Function at 0x563bb0
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x56
push 0
push 0
dec ecx
jne 0x563bb9
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.00405860
xor eax, eax
push ebp
push 0x564236
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov edx, 0x564248
lea eax, [ebp - 0x58]
call fcn.00403a60
mov eax, dword [ebp - 8]
mov edx, eax
lea eax, [ebp - 0x58]
mov cl, 0x45
call fcn.00403a30
lea edx, [ebp - 0x58]
lea eax, [ebp - 0x10]
call fcn.00405644
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.005644f4
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00563030
mov eax, dword [ebp - 4]
push eax
push 0x5644b8
lea ecx, [ebp - 0x6c]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00561d6c
lea eax, [ebp - 0x6c]
lea edx, [ebp - 0x5c]
call fcn.00561cc4
mov eax, dword [ebp - 0x5c]
push eax
lea eax, [ebp - 0x70]
mov edx, dword [ebp - 8]
add edx, 0x23a
call fcn.00405644
mov edx, dword [ebp - 0x70]
pop eax
call fcn.0040a274
test eax, eax
je 0x563ccd
mov edx, 0x564254
lea eax, [ebp - 0xb8]
call fcn.00403a60
mov eax, dword [ebp - 8]
mov edx, eax
lea eax, [ebp - 0xb8]
mov cl, 0x41
call fcn.00403a30
lea edx, [ebp - 0xb8]
lea eax, [ebp - 0x104]
call fcn.00403a60
mov edx, 0x56425c
lea eax, [ebp - 0x104]
mov cl, 0x49
call fcn.00403a30
lea edx, [ebp - 0x104]
lea eax, [ebp - 0x74]
call fcn.00405644
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 4]
call fcn.005644f4
xor ebx, ebx
jmp 0x5641d0
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 0x25b]
dec al
je 0x563ce8
sub al, 2
je 0x563e41
jmp 0x5641aa
mov eax, dword [ebp - 8]
cmp byte [eax + 0x130], 0
je 0x563d89
push ebp
lea eax, [ebp - 0x108]
mov edx, dword [ebp - 8]
add edx, 0x3d
call fcn.00405644
mov eax, dword [ebp - 0x108]
call fcn.00563a10
pop ecx
mov ebx, eax
test bl, bl
jne 0x5641aa
mov edx, 0x564268
lea eax, [ebp - 0x150]
call fcn.00403a60
mov eax, dword [ebp - 8]
mov edx, eax
lea eax, [ebp - 0x150]
mov cl, 0x43
call fcn.00403a30
lea edx, [ebp - 0x150]
lea eax, [ebp - 0x19c]
call fcn.00403a60
mov edx, 0x564270
lea eax, [ebp - 0x19c]
mov cl, 0x4a
call fcn.00403a30
lea edx, [ebp - 0x19c]
lea eax, [ebp - 0x10c]
call fcn.00405644
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 4]
call fcn.005644f4
jmp 0x5641aa
push ebp
mov eax, dword [ebp - 8]
lea edx, [eax + 0x3d]
lea eax, [ebp - 0x230]
call fcn.00403a60
mov eax, dword [ebp - 8]
lea edx, [eax + 0xa2]
lea eax, [ebp - 0x230]
mov cl, 0x8c
call fcn.00403a30
lea edx, [ebp - 0x230]
lea eax, [ebp - 0x1a0]
call fcn.00405644
mov eax, dword [ebp - 0x1a0]
call fcn.00563b24
pop ecx
test al, al
jne 0x5641aa
xor ebx, ebx
mov edx, 0x564278
lea eax, [ebp - 0xb8]
call fcn.00403a60
mov eax, dword [ebp - 8]
mov edx, eax
lea eax, [ebp - 0xb8]
mov cl, 0x41
call fcn.00403a30
lea edx, [ebp - 0xb8]
lea eax, [ebp - 0x280]
call fcn.00403a60
mov edx, 0x564280
lea eax, [ebp - 0x280]
mov cl, 0x48
call fcn.00403a30
lea edx, [ebp - 0x280]
lea eax, [ebp - 0x234]
call fcn.00405644
mov edx, dword [ebp - 0x234]
mov eax, dword [ebp - 4]
call fcn.005644f4
jmp 0x5641aa
lea eax, [ebp - 0x284]
mov edx, dword [ebp - 8]
add edx, 0xa2
call fcn.00405644
mov eax, dword [ebp - 0x284]
mov edx, 0x564290
call fcn.0040a274
test eax, eax
jne 0x563ebd
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x563e75
sub eax, 4
mov eax, dword [eax]
inc eax
call fcn.00402fb4
mov esi, eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x563e89
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0xc]
call fcn.004058d0
lea ecx, [ebx + 1]
mov edx, esi
call fcn.004032f0
push esi
push 0
push 0x7eb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
push eax
call sub.user32.dll_SendMessageA
mov eax, esi
call fcn.00402fd0
xor ebx, ebx
jmp 0x5641aa
lea eax, [ebp - 0x28c]
mov edx, dword [ebp - 8]
add edx, 0xa2
call fcn.00405644
mov eax, dword [ebp - 0x28c]
lea ecx, [ebp - 0x288]
