Function at 0x5609e0
Capabilities:
Copy file
Create process on windows
Delete file
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x5609e8
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x561044
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5824dc]
cmp byte [eax], 0
je 0x560cf9
mov eax, dword [0x582f40]
mov eax, dword [eax]
call fcn.0048251c
mov eax, dword [ebx + 0x360]
mov eax, dword [eax + 0x2b4]
call fcn.004bd7a4
mov eax, dword [ebx + 0x360]
mov eax, dword [eax + 0x68]
mov edx, 0xff00
call fcn.0042d2fc
xor edx, edx
mov eax, dword [ebx + 0x360]
call fcn.00458328
push 0
mov eax, dword [ebx + 0x360]
mov eax, dword [eax + 0x2b4]
mov ecx, 0x56105c
xor edx, edx
call fcn.004bd870
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x10]
mov edx, dword [0x5826f8]
add edx, 0x2bc
call fcn.00405848
mov ecx, dword [ebp - 0x10]
mov edx, dword [0x58275c]
mov edx, dword [edx]
lea eax, [ebp - 8]
call fcn.004058fc
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0040d774
mov eax, dword [ebp - 8]
call fcn.00405a74
push eax
call sub.kernel32.dll_DeleteFileA
mov edx, dword [0x58275c]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x56107c
call fcn.004058fc
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x42903c]
call fcn.004290f4
mov ebx, eax
push 1
mov ecx, 0x561094
mov edx, 0x5610ac
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
call fcn.004046a4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dl, 1
mov eax, dword [0x41c07c]
call fcn.00404674
mov ebx, eax
mov eax, dword [0x582cac]
mov eax, dword [eax]
cmp dword [eax + 0xc], 5
jle 0x560b88
mov edx, 0x5610c0
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x5610d4
mov eax, dword [0x5825f0]
push dword [eax]
push 0x5610e4
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405978
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x560bbc
mov edx, 0x5610f0
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x5610d4
mov eax, dword [0x5825f0]
push dword [eax]
push 0x5610e4
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405978
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x561114
mov eax, dword [0x582c8c]
push dword [eax]
push 0x561124
mov eax, dword [0x5825f0]
push dword [eax]
push 0x561130
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00405978
mov edx, dword [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x5610d4
mov eax, dword [0x582c8c]
push dword [eax]
push 0x5610e4
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00405978
mov edx, dword [ebp - 0x20]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x561140
mov eax, dword [0x5825f0]
push dword [eax]
push 0x5610e4
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00405978
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x561154
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00560790
mov eax, ebx
call fcn.004046a4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
lea edx, [ebp - 0x2c]
mov eax, dword [0x582ca0]
mov eax, dword [eax]
call fcn.00477540
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.0040d9cc
mov eax, dword [ebp - 0x28]
call fcn.00405a74
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405a74
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [0x582ca0]
mov eax, dword [eax]
call fcn.00476ed8
jmp 0x56101c
mov eax, dword [0x5828c4]
cmp byte [eax], 0
je 0x56101c
mov eax, dword [0x582f40]
mov eax, dword [eax]
call fcn.0048251c
mov eax, dword [ebx + 0x360]
mov eax, dword [eax + 0x2b4]
call fcn.004bd7a4
mov eax, dword [ebx + 0x360]
mov eax, dword [eax + 0x68]
mov edx, 0xff00
call fcn.0042d2fc
xor edx, edx
mov eax, dword [ebx + 0x360]
call fcn.00458328
push 0
mov eax, dword [ebx + 0x360]
mov eax, dword [eax + 0x2b4]
mov ecx, 0x56105c
xor edx, edx
call fcn.004bd870
lea eax, [ebp - 0xc]
call fcn.005606dc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0xc]
call fcn.0040d9cc
mov eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
mov edx, dword [0x5826f8]
add edx, 0x2bc
call fcn.00405848
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 8]
pop edx
call fcn.004058fc
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0040d774
mov eax, dword [ebp - 8]
call fcn.00405a74
push eax
call sub.kernel32.dll_DeleteFileA
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.0040d9cc
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 8]
mov ecx, 0x56107c
call fcn.004058fc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x42903c]
call fcn.004290f4
mov ebx, eax
push 1
mov ecx, 0x561094
mov edx, 0x5610ac
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
call fcn.004046a4
mov ebx, dword [0x5825f0]
mov ebx, dword [ebx]
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x3c]
call fcn.00405a74
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov eax, dword [0x5825f0]
mov eax, dword [eax]
call fcn.0040d554
test al, al
jne 0x560e84
lea eax, [ebp - 0xc]
mov edx, dword [0x5825f0]
mov edx, dword [edx]
call fcn.0040567c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
call fcn.00405a74
push eax
mov eax, dword [0x582c8c]
mov eax, dword [eax]
call fcn.00405a74
push eax
call sub.kernel32.dll_CopyFileA
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dl, 1
mov eax, dword [0x41c07c]
call fcn.00404674
mov ebx, eax
mov eax, dword [0x582cac]
mov eax, dword [eax]
cmp dword [eax + 0xc], 5
jle 0x560f44
mov edx, 0x5610c0
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x5610d4
mov eax, dword [0x582c8c]
push dword [eax]
push 0x5610e4
lea eax, [ebp - 0x40]
mov edx, 3
call fcn.00405978
mov edx, dword [ebp - 0x40]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x560f78
mov edx, 0x5610f0
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x5610d4
mov eax, dword [0x582c8c]
push dword [eax]
push 0x5610e4
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.00405978
mov edx, dword [ebp - 0x44]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x561140
push dword [ebp - 0xc]
push 0x5610e4
lea eax, [ebp - 0x48]
mov edx, 3
call fcn.00405978
mov edx, dword [ebp - 0x48]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x561154
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00560790
mov eax, ebx
call fcn.004046a4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
lea edx, [ebp - 0x50]
mov eax, dword [0x582ca0]
mov eax, dword [eax]
call fcn.00477540
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x4c]
call fcn.0040d9cc
mov eax, dword [ebp - 0x4c]
call fcn.00405a74
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405a74
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x582ca0]
mov eax, dword [eax]
call fcn.00476ed8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56104b
lea eax, [ebp - 0x50]
mov edx, 5
call fcn.00405608
lea eax, [ebp - 0x38]
mov edx, 0xe
call fcn.00405608
ret