Function at 0x546f10
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb84
push ebx
xor edx, edx
mov dword [ebp - 0x47c], edx
mov dword [ebp - 0x478], edx
mov dword [ebp - 0x474], edx
mov dword [ebp - 0x470], edx
mov dword [ebp - 0x46c], edx
mov dword [ebp - 0x468], edx
mov dword [ebp - 0x464], edx
mov dword [ebp - 0x460], edx
mov dword [ebp - 0x45c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405d78
lea eax, [ebp - 0x168]
mov edx, dword [0x409290]
call fcn.00406408
mov ebx, 0x5a8854
xor eax, eax
push ebp
push 0x5474fb
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x168]
mov edx, 0x3f
mov eax, dword [ebp - 4]
call fcn.0040b01c
lea eax, [ebp - 0x168]
call fcn.0040b090
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x2b4]
call fcn.0040367c
mov edx, 0xb5b
lea eax, [ebp - 0x2b4]
call fcn.00403cfc
call fcn.00402f48
mov al, 1
call fcn.0058bc94
mov al, 1
call fcn.0058ace8
mov edx, dword [0x5a27d0]
mov edx, dword [edx]
lea eax, [ebp - 0x2b4]
call fcn.00403ba8
mov eax, ebx
mov edx, dword [0x5a27d0]
mov edx, dword [edx]
call fcn.00405b28
mov al, 1
call fcn.0058bc94
lea eax, [ebp - 0x2b4]
call fcn.004037fc
mov eax, dword [ebx]
mov edx, 0x547510
call fcn.00405cd4
jne 0x54717e
mov eax, 0x547528
call fcn.0044b124
lea eax, [ebp - 0x45c]
call fcn.005149b4
push dword [ebp - 0x45c]
push dword [ebx]
push 0x547640
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405c48
lea ecx, [ebp - 0x168]
mov edx, 0x3f
mov eax, dword [ebp - 8]
call fcn.0040b01c
test eax, eax
jne 0x5470ad
mov eax, dword [0x5a287c]
mov eax, dword [eax]
mov edx, dword [0x5a281c]
mov edx, dword [edx]
call fcn.00405cd4
jne 0x5470ad
push 5
push dword [ebp - 8]
push 0x547650
push dword [ebp - 4]
push 0x54765c
lea eax, [ebp - 0x460]
mov edx, 4
call fcn.00405c48
mov eax, dword [ebp - 0x460]
call fcn.00405d88
push eax
call sub.kernel32.dll_WinExec
jmp 0x54716e
lea eax, [ebp - 0x168]
call fcn.0040b090
mov eax, dword [ebp - 8]
call fcn.00405d88
push eax
call sub.kernel32.dll_DeleteFileA
push 0
push 0
push 1
push 1
mov eax, dword [0x5a3218]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov edx, 0x547668
call fcn.00538d10
test al, al
je 0x5474bf
mov edx, dword [0x5a2900]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
call fcn.0053ab94
lea ecx, [ebp - 0x168]
mov edx, 0x3f
mov eax, dword [ebp - 8]
call fcn.0040b01c
test eax, eax
jne 0x547164
mov eax, dword [0x5a287c]
mov edx, dword [0x5a281c]
mov edx, dword [edx]
call fcn.00405908
mov eax, dword [0x5a30e4]
mov eax, dword [eax]
call fcn.0057a3d0
push 5
push dword [ebp - 8]
push 0x547650
push dword [ebp - 4]
push 0x54765c
lea eax, [ebp - 0x464]
mov edx, 4
call fcn.00405c48
mov eax, dword [ebp - 0x464]
call fcn.00405d88
push eax
call sub.kernel32.dll_WinExec
jmp 0x54716e
mov eax, 0x5476b0
call fcn.0044b124
lea eax, [ebp - 0x168]
call fcn.0040b090
call fcn.004056ec
mov eax, dword [ebx]
mov edx, 0x547714
call fcn.00405cd4
jne 0x5472f5
mov eax, 0x54772c
call fcn.0044b124
lea eax, [ebp - 0x468]
call fcn.005149b4
push dword [ebp - 0x468]
push dword [ebx]
push 0x547640
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405c48
lea ecx, [ebp - 0x168]
mov edx, 0x3f
mov eax, dword [ebp - 8]
call fcn.0040b01c
test eax, eax
jne 0x547224
mov eax, dword [0x5a2ffc]
mov eax, dword [eax]
mov edx, dword [0x5a2fd0]
mov edx, dword [edx]
call fcn.00405cd4
jne 0x547224
push 5
push dword [ebp - 8]
push 0x547650
push dword [ebp - 4]
push 0x54765c
