Function at 0x52c4e8
Capabilities:
Create directory
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x13
push 0
push 0
dec ecx
jne 0x52c4f0
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52ceb6
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x52c5a2
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x430]
call fcn.00419f2c
lea eax, [ebp - 0x64]
mov edx, 0x52ced0
call fcn.004073fc
mov eax, dword [ebp - 0x64]
call fcn.00413b70
test al, al
jne 0x52c572
push 0
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x430]
call fcn.00419f2c
lea eax, [ebp - 0x68]
mov edx, 0x52ced0
call fcn.004073fc
mov eax, dword [ebp - 0x68]
call fcn.0040707c
push eax
call sub.kernel32.dll_CreateDirectoryW
lea edx, [ebp - 0x6c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x430]
call fcn.00419f2c
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 4]
add eax, 0x42c
mov ecx, 0x52ced0
call fcn.004074bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52c5dc
mov bx, 1
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x434]
mov eax, ebx
call fcn.00528df0
jmp 0x52c65e
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x42c]
call fcn.00419f2c
push dword [ebp - 0x74]
push dword [ebp - 0x18]
push 0x52cef8
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004075a0
mov eax, dword [ebp - 0x14]
call fcn.00413b28
test al, al
je 0x52c64a
mov eax, dword [ebp - 0x14]
call fcn.0040707c
mov edx, eax
lea eax, [ebp - 0x78]
call fcn.004071ac
mov eax, dword [ebp - 0x78]
call fcn.0040707c
push eax
call sub.kernel32.dll_DeleteFileW
inc ebx
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x434]
mov eax, ebx
call fcn.00528df0
cmp dword [ebp - 0x18], 0
jne 0x52c5f5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x410]
xor edx, edx
call fcn.00528b30
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x52c6a0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x444]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x410]
call fcn.00528b30
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e4]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x52c6db
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x410]
mov edx, dword [eax + 0x1b4]
mov ecx, dword [ebp - 4]
add edx, dword [ecx + 0x448]
mov ecx, dword [ebp - 4]
add edx, dword [ecx + 0x44c]
call fcn.00528b30
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3f8]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x52c722
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
jne 0x52c722
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x410]
mov edx, dword [eax + 0x1b4]
mov ecx, dword [ebp - 4]
add edx, dword [ecx + 0x450]
call fcn.00528b30
lea eax, [ebp - 0x24]
xor edx, edx
call fcn.00407044
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x52c843
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e4]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x52c843
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x46c]
cmp eax, 0xb
ja case.0x52c770.0
jmp dword [eax*4 + 0x52c777]
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x434]
mov ax, 6
call fcn.00528df0
jmp case.0x52c770.0
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x434]
mov ax, 2
call fcn.00528df0
jmp case.0x52c770.0
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x434]
mov ax, 1
call fcn.00528df0
jmp case.0x52c770.0
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x434]
mov ax, 1
call fcn.00528df0
jmp case.0x52c770.0
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x434]
mov ax, 1
call fcn.00528df0
jmp case.0x52c770.0
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x434]
mov ax, 2
call fcn.00528df0
jmp case.0x52c770.0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x52c941
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x46c]
cmp eax, 9
jg 0x52c87a
je 0x52c8e2
dec eax
je 0x52c894
dec eax
je 0x52c8ae
dec eax
je 0x52c8c8
jmp case.0x52c770.0
sub eax, 0xa
je 0x52c8fc
dec eax
je 0x52c913
sub eax, 0x58
je 0x52c92a
jmp case.0x52c770.0
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x434]
mov ax, 7
call fcn.00528df0
jmp case.0x52c770.0
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x434]
mov ax, 4
call fcn.00528df0
jmp case.0x52c770.0
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x434]
mov ax, 3
call fcn.00528df0
jmp case.0x52c770.0
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x434]
mov ax, 2
call fcn.00528df0
jmp case.0x52c770.0
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x434]
mov ax, 1
call fcn.00528df0
jmp case.0x52c770.0
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x434]
mov ax, 1
call fcn.00528df0
jmp case.0x52c770.0
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x434]
mov ax, 1
call fcn.00528df0
jmp case.0x52c770.0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e4]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je case.0x52c770.0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x46c], 0xb
jne 0x52c979
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x434]
mov ax, 3
call fcn.00528df0
jmp case.0x52c770.0
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x434]
mov ax, 5
call fcn.00528df0
mov eax, dword [ebp - 0x24]
mov edx, 0x52cf10
call fcn.00407760
jne 0x52c9a7
lea eax, [ebp - 0x24]
xor edx, edx
call fcn.00407044
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
jne 0x52c9d1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e4]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x52ca02
