Function at 0x61066d90
Capabilities:
Delete file
Get file attributes
Persist via lnk shortcut
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x368]
push esi
mov esi, eax
push ebx
sub esp, 0xb7c
mov ebx, edx
movzx eax, byte [ebp + 8]
xor edx, edx
mov byte [ebp - 0xb3d], cl
xor ecx, ecx
mov dword [ebp - 0x140], ecx
xor ecx, ecx
mov byte [ebp - 0xb3e], al
mov eax, 0xffffffff
mov dword [ebp - 0xb48], eax
mov eax, 0xffffffff
mov dword [ebp - 0x368], eax
xor eax, eax
mov dword [ebp - 0x148], eax
xor eax, eax
mov dword [ebp - 0x144], eax
mov eax, 0xffffffff
mov dword [ebp - 0x6b8], eax
xor eax, eax
mov dword [ebp - 0x498], eax
xor eax, eax
mov dword [ebp - 0x494], eax
xor eax, eax
mov dword [ebp - 0x490], eax
xor eax, eax
mov dword [ebp - 0x474], eax
xor eax, eax
mov dword [ebp - 0xb4c], eax
mov eax, dword [0x610ef788]
mov dword [ebp - 0x124], edx
xor edx, edx
mov dword [ebp - 0x9f8], eax
mov eax, dword [0x610ef78c]
mov byte [ebp - 0x11c], 0
mov byte [ebp - 0x46c], 0
mov dword [ebp - 0x9f4], eax
mov eax, dword [0x610ef790]
mov byte [ebp - 0xb4d], 0
mov dword [ebp - 0xa08], ecx
mov dword [ebp - 0x9f0], eax
mov eax, esi
mov dword [ebp - 0xa04], edx
call fcn.610552f0
cmp eax, 0xe
je 0x61066e7c
mov eax, ebx
call fcn.610552f0
test eax, eax
je 0x61066ef0
mov edx, dword [0x610f08a0]
test edx, edx
jne 0x61066ea2
lea edx, [ebp - 0xa08]
mov dword [esp], edx
call fcn.61078650
mov eax, dword [ebp - 0xb48]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [ebp - 0xb3e]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], 0x61066d40
mov dword [esp + 0x20], eax
movzx eax, byte [ebp - 0xb3d]
mov dword [esp + 8], 0x61066d00
mov dword [esp + 4], 0x10
mov dword [esp], 0x610f089c
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0xb48]
mov dword [esp + 0x10], eax
call fcn.6108fd50
jmp 0x61066e86
mov dword [esp], esi
call sym.cygwin1.dll__strlen
cmp eax, 0x103
ja 0x610675c4
mov dword [esp], 0
mov ecx, 2
mov edx, ebx
mov eax, edi
call fcn.610620e0
cmp byte [ebp - 0xb3d], 0
je 0x61066f2e
cmp dword [ebp - 0x368], 0xffffffff
je 0x6106757e
mov eax, dword [ebp - 0x140]
test eax, eax
jne 0x6106755c
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x61067525
mov eax, dword [ebp - 0x138]
test eax, eax
je 0x61066f8b
cmp eax, 0xf7
je 0x61066f8b
cmp eax, 0xfc
je 0x61066f8b
mov eax, dword [edi + 0x230]
test eax, eax
je 0x61066f7b
cmp eax, 0xf7
je 0x61066f7b
cmp byte [edi + 0x23c], 0
jne 0x61066f8b
call sym.cygwin1.dll___errno
mov dword [eax], 0x11
jmp 0x61066e7c
cmp byte [ebp - 0xb3d], 0
je 0x6106708c
cmp byte [ebp - 0xb3e], 0
jne 0x610674f0
movzx eax, byte [esi]
cmp al, 0x2f
je 0x61067466
cmp al, 0x5c
je 0x61067466
movsx eax, al
mov dword [esp], eax
call sym.cygwin1.dll__isalpha
test eax, eax
je 0x61066fd1
cmp byte [esi + 1], 0x3a
je 0x610674d6
mov dword [esp + 4], 0x105
lea eax, [ebp - 0x8d8]
lea edi, [ebp - 0x7c8]
mov dword [esp], eax
call fcn.61068660
mov dword [esp + 4], 0x2f
mov dword [esp], edi
call sym.cygwin1.dll__strrchr
mov dword [ebp - 0xb4c], eax
test eax, eax
je 0x610674b3
mov edx, dword [ebp - 0xb4c]
mov eax, dword [ebp - 0xb4c]
movzx edx, byte [edx]