lea eax, [ebp - 0x46c]
mov edx, 4
call fcn.00405c48
mov eax, dword [ebp - 0x46c]
call fcn.00405d88
push eax
call sub.kernel32.dll_WinExec
jmp 0x5472e5
lea eax, [ebp - 0x168]
call fcn.0040b090
mov eax, dword [ebp - 8]
call fcn.00405d88
push eax
call sub.kernel32.dll_DeleteFileA
push 0
push 0
push 1
push 1
mov eax, dword [0x5a3218]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov edx, 0x54783c
call fcn.00538d10
test al, al
je 0x5474bf
mov edx, dword [0x5a2900]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
call fcn.0053ab94
lea ecx, [ebp - 0x168]
mov edx, 0x3f
mov eax, dword [ebp - 8]
call fcn.0040b01c
test eax, eax
jne 0x5472db
mov eax, dword [0x5a2ffc]
mov edx, dword [0x5a2fd0]
mov edx, dword [edx]
call fcn.00405908
mov eax, dword [0x5a30e4]
mov eax, dword [eax]
call fcn.0057a3d0
push 5
push dword [ebp - 8]
push 0x547650
push dword [ebp - 4]
push 0x54765c
lea eax, [ebp - 0x470]
mov edx, 4
call fcn.00405c48
mov eax, dword [ebp - 0x470]
call fcn.00405d88
push eax
call sub.kernel32.dll_WinExec
jmp 0x5472e5
mov eax, 0x547884
call fcn.0044b124
lea eax, [ebp - 0x168]
call fcn.0040b090
call fcn.004056ec
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x400]
call fcn.0040367c
mov edx, 0x56
lea eax, [ebp - 0x400]
call fcn.00403cfc
call fcn.00402f48
lea edx, [ebp - 0x456]
lea eax, [ebp - 0x400]
call fcn.00403ba8
mov eax, ebx
lea edx, [ebp - 0x429]
call fcn.00405b28
lea eax, [ebp - 0x400]
call fcn.004037fc
mov eax, dword [ebx]
mov edx, 0x5478dc
call fcn.00405cd4
jne 0x5474ae
lea eax, [ebp - 0x474]
call fcn.005149b4
push dword [ebp - 0x474]
push dword [ebx]
push 0x547640
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405c48
lea ecx, [ebp - 0x168]
mov edx, 0x3f
mov eax, dword [ebp - 8]
call fcn.0040b01c
test eax, eax
jne 0x5473dd
mov eax, dword [0x5a2e14]
mov eax, dword [eax]
mov edx, dword [0x5a2dcc]
mov edx, dword [edx]
call fcn.00405cd4
jne 0x5473dd
push 5
push dword [ebp - 8]
push 0x547650
push dword [ebp - 4]
push 0x54765c
lea eax, [ebp - 0x478]
mov edx, 4
call fcn.00405c48
mov eax, dword [ebp - 0x478]
call fcn.00405d88
push eax
call sub.kernel32.dll_WinExec
jmp 0x54749e
mov eax, dword [ebp - 8]
call fcn.00405d88
push eax
call sub.kernel32.dll_DeleteFileA
push 0
push 0
push 1
push 1
mov eax, dword [0x5a3218]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov edx, 0x5478f4
call fcn.00538d10
test al, al
je 0x5474bf
mov edx, dword [0x5a2900]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
call fcn.0053ab94
lea eax, [ebp - 0x168]
call fcn.0040b090
lea ecx, [ebp - 0x168]
mov edx, 0x3f
mov eax, dword [ebp - 8]
call fcn.0040b01c
test eax, eax
jne 0x547494
mov eax, dword [0x5a2e14]
mov edx, dword [0x5a2dcc]
mov edx, dword [edx]
call fcn.00405908
mov eax, dword [0x5a30e4]
mov eax, dword [eax]
call fcn.0057a3d0
push 5
push dword [ebp - 8]
push 0x547650
push dword [ebp - 4]
push 0x54765c
lea eax, [ebp - 0x47c]
mov edx, 4
call fcn.00405c48
mov eax, dword [ebp - 0x47c]
call fcn.00405d88
push eax
call sub.kernel32.dll_WinExec
jmp 0x54749e
mov eax, 0x547884
call fcn.0044b124
lea eax, [ebp - 0x168]
call fcn.0040b090
call fcn.004056ec
mov eax, 0x54793c
call fcn.0044b124
mov al, 1
call fcn.0058ace8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x547502
lea eax, [ebp - 0x47c]
mov edx, 9
call fcn.004058d8
lea eax, [ebp - 0x168]
mov edx, dword [0x409290]
call fcn.004064d8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004058d8
ret