Function at 0x5407ec
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb90
xor edx, edx
mov dword [ebp - 0x470], edx
mov dword [ebp - 0x46c], edx
mov dword [ebp - 0x468], edx
mov dword [ebp - 0x464], edx
mov dword [ebp - 0x460], edx
mov dword [ebp - 0x45c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405c0c
lea eax, [ebp - 0x168]
mov edx, dword [0x40911c]
call fcn.0040629c
xor eax, eax
push ebp
push 0x540c52
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x168]
mov edx, 0x3f
mov eax, dword [ebp - 4]
call fcn.0040aea8
lea eax, [ebp - 0x168]
call fcn.0040af1c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x2b4]
call fcn.0040367c
mov edx, 0x77f
lea eax, [ebp - 0x2b4]
call fcn.00403b90
call fcn.00402f48
mov al, 1
call fcn.005807a8
mov al, 1
call fcn.0057f868
mov edx, dword [0x596c00]
mov edx, dword [edx]
lea eax, [ebp - 0x2b4]
call fcn.00403a3c
mov eax, 0x59c71c
mov edx, dword [0x596c00]
mov edx, dword [edx]
call fcn.004059bc
mov al, 1
call fcn.005807a8
lea eax, [ebp - 0x2b4]
call fcn.004037fc
mov eax, dword [0x59c71c]
mov edx, 0x540c68
call fcn.00405b68
jne 0x540a42
lea eax, [ebp - 0x45c]
call fcn.00512268
push dword [ebp - 0x45c]
push dword [0x59c71c]
push 0x540c80
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405adc
lea ecx, [ebp - 0x168]
mov edx, 0x3f
mov eax, dword [ebp - 8]
call fcn.0040aea8
test eax, eax
jne 0x540971
mov eax, dword [0x597410]
mov eax, dword [eax]
mov edx, dword [0x5973e4]
mov edx, dword [edx]
call fcn.00405b68
jne 0x540971
push 5
push dword [ebp - 8]
push 0x540c90
push dword [ebp - 4]
push 0x540c9c
lea eax, [ebp - 0x460]
mov edx, 4
call fcn.00405adc
mov eax, dword [ebp - 0x460]
call fcn.00405c1c
push eax
call sub.kernel32.dll_WinExec
jmp 0x540a32
lea eax, [ebp - 0x168]
call fcn.0040af1c
mov eax, dword [ebp - 8]
call fcn.00405c1c
push eax
call sub.kernel32.dll_DeleteFileA
push 0
push 0
push 1
push 1
mov eax, dword [0x597630]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov edx, 0x540ca8
call fcn.0053bef8
test al, al
je 0x540c16
mov edx, dword [0x596d24]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
call fcn.0053dc70
lea ecx, [ebp - 0x168]
mov edx, 0x3f
mov eax, dword [ebp - 8]
call fcn.0040aea8
test eax, eax
jne 0x540a28
mov eax, dword [0x597410]
mov edx, dword [0x5973e4]
mov edx, dword [edx]
call fcn.0040579c
mov eax, dword [0x5974fc]
mov eax, dword [eax]
call fcn.0056ff44
push 5
push dword [ebp - 8]
push 0x540c90
push dword [ebp - 4]
push 0x540c9c
lea eax, [ebp - 0x464]
mov edx, 4
call fcn.00405adc
mov eax, dword [ebp - 0x464]
call fcn.00405c1c
push eax
call sub.kernel32.dll_WinExec
jmp 0x540a32
mov eax, 0x540ce4
call fcn.0044af4c
lea eax, [ebp - 0x168]
call fcn.0040af1c
call fcn.00405580
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x400]
call fcn.0040367c
mov edx, 0x56
lea eax, [ebp - 0x400]
call fcn.00403b90
call fcn.00402f48
lea edx, [ebp - 0x456]
lea eax, [ebp - 0x400]
call fcn.00403a3c
mov eax, 0x59c71c
lea edx, [ebp - 0x429]
call fcn.004059bc
lea eax, [ebp - 0x400]
call fcn.004037fc
mov eax, dword [0x59c71c]
mov edx, 0x540d3c
call fcn.00405b68
jne 0x540c05
lea eax, [ebp - 0x468]
call fcn.00512268
push dword [ebp - 0x468]
push dword [0x59c71c]
push 0x540c80
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405adc
lea ecx, [ebp - 0x168]
mov edx, 0x3f
mov eax, dword [ebp - 8]
call fcn.0040aea8
test eax, eax
jne 0x540b34
mov eax, dword [0x59722c]
mov eax, dword [eax]
mov edx, dword [0x5971e4]
mov edx, dword [edx]
call fcn.00405b68
jne 0x540b34
push 5
push dword [ebp - 8]
push 0x540c90
push dword [ebp - 4]
push 0x540c9c
lea eax, [ebp - 0x46c]
mov edx, 4
call fcn.00405adc
mov eax, dword [ebp - 0x46c]
call fcn.00405c1c
push eax
call sub.kernel32.dll_WinExec
jmp 0x540bf5
mov eax, dword [ebp - 8]
call fcn.00405c1c
push eax
call sub.kernel32.dll_DeleteFileA
push 0
push 0
push 1
push 1
mov eax, dword [0x597630]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov edx, 0x540d54
call fcn.0053bef8
test al, al
je 0x540c16
mov edx, dword [0x596d24]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
call fcn.0053dc70
lea eax, [ebp - 0x168]
call fcn.0040af1c
lea ecx, [ebp - 0x168]
mov edx, 0x3f
mov eax, dword [ebp - 8]
call fcn.0040aea8
test eax, eax
jne 0x540beb
mov eax, dword [0x59722c]
mov edx, dword [0x5971e4]
mov edx, dword [edx]
call fcn.0040579c
mov eax, dword [0x5974fc]
mov eax, dword [eax]
call fcn.0056ff44
push 5
push dword [ebp - 8]
push 0x540c90
push dword [ebp - 4]
push 0x540c9c
lea eax, [ebp - 0x470]
mov edx, 4
call fcn.00405adc
mov eax, dword [ebp - 0x470]
call fcn.00405c1c
push eax
call sub.kernel32.dll_WinExec
jmp 0x540bf5
mov eax, 0x540ce4
call fcn.0044af4c
lea eax, [ebp - 0x168]
call fcn.0040af1c
call fcn.00405580
mov eax, 0x540d90
call fcn.0044af4c
mov al, 1
call fcn.0057f868
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x540c59
lea eax, [ebp - 0x470]
mov edx, 6
call fcn.0040576c
lea eax, [ebp - 0x168]
mov edx, dword [0x40911c]
call fcn.0040636c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040576c
ret