Function at 0x569ac4
Capabilities:
Create process on windows
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x35
push 0
push 0
dec ecx
jne 0x569acc
push ecx
push ebx
push esi
push edi
mov byte [ebp - 0x171], dl
mov esi, eax
lea eax, [ebp - 0x170]
mov edx, dword [0x40911c]
call fcn.0040629c
xor eax, eax
push ebp
push 0x569f7c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 0x171], 0
jne 0x569b4c
lea eax, [ebp - 4]
call fcn.0051356c
test al, al
jne 0x569b22
mov eax, 0x569f94
call fcn.0044af4c
jmp 0x569f40
mov eax, dword [0x596d98]
cmp byte [eax], 0
jne 0x569b4c
push 0
push 0
movzx ecx, word [0x569fc4]
xor edx, edx
mov eax, 0x569fd0
call fcn.0044adf0
cmp eax, 7
je 0x569f40
lea eax, [ebp - 0xc]
mov edx, 0x56a028
call fcn.004057e0
lea eax, [ebp - 8]
mov edx, 0x56a038
call fcn.004057e0
lea eax, [ebp - 4]
call fcn.00512268
lea eax, [ebp - 0xc]
mov edx, 0x56a054
call fcn.00405a24
mov eax, dword [esi + 0x3a0]
add eax, 0xe4
mov edx, 0x56a060
call fcn.0040579c
lea edx, [ebp - 0x184]
mov eax, 0x3db
call fcn.0040a6d4
mov ecx, dword [ebp - 0x184]
mov eax, dword [esi + 0x3a0]
add eax, 0xd8
mov edx, 0x56a074
call fcn.00405a68
mov ebx, dword [esi + 0x3a0]
push dword [ebx + 0xe4]
push 0x56a084
push dword [ebp - 0xc]
lea eax, [ebx + 0xe4]
mov edx, 3
call fcn.00405adc
lea eax, [ebp - 0x188]
mov ecx, dword [ebp - 0xc]
mov edx, 0x56a090
call fcn.00405a68
mov edx, dword [ebp - 0x188]
mov eax, dword [esi + 0x3a0]
mov ecx, dword [eax]
call dword [ecx + 0x90]
mov eax, dword [esi + 0x3a0]
mov edx, 0x2710
call fcn.004a362c
mov eax, dword [esi + 0x3a0]
mov edx, dword [eax]
call dword [edx + 0x9c]
mov eax, dword [esi + 0x3a0]
mov edx, dword [eax]
call dword [edx + 0x64]
test al, al
je 0x569f20
mov eax, dword [esi + 0x3a0]
mov edx, 0x56a0a0
call fcn.004c6d90
mov eax, dword [esi + 0x3a0]
mov edx, dword [ebp - 8]
call fcn.004c6e10
mov dword [0x6c5abc], eax
cmp dword [0x6c5abc], 0xffffffff
jne 0x569c7d
mov eax, dword [esi + 0x3a0]
call fcn.004c66d0
mov eax, 0x56a0ac
call fcn.0044af4c
jmp 0x569f40
cmp dword [0x6c5abc], 0
jg 0x569c90
mov dword [0x6c5abc], 0x20e1f8
xor edx, edx
push ebp
push 0x569cd3
push dword fs:[edx]
mov dword fs:[edx], esp
push 1
push 0
lea eax, [ebp - 0x18c]
mov ecx, 0x56a0dc
mov edx, dword [ebp - 4]
call fcn.00405a68
mov ecx, dword [ebp - 0x18c]
mov eax, dword [esi + 0x3a0]
mov edx, dword [ebp - 8]
call fcn.004c588c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x569d21
mov eax, dword [esi + 0x3a0]
call fcn.004c66d0
mov word [0x6c5a8e], 0
call fcn.0040cf0c
fstp qword [ebp - 0x180]
wait
push dword [ebp - 0x17c]
push dword [ebp - 0x180]
mov edx, dword [0x596e94]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
call fcn.0040db6c
mov eax, 0x6c5a98
mov edx, dword [ebp - 0x10]
call fcn.0040579c
mov eax, dword [0x597338]
mov eax, dword [eax]
mov eax, dword [eax + 0x368]
mov edx, 0x56a144
call fcn.0045a018
mov eax, dword [0x597338]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x8c]
lea eax, [ebp - 0x194]
mov ecx, 0x56a0dc
mov edx, dword [ebp - 4]
call fcn.00405a68
mov eax, dword [ebp - 0x194]
mov edx, dword [0x596d24]
mov edx, dword [edx]
call fcn.0053dc70
lea eax, [ebp - 0x198]
mov ecx, 0x56a16c
mov edx, dword [ebp - 4]
call fcn.00405a68
mov eax, dword [ebp - 0x198]
call fcn.00405c1c
push eax
lea eax, [ebp - 0x19c]
mov ecx, 0x56a0dc
mov edx, dword [ebp - 4]
call fcn.00405a68
mov eax, dword [ebp - 0x19c]
call fcn.00405c1c
push eax
call sub.kernel32.dll_MoveFileA
cmp byte [0x6c58f1], 0
je 0x569e1e
push 0x56a184
push 0x56a1a8
mov eax, dword [0x596b40]
mov eax, dword [eax]
mov cl, 1
mov dl, 1
call fcn.0053c644
jmp 0x569e38
push 0x56a1bc
push 0x56a1e0
mov eax, dword [0x596b40]
mov eax, dword [eax]
mov cl, 1
mov dl, 1
call fcn.0053c644
cmp byte [ebp - 0x171], 0
jne 0x569e88
lea eax, [ebp - 0x1a0]
mov ecx, 0x56a16c
mov edx, dword [ebp - 4]
call fcn.00405a68
mov eax, dword [ebp - 0x1a0]
lea ecx, [ebp - 0x170]
mov edx, 0x3f
call fcn.0040aea8
test eax, eax
je 0x569e88
push 0
movzx ecx, word [0x56a1f0]
mov dl, 2
mov eax, 0x56a1fc
call fcn.0044add0
jmp 0x569f40
mov byte [0x6c5916], 1
mov eax, esi
call fcn.0056ff44
movzx eax, byte [0x6c58fb]
and al, byte [0x6c58f1]
je 0x569ef3
push 0x56a348
mov eax, dword [0x59724c]
push dword [eax]
push 0x56a35c
lea eax, [ebp - 0x1a4]
mov edx, 3
call fcn.00405adc
mov eax, dword [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x1a8]
mov ecx, 0x56a16c
mov edx, dword [ebp - 4]
call fcn.00405a68
mov eax, dword [ebp - 0x1a8]
mov edx, 0x56a36c
pop ecx
call fcn.005124f4
jmp 0x569f40
push 5
lea eax, [ebp - 0x1ac]
mov ecx, 0x56a16c
mov edx, dword [ebp - 4]
call fcn.00405a68
mov eax, dword [ebp - 0x1ac]
call fcn.00405c1c
push eax
call sub.kernel32.dll_WinExec
call fcn.00405580
jmp 0x569f40
push 0
movzx ecx, word [0x56a1f0]
mov dl, 2
mov eax, 0x56a384
call fcn.0044add0
mov eax, dword [esi + 0x3a0]
call fcn.004c66d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x569f83
lea eax, [ebp - 0x1ac]
mov edx, 0xb
call fcn.0040576c
lea eax, [ebp - 0x170]
mov edx, dword [0x40911c]
call fcn.0040636c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040576c
ret