Function at 0x568988
Capabilities:
Copy file
Create process on windows
Delete file
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x61
push 0
push 0
dec ecx
jne 0x568990
push ebx
push esi
push edi
mov esi, dword [0x59a6fc]
mov edi, dword [0x59a55c]
xor eax, eax
push ebp
push 0x568c6a
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [esi]
mov edx, dword [edi]
lea eax, [ebp - 0x1d4]
call fcn.004056ec
mov eax, dword [ebp - 0x1d4]
call fcn.00568908
test al, al
je 0x568a61
mov edx, dword [esi]
mov eax, 0x568c80
call fcn.004059b0
test eax, eax
jle 0x568a02
push esi
mov edx, dword [esi]
mov eax, 0x568c80
call fcn.004059b0
mov ecx, eax
dec ecx
mov eax, dword [esi]
mov edx, 1
call fcn.004058cc
xor ebx, ebx
push dword [edi]
push dword [esi]
lea edx, [ebp - 0x1d8]
mov eax, ebx
call fcn.0040a76c
push dword [ebp - 0x1d8]
push 0x568c8c
lea eax, [ebp - 4]
mov edx, 4
call fcn.00405768
mov eax, dword [ebp - 4]
call fcn.0040ae60
test al, al
jne 0x568a04
push dword [esi]
lea edx, [ebp - 0x1dc]
mov eax, ebx
call fcn.0040a76c
push dword [ebp - 0x1dc]
push 0x568c8c
mov eax, esi
mov edx, 3
call fcn.00405768
jmp 0x568aaf
mov ecx, dword [esi]
mov edx, dword [edi]
lea eax, [ebp - 0x1e0]
call fcn.004056ec
mov eax, dword [ebp - 0x1e0]
xor edx, edx
call fcn.0040b05c
mov ecx, dword [esi]
mov edx, dword [edi]
lea eax, [ebp - 0x1e4]
call fcn.004056ec
mov ebx, dword [ebp - 0x1e4]
mov dword [ebp - 0x1e8], ebx
mov eax, dword [ebp - 0x1e8]
call fcn.00405864
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
push 0xffffffffffffffff
mov ecx, dword [esi]
mov edx, dword [edi]
lea eax, [ebp - 0x1ec]
call fcn.004056ec
mov eax, dword [ebp - 0x1ec]
call fcn.00405864
push eax
lea edx, [ebp - 0x1f0]
mov eax, dword [0x59a524]
mov eax, dword [eax]
call fcn.00476ab8
mov eax, dword [ebp - 0x1f0]
call fcn.00405864
push eax
call sub.kernel32.dll_CopyFileA
mov edx, 0x568c9c
lea eax, [ebp - 0x1d0]
call fcn.00403904
lea eax, [ebp - 0x1d0]
call fcn.004036a0
call fcn.00403110
mov edx, 0x568cb0
lea eax, [ebp - 0x1d0]
call fcn.00405b84
call fcn.00403df4
call fcn.00403110
push 0x568cc8
lea edx, [ebp - 0x304]
xor eax, eax
call fcn.004034ec
mov eax, dword [ebp - 0x304]
call fcn.00405864
mov edx, eax
lea eax, [ebp - 0x300]
call fcn.00403e3c
lea edx, [ebp - 0x300]
lea eax, [ebp - 0x200]
call fcn.00405638
push dword [ebp - 0x200]
push 0x568cc8
lea eax, [ebp - 0x1fc]
mov edx, 3
call fcn.00405768
mov eax, dword [ebp - 0x1fc]
call fcn.00405864
mov edx, eax
lea eax, [ebp - 0x1f8]
call fcn.004055cc
mov ecx, dword [ebp - 0x1f8]
lea eax, [ebp - 0x1f4]
mov edx, 0x568cd4
call fcn.004056ec
mov edx, dword [ebp - 0x1f4]
lea eax, [ebp - 0x1d0]
call fcn.00405b84
call fcn.00403df4
call fcn.00403110
mov edx, 0x568ce4
lea eax, [ebp - 0x1d0]
call fcn.00405b84
call fcn.00403df4
call fcn.00403110
lea eax, [ebp - 0x1d0]
call fcn.004039cc
call fcn.00403110
push 0
push 0x568cec
call sub.kernel32.dll_WinExec
mov ecx, dword [esi]
mov edx, dword [edi]
lea eax, [ebp - 0x308]
call fcn.004056ec
mov eax, dword [ebp - 0x308]
call fcn.00568850
mov eax, dword [0x59a524]
mov eax, dword [eax]
call fcn.00476450
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x568c71
lea eax, [ebp - 0x308]
mov edx, 2
call fcn.004053f8
lea eax, [ebp - 0x200]
mov edx, 6
call fcn.004053f8
lea eax, [ebp - 0x1e4]
mov edx, 5
call fcn.004053f8
lea eax, [ebp - 4]
call fcn.004053d4
ret