
mov eax, ebx
jmp 0x5871df
push edi
call fcn.00505bb3
pop ecx
push edi
push eax
lea ecx, [esi + 0x62b8]
call fcn.0040f513
push ebx
push ebx
push 0x7fc
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff4
jmp 0x587368
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
xor eax, eax
inc edx
cmp ecx, edx
sete al
xor ebx, ebx
mov dword [ebp - 0x10], eax
cmp ecx, edx
je 0x587244
cmp dword [esi + 0x6294], ebx
je 0x587244
call edi
mov ecx, dword [esi + 0x6294]
mov edx, dword [ebp - 0x10]
add ecx, 0x3e8
cmp eax, ecx
push 1
pop eax
cmovb edx, eax
mov dword [ebp - 0x10], edx
call edi
mov dword [esi + 0x6294], eax
cmp dword [0x673c90], ebx
je 0x58726b
cmp dword [0x673bdc], ebx
je 0x58726b
lea edi, [esi + 0x3a18]
mov ecx, edi
call fcn.005a595a
jmp 0x5872a2
lea ecx, [esi + 0x3a18]
cmp dword [0x6737ec], ebx
je 0x587286
push ebx
push ebx
call fcn.005a5af5
lea ecx, [esi + 0x3a18]
mov eax, dword [ebp - 0x10]
mov edi, ecx
test eax, eax
jne 0x5872a5
cmp dword [0x6737e8], ebx
je 0x5872a5
call fcn.005a595a
lea edi, [esi + 0x3a18]
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 0x3ba0]
test ecx, ecx
je 0x5872b4
mov edx, dword [ecx + 4]
jmp 0x5872b6
mov edx, ebx
xor ecx, ecx
test eax, eax
push ebx
cmovne ecx, edx
or edx, 0xffffffff
mov dword [ebp + 0x10], ecx
lea ecx, [ebp - 0x14]
call fcn.00596d00
mov esi, dword [ebp - 0x14]
pop ecx
cmp eax, 6
jne 0x5872e8
push dword [0x673e20]
mov ecx, edi
push esi
call fcn.005a48da
mov ebx, dword [ebp + 0x10]
jmp 0x587353
cmp eax, 3
jne 0x587307
push ecx
lea ecx, [ebp - 0x6c]
call fcn.0041bf00
push ebx
push ebx
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 8
push eax
call fcn.005970c0
jmp 0x58731f
cmp eax, 5
jne 0x587345
push ecx
lea ecx, [ebp - 0x6c]
call fcn.0041bf00
push esi
mov byte [ebp - 4], 9
call fcn.00596eb0
mov ebx, dword [ebp + 0x10]
test eax, eax
je 0x587337
xor eax, eax
mov ecx, edi
inc eax
push eax
push eax
push ebx
lea eax, [ebp - 0x6c]
push eax
call fcn.005a4f82
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 6
call fcn.0041bf3f
jmp 0x587353
mov ebx, dword [ebp + 0x10]
mov ecx, edi
push ebx
push esi
call fcn.005a4a24
mov ebx, eax
cmp dword [ebp - 0x10], 0
jne 0x587365
xor eax, eax
mov ecx, edi
inc eax
push eax
push ebx
call fcn.005a52f4
lea ecx, [esi - 0xc]
cmp ecx, 0x668010
je 0x587375
call fcn.00407965
xor eax, eax
call fcn.004db459
ret 0x10