mov byte [ebp - 0xb4d], dl
mov byte [eax], 0
mov dword [esp], edi
call fcn.61068790
mov dword [esp + 8], 0
lea edi, [ebp - 0x9e8]
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.61063340
mov eax, dword [ebp - 0xb4c]
test eax, eax
je 0x61067466
mov dword [esp], edi
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
inc eax
je 0x61067466
mov eax, dword [ebp - 0xb4c]
test eax, eax
je 0x6106708c
movzx edx, byte [ebp - 0xb4d]
mov eax, dword [ebp - 0xb4c]
mov byte [eax], dl
lea eax, [ebp - 0x8d8]
mov dword [esp], eax
call fcn.61068790
mov edi, 1
cmp byte [0x61146ea0], 0
je 0x610670a8
mov eax, dword [ebp - 0x148]
test eax, eax
js 0x61067441
mov dword [esp + 0x18], 0
lea edx, [ebp - 0x9f8]
lea eax, [ebp - 0x11c]
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 0xb44], eax
sub esp, 0x1c
inc eax
je 0x6106742d
cmp byte [ebp - 0xb3d], 0
je 0x6106738c
call fcn.61061560
mov dword [esp], esi
call sym.cygwin1.dll__strlen
mov word [ebp - 0xa0a], ax
lea ecx, [ebp - 0x9e8]
mov edi, ecx
lea esi, [esi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x61067120
test edx, 0x8080
jne 0x61067145
shr edx, 0x10
add ecx, 2
mov dword [esp + 0x10], 0
add dl, dl
mov edx, dword [ebp - 0xb44]
sbb ecx, 3
sub ecx, edi
lea edi, [ebp - 0xb3c]
mov word [ebp - 0xa0c], cx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 0x61146a90
mov dword [esp], edx
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
test eax, eax
je 0x61067193
cmp dword [ebp - 0xb3c], 0x4c
je 0x610671c9
mov edx, 0xa52
mov eax, 0x610620a0
call fcn.61022e70
mov eax, dword [ebp - 0xb44]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
lea edx, [ebp - 0x11c]
mov dword [esp], edx
call sub.KERNEL32.dll_DeleteFileA
sub esp, 4
jmp 0x61066e7c
mov dword [esp + 0x10], 0
lea eax, [ebp - 0xa0a]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xb44]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 2
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
test eax, eax
je 0x61067193
cmp dword [ebp - 0xb3c], 2
jne 0x61067193
movzx eax, word [ebp - 0xa0a]
mov dword [esp + 0x10], 0
mov edx, dword [ebp - 0xb44]
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], edx
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
test eax, eax
je 0x61067193
movzx eax, word [ebp - 0xa0a]
cmp dword [ebp - 0xb3c], eax
jne 0x61067193
mov dword [esp + 0x10], 0
lea eax, [ebp - 0xa0c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xb44]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 2
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
test eax, eax
je 0x61067193
cmp dword [ebp - 0xb3c], 2
jne 0x61067193
movzx eax, word [ebp - 0xa0c]
lea edx, [ebp - 0x9e8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xb44]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
test eax, eax
je 0x61067193
movzx eax, word [ebp - 0xa0c]
cmp dword [ebp - 0xb3c], eax
jne 0x61067193
mov eax, dword [ebp - 0xb44]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
cmp byte [0x61146ea0], 0
jne 0x61067300
cmp byte [0x611462b0], 0
jne 0x6106735f
xor eax, eax
cmp byte [ebp - 0xb3d], 0
sete al
lea eax, [eax + eax*2 + 1]
