Function at 0x512cf4
Capabilities:
Copy file
Create process on windows
Delete file
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x61
push 0
push 0
dec ecx
jne 0x512cfc
push ebx
push esi
push edi
mov esi, dword [0x523c7c]
mov edi, dword [0x523b04]
xor eax, eax
push ebp
push 0x512fd6
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [esi]
mov edx, dword [edi]
lea eax, [ebp - 0x1d4]
call fcn.0040577c
mov eax, dword [ebp - 0x1d4]
call fcn.00512c74
test al, al
je 0x512dcd
mov edx, dword [esi]
mov eax, 0x512fec
call fcn.00405a40
test eax, eax
jle 0x512d6e
push esi
mov edx, dword [esi]
mov eax, 0x512fec
call fcn.00405a40
mov ecx, eax
dec ecx
mov eax, dword [esi]
mov edx, 1
call fcn.0040595c
xor ebx, ebx
push dword [edi]
push dword [esi]
lea edx, [ebp - 0x1d8]
mov eax, ebx
call fcn.0040c938
push dword [ebp - 0x1d8]
push 0x512ff8
lea eax, [ebp - 4]
mov edx, 4
call fcn.004057f8
mov eax, dword [ebp - 4]
call fcn.0040d070
test al, al
jne 0x512d70
push dword [esi]
lea edx, [ebp - 0x1dc]
mov eax, ebx
call fcn.0040c938
push dword [ebp - 0x1dc]
push 0x512ff8
mov eax, esi
mov edx, 3
call fcn.004057f8
jmp 0x512e1b
mov ecx, dword [esi]
mov edx, dword [edi]
lea eax, [ebp - 0x1e0]
call fcn.0040577c
mov eax, dword [ebp - 0x1e0]
xor edx, edx
call fcn.0040d26c
mov ecx, dword [esi]
mov edx, dword [edi]
lea eax, [ebp - 0x1e4]
call fcn.0040577c
mov ebx, dword [ebp - 0x1e4]
mov dword [ebp - 0x1e8], ebx
mov eax, dword [ebp - 0x1e8]
call fcn.004058f4
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
push 0xffffffffffffffff
mov ecx, dword [esi]
mov edx, dword [edi]
lea eax, [ebp - 0x1ec]
call fcn.0040577c
mov eax, dword [ebp - 0x1ec]
call fcn.004058f4
push eax
lea edx, [ebp - 0x1f0]
mov eax, dword [0x523ac4]
mov eax, dword [eax]
call fcn.00475b48
mov eax, dword [ebp - 0x1f0]
call fcn.004058f4
push eax
call sub.kernel32.dll_CopyFileA
mov edx, 0x513008
lea eax, [ebp - 0x1d0]
call fcn.00403a98
lea eax, [ebp - 0x1d0]
call fcn.00403828
call fcn.00403340
mov edx, 0x51301c
lea eax, [ebp - 0x1d0]
call fcn.00405c14
call fcn.00403f88
call fcn.00403340
push 0x513034
lea edx, [ebp - 0x304]
xor eax, eax
call fcn.004036f0
mov eax, dword [ebp - 0x304]
call fcn.004058f4
mov edx, eax
lea eax, [ebp - 0x300]
call fcn.00403fd0
lea edx, [ebp - 0x300]
lea eax, [ebp - 0x200]
call fcn.004056c8
push dword [ebp - 0x200]
push 0x513034
lea eax, [ebp - 0x1fc]
mov edx, 3
call fcn.004057f8
mov eax, dword [ebp - 0x1fc]
call fcn.004058f4
mov edx, eax
lea eax, [ebp - 0x1f8]
call fcn.0040565c
mov ecx, dword [ebp - 0x1f8]
lea eax, [ebp - 0x1f4]
mov edx, 0x513040
call fcn.0040577c
mov edx, dword [ebp - 0x1f4]
lea eax, [ebp - 0x1d0]
call fcn.00405c14
call fcn.00403f88
call fcn.00403340
mov edx, 0x513050
lea eax, [ebp - 0x1d0]
call fcn.00405c14
call fcn.00403f88
call fcn.00403340
lea eax, [ebp - 0x1d0]
call fcn.00403b60
call fcn.00403340
push 0
push 0x513058
call sub.kernel32.dll_WinExec
mov ecx, dword [esi]
mov edx, dword [edi]
lea eax, [ebp - 0x308]
call fcn.0040577c
mov eax, dword [ebp - 0x308]
call fcn.00512bbc
mov eax, dword [0x523ac4]
mov eax, dword [eax]
call fcn.004754e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x512fdd
lea eax, [ebp - 0x308]
mov edx, 2
call fcn.00405488
lea eax, [ebp - 0x200]
mov edx, 6
call fcn.00405488
lea eax, [ebp - 0x1e4]
mov edx, 5
call fcn.00405488
lea eax, [ebp - 4]
call fcn.00405464
ret