mov edx, 5
call fcn.00442490
mov eax, dword [ebp - 0x288]
mov edx, 0x5642a0
call fcn.00405808
jne 0x563f91
lea eax, [ebp - 0x294]
mov edx, dword [ebp - 8]
add edx, 0xa2
call fcn.00405644
mov eax, dword [ebp - 0x294]
lea ecx, [ebp - 0x290]
mov edx, dword [ebp - 8]
movzx edx, byte [edx + 0xa2]
sub edx, 5
call fcn.004424ac
mov edx, dword [ebp - 0x290]
mov eax, dword [0x634108]
call fcn.00405434
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x563f4b
sub eax, 4
mov eax, dword [eax]
inc eax
call fcn.00402fb4
mov esi, eax
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x563f5f
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0xc]
call fcn.004058d0
lea ecx, [edi + 1]
mov edx, esi
call fcn.004032f0
push esi
push 0
push 0x7ee
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
push eax
call sub.user32.dll_SendMessageA
mov eax, esi
call fcn.00402fd0
jmp 0x5641aa
mov eax, dword [ebp - 8]
cmp byte [eax + 0x130], 0
je 0x5640fb
push ebp
lea eax, [ebp - 0x298]
mov edx, dword [ebp - 8]
add edx, 0x3d
call fcn.00405644
mov eax, dword [ebp - 0x298]
call fcn.00563a10
pop ecx
mov ebx, eax
lea eax, [ebp - 0x29c]
mov edx, dword [ebp - 8]
add edx, 0xa2
call fcn.00405644
mov edx, dword [ebp - 0x29c]
mov eax, 0x5642b0
call fcn.004059bc
test eax, eax
jg 0x564011
lea eax, [ebp - 0x2a0]
mov edx, dword [ebp - 8]
add edx, 0xa2
call fcn.00405644
mov edx, dword [ebp - 0x2a0]
mov eax, 0x5642c0
call fcn.004059bc
test eax, eax
jle 0x56408a
mov eax, dword [ebp - 8]
lea edx, [eax + 0x3d]
lea eax, [ebp - 0x230]
call fcn.00403a60
mov eax, dword [ebp - 8]
lea edx, [eax + 0xa2]
lea eax, [ebp - 0x230]
mov cl, 0x8c
call fcn.00403a30
lea edx, [ebp - 0x230]
mov eax, dword [0x634108]
call fcn.00405644
lea eax, [ebp - 0x2a4]
mov edx, dword [ebp - 8]
add edx, 0xa2
call fcn.00405644
mov eax, dword [ebp - 0x2a4]
call fcn.00561f6c
test al, al
jne 0x56408a
push 6
push 0
push 0
mov eax, dword [0x634108]
mov eax, dword [eax]
call fcn.00405870
push eax
push 0x5642c8
push 0
call sub.shell32.dll_ShellExecuteA
test bl, bl
jne 0x5641aa
mov edx, 0x564268
lea eax, [ebp - 0x150]
call fcn.00403a60
mov eax, dword [ebp - 8]
mov edx, eax
lea eax, [ebp - 0x150]
mov cl, 0x43
call fcn.00403a30
lea edx, [ebp - 0x150]
lea eax, [ebp - 0x19c]
call fcn.00403a60
mov edx, 0x564270
lea eax, [ebp - 0x19c]
mov cl, 0x4a
call fcn.00403a30
lea edx, [ebp - 0x19c]
lea eax, [ebp - 0x2a8]
call fcn.00405644
mov edx, dword [ebp - 0x2a8]
mov eax, dword [ebp - 4]
call fcn.005644f4
jmp 0x5641aa
push ebp
mov eax, dword [ebp - 8]
lea edx, [eax + 0x3d]
lea eax, [ebp - 0x230]
call fcn.00403a60
mov eax, dword [ebp - 8]
lea edx, [eax + 0xa2]
lea eax, [ebp - 0x230]
mov cl, 0x8c
call fcn.00403a30
lea edx, [ebp - 0x230]
lea eax, [ebp - 0x2ac]
call fcn.00405644
mov eax, dword [ebp - 0x2ac]
call fcn.00563b24
pop ecx
test al, al
jne 0x5641aa
xor ebx, ebx
mov edx, 0x564278
lea eax, [ebp - 0xb8]
call fcn.00403a60
mov eax, dword [ebp - 8]
mov edx, eax
lea eax, [ebp - 0xb8]
mov cl, 0x41
call fcn.00403a30
lea edx, [ebp - 0xb8]
lea eax, [ebp - 0x280]
call fcn.00403a60
mov edx, 0x564280
lea eax, [ebp - 0x280]
mov cl, 0x48
call fcn.00403a30
lea edx, [ebp - 0x280]
lea eax, [ebp - 0x2b0]
call fcn.00405644
mov edx, dword [ebp - 0x2b0]
mov eax, dword [ebp - 4]
call fcn.005644f4
mov eax, dword [ebp - 0xc]
call fcn.00405870
mov edx, eax
lea eax, [ebp - 0x2b4]
call fcn.004055d8
mov eax, dword [ebp - 0x2b4]
call fcn.00405870
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56423d
lea eax, [ebp - 0x2b4]
mov edx, 0xd
call fcn.00405404
lea eax, [ebp - 0x234]
call fcn.004053e0
lea eax, [ebp - 0x1a0]
call fcn.004053e0
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.00405404
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00405404
lea eax, [ebp - 0x5c]
call fcn.004053e0
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405404
ret