mov dword [esp + 4], eax
lea eax, [ebp - 0x11c]
mov dword [esp], eax
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
cmp byte [ebp - 0xb3e], 0
jne 0x6106733e
mov eax, dword [ebp - 0x154]
shr eax, 6
and eax, 1
test al, al
jne 0x6106734b
xor ecx, ecx
mov dword [ebp - 0xb48], ecx
jmp 0x61066e7c
mov dword [esp + 4], esi
lea edx, [ebp - 0x11c]
mov dword [esp], edx
call fcn.61066c50
jmp 0x6106733e
mov dword [esp + 8], 0xa1ff
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x11c]
mov dword [esp + 4], edx
and eax, 0x80000000
mov dword [esp], eax
call fcn.6107ec60
sub esp, 0xc
jmp 0x61067300
mov dword [esp + 0xc], esi
lea edi, [ebp - 0xb38]
mov dword [esp + 8], 0x61066d65
mov dword [esp + 4], 0x61066d70
mov dword [esp], edi
call fcn.6108c610
mov ecx, edi
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x610673b0
test edx, 0x8080
jne 0x610673d5
shr edx, 0x10
add ecx, 2
mov dword [esp + 0x10], 0
add dl, dl
lea eax, [ebp - 0xb3c]
sbb ecx, 3
sub ecx, edi
inc ecx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xb44]
mov dword [ebp - 0xb54], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
test eax, eax
jne 0x610672dd
mov edx, dword [ebp - 0xb54]
cmp dword [ebp - 0xb3c], edx
jne 0x610672dd
jmp 0x61067193
mov edx, 0xa16
mov eax, 0x610620a0
call fcn.61022e70
jmp 0x61066e7c
mov dword [esp], 0xa1a4
lea edx, [ebp - 0xa08]
lea eax, [ebp - 0x9f8]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call fcn.6107e910
jmp 0x610670a8
mov dword [esp], 0
lea eax, [ebp - 0x6b8]
mov ecx, 2
mov edx, esi
call fcn.610620e0
mov eax, dword [ebp - 0xb4c]
test eax, eax
je 0x61067496
cmp dword [ebp - 0x490], 2
je 0x61067065
lea eax, [ebp - 0x46c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x9e8]
mov dword [esp], eax
call sym.cygwin1.dll__strcpy
jmp 0x61067065
mov dword [esp + 4], 0x5c
mov dword [esp], edi
call sym.cygwin1.dll__strrchr
mov dword [ebp - 0xb4c], eax
test eax, eax
jne 0x6106700b
jmp 0x6106702b
movzx eax, byte [esi + 2]
test al, al
je 0x61067466
cmp al, 0x2f
je 0x61067466
cmp al, 0x5c
jne 0x61066fd1
jmp 0x61067466
mov dword [esp + 4], esi
lea eax, [ebp - 0x9e8]
mov edi, 2
mov dword [esp], eax
call sym.cygwin1.dll__strcpy
mov dword [esp + 4], pe_nt_image_headers32
lea eax, [ebp - 0x11c]
mov dword [esp], eax
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
jmp 0x61067091
mov dword [esp + 0x10], esi
lea edx, [ebp - 0x11c]
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], 0x61066d75
mov dword [esp + 8], 0x61066d00
mov dword [esp + 4], 0x10
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x61066f49
call sym.cygwin1.dll___errno
cmp byte [ebp - 0x128], 0
je 0x61067576
mov edx, 0x89
mov dword [eax], edx
jmp 0x61066e7c
mov edx, dword [ebp - 0x140]
jmp 0x6106756f
mov dword [esp + 4], ebx
lea edx, [ebp - 0x7c8]
mov dword [esp], edx
call sym.cygwin1.dll__strcpy
mov dword [esp + 4], 0x61066d86
lea eax, [ebp - 0x7c8]
mov dword [esp], eax
call sym.cygwin1.dll__strcat
mov dword [esp], 0
mov ecx, 2
lea edx, [ebp - 0x7c8]
mov eax, edi
call fcn.610620e0
jmp 0x61066f2e
call sym.cygwin1.dll___errno
mov dword [eax], 0x5b
jmp 0x61066e7c