cmp dword [ebp - 0x24], 0
jne 0x52ca02
lea edx, [ebp - 0x7c]
mov eax, dword [0x53a84c]
call fcn.0040a29c
mov eax, dword [ebp - 0x7c]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
movzx ecx, word [0x52cee8]
xor edx, edx
call fcn.0047086c
jmp 0x52ce7e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x410]
mov dl, 1
call fcn.0048a32c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x410]
call fcn.0048aa94
cmp dword [ebp - 0x24], 0
je 0x52cc59
mov eax, dword [ebp - 4]
mov byte [eax + 0x45c], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x39c]
mov edx, 0x4e20
call fcn.004e4010
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x39c]
mov edx, 0x4e20
call fcn.004e3ff8
mov eax, dword [ebp - 4]
push dword [eax + 0x438]
push dword [ebp - 0x24]
push 0x52cef8
lea eax, [ebp - 8]
mov edx, 3
call fcn.004075a0
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x42c]
call fcn.00419f2c
push dword [ebp - 0x80]
push dword [ebp - 0x24]
push 0x52cef8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004075a0
xor edx, edx
push ebp
push 0x52caf5
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x39c]
mov edx, dword [ebp - 8]
call fcn.00522cc8
push 0xff40
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x42d104]
call fcn.00438db4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x39c]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00522a88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52cb4d
cmp dword [ebp - 0x10], 0
je 0x52cb5b
mov eax, dword [ebp - 0x10]
call fcn.004053a4
mov eax, dword [ebp - 4]
mov byte [eax + 0x45c], 0
mov dword [ebp - 0x60], 0x3c
mov dword [ebp - 0x5c], 0x40
xor eax, eax
mov dword [ebp - 0x54], eax
lea edx, [ebp - 0x8c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x42c]
call fcn.00419f2c
push dword [ebp - 0x8c]
push dword [ebp - 0x24]
push 0x52cef8
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.004075a0
mov eax, dword [ebp - 0x88]
call fcn.0040707c
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 1
xor eax, eax
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x60]
push eax
call sub.shell32.dll_ShellExecuteExW
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x414]
mov dl, 1
call fcn.0048a32c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x410]
mov edx, dword [eax + 0x1b4]
call fcn.00528be0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x52cc18
mov eax, dword [ebp - 4]
call fcn.004b51e4
jmp 0x52ce3c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e4]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x52ce3c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e4]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xf0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e4]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x74]
jmp 0x52ce3c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x46c], 0xb
jge 0x52cd87
lea edx, [ebp - 0x90]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x430]
call fcn.00419f2c
lea eax, [ebp - 0x90]
mov edx, 0x52cf20
call fcn.004073fc
mov eax, dword [ebp - 0x90]
call fcn.00413b28
test al, al
je 0x52ccb0
push ebp
mov eax, 0x52cf20
call fcn.0052c340
pop ecx
test al, al
je 0x52ce7e
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x430]
call fcn.00419f2c
lea eax, [ebp - 0x94]
mov edx, 0x52cf44
call fcn.004073fc
mov eax, dword [ebp - 0x94]
call fcn.00413b28
test al, al
je 0x52ccf7
push ebp
mov eax, 0x52cf44
call fcn.0052c340
pop ecx
test al, al
je 0x52ce7e
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x430]
call fcn.00419f2c
lea eax, [ebp - 0x98]
mov edx, 0x52cf68
call fcn.004073fc
mov eax, dword [ebp - 0x98]
call fcn.00413b28
test al, al
je 0x52cd3e
push ebp
mov eax, 0x52cf68
call fcn.0052c340
pop ecx
test al, al
je 0x52ce7e
lea edx, [ebp - 0x9c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x430]
call fcn.00419f2c
lea eax, [ebp - 0x9c]
mov edx, 0x52cf8c
call fcn.004073fc
mov eax, dword [ebp - 0x9c]
call fcn.00413b28
test al, al
je 0x52cdeb
push ebp
mov eax, 0x52cf8c
call fcn.0052c340
pop ecx
test al, al
je 0x52ce7e
jmp 0x52cdeb
push 0x52cfb0
mov eax, dword [ebp - 4]
push dword [eax + 0x440]
push 0x52cfc4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004075a0
push ebp
mov eax, dword [ebp - 0x1c]
call fcn.0052c340
pop ecx
test al, al
je 0x52ce7e
push 0x52cfdc
mov eax, dword [ebp - 4]
push dword [eax + 0x440]
push 0x52cfc4
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004075a0
push ebp
mov eax, dword [ebp - 0x20]
call fcn.0052c340
pop ecx
test al, al
je 0x52ce7e
mov eax, dword [ebp - 4]
mov byte [eax + 0x45c], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x410]
mov edx, dword [eax + 0x1b4]
call fcn.00528be0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x414]
mov dl, 1
call fcn.0048a32c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3f8]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xf0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3f8]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x410]
xor edx, edx
call fcn.0048a32c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x414]
xor edx, edx
call fcn.0048a32c
xor eax, eax
push ebp
push 0x52ce74
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52ce7e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52cebd
lea eax, [ebp - 0x9c]
mov edx, 0xf
call fcn.00406fe8
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00406fe8
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00406fe8
ret