Function at 0x1000590c
Capabilities:
Copy file
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x10
push 0
push 0
dec ecx
jne 0x10005914
push ebx
push esi
push edi
mov eax, 0x100058b4
call fcn.10003ee8
xor eax, eax
push ebp
push 0x10005efc
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.100054b4
nop
nop
nop
nop
nop
mov edx, 0x10005f0c
mov eax, 0x100076bc
call fcn.10004140
nop
nop
nop
nop
nop
mov edx, 0x100076d0
mov ecx, dword [0x100076bc]
call fcn.100025bc
mov edx, 0x10007928
xor eax, eax
call fcn.100026e8
mov edi, 1
mov eax, 0x100076c8
call fcn.10003768
lea eax, [ebp - 0x14]
mov edx, 0x10007724
mov ecx, 0xd
call fcn.10003868
mov eax, dword [ebp - 0x14]
call fcn.1000427c
mov dword [0x10007740], eax
cmp byte [0x100076d3], 1
jne 0x100059d2
lea eax, [ebp - 0x1c]
mov edx, 0x100076d7
mov ecx, 0xd
call fcn.10003868
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov edx, dword [0x10007740]
call fcn.100040bc
mov eax, dword [ebp - 0x18]
call fcn.1000577c
mov eax, 0x10007920
mov edx, 0x10005f1c
call fcn.100037bc
lea eax, [ebp - 0x24]
mov edx, 0x10007717
mov ecx, 0xd
call fcn.10003868
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x20]
mov edx, dword [0x10007740]
call fcn.100040bc
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
mov edx, 0x100076e4
mov ecx, 0x33
call fcn.10003868
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
mov edx, dword [0x10007740]
call fcn.100040bc
mov edx, dword [ebp - 0x28]
mov eax, 0x100076cc
pop ecx
call fcn.100038cc
mov eax, dword [0x10007920]
call fcn.10005414
cmp eax, 1
sbb eax, eax
inc eax
cmp al, byte [0x100076d6]
sete al
cmp al, 1
jne 0x10005a83
nop
nop
nop
mov eax, dword [0x10007928]
call fcn.10003880
mov edx, eax
sub edx, 4
lea ecx, [ebp - 0x30]
mov eax, dword [0x10007928]
call fcn.1000517c
mov eax, dword [ebp - 0x30]
call fcn.10003a80
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x40]
mov edx, 0x10007731
mov ecx, 0xd
call fcn.10002eb0
lea eax, [ebp - 0x40]
mov edx, 0x10005f30
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.10002b68
jne 0x10005adb
lea eax, [ebp - 0x48]
mov edx, 0x10007717
mov ecx, 0xd
call fcn.10003868
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x44]
mov edx, dword [0x10007740]
call fcn.100040bc
mov edx, dword [ebp - 0x44]
mov eax, 0x1000792c
call fcn.100037bc
jmp 0x10005aef
mov eax, 0x1000792c
mov edx, 0x10007731
mov ecx, 0xd
call fcn.10003868
push 0x10005f3c
push dword [0x1000792c]
push 0x10005f50
mov eax, 0x10007918
mov edx, 3
call fcn.10003940
push 0x10005f58
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
push 0x10005f68
push ebx
call sub.kernel32.dll_GetProcAddress
mov dword [0x10007744], eax
mov eax, dword [0x100076cc]
call fcn.10005414
cmp eax, 1
sbb eax, eax
inc eax
cmp al, byte [0x100076d2]
je 0x10005b7d
push 0xffffffffffffffff
mov eax, dword [0x100076cc]
call fcn.10003a80
mov ebx, eax
push ebx
mov eax, dword [0x10007928]
call fcn.10003a80
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [0x10007918]
call fcn.10005414
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x10005b7d
push 0
push ebx
call sub.kernel32.dll_WinExec
cmp byte [0x100076d1], 1
jne 0x10005bb4
lea edx, [ebp - 0x4c]
mov eax, dword [0x10007928]
call fcn.10005140
mov eax, dword [ebp - 0x4c]
push eax
lea edx, [ebp - 0x50]
mov eax, dword [0x100076cc]
call fcn.10005140
mov edx, dword [ebp - 0x50]
pop eax
call fcn.100039cc
je 0x10005bb4
call fcn.100054e0
cmp byte [0x100076d2], 0
jne 0x10005bcd
mov eax, 0x100076cc
mov edx, dword [0x10007928]
call fcn.100037bc
lea edx, [ebp - 0x54]
mov eax, dword [0x10007928]
call fcn.10005140
mov eax, dword [ebp - 0x54]
push eax
lea edx, [ebp - 0x58]
mov eax, dword [0x100076cc]
call fcn.10005140
mov edx, dword [ebp - 0x58]
pop eax
call fcn.100039cc
je 0x10005bfe
push 0
call dword [0x10007744]
cmp byte [0x100076d0], 1
jne 0x10005c80
mov edx, dword [0x10007918]
mov eax, 0x1000774c
call fcn.10002a38
mov eax, 0x1000774c
call fcn.100027c8
call fcn.1000258c
push 0x10005f7c
lea edx, [ebp - 0x60]
xor eax, eax
call fcn.100026e8
push dword [ebp - 0x60]
push 0x10005f8c
lea edx, [ebp - 0x64]
mov eax, 1
call fcn.100026e8
push dword [ebp - 0x64]
lea eax, [ebp - 0x5c]
mov edx, 4
call fcn.10003940
mov edx, dword [ebp - 0x5c]
mov eax, 0x1000774c
call fcn.10003b7c
call fcn.10002e68
call fcn.1000258c
mov eax, 0x1000774c
call fcn.10002af4
call fcn.1000258c
cmp byte [0x100076d6], 1
jne 0x10005d2b
mov eax, dword [0x10007920]
call fcn.10005414
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x10005d1b
push 0
lea eax, [ebp - 0x68]
mov ecx, dword [0x10007920]
mov edx, 0x10005f98
call fcn.100038cc
mov eax, dword [ebp - 0x68]
call fcn.10003a80
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x10007918]
call fcn.10003a80
push eax
call sub.kernel32.dll_DeleteFileA
lea edx, [ebp - 0x6c]
mov eax, dword [0x10007928]
call fcn.100052fc
mov edx, dword [ebp - 0x6c]
mov eax, 0x10007924
call fcn.100037bc
push 0
lea eax, [ebp - 0x70]
mov ecx, dword [0x10007924]
mov edx, 0x10005fb0
call fcn.100038cc
mov eax, dword [ebp - 0x70]
call fcn.10003a80
push eax
call sub.kernel32.dll_WinExec
push 0
call dword [0x10007744]
jmp 0x10005d2b
mov eax, dword [0x10007920]
call fcn.10003a80
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, 0x1000791c
mov edx, 0x10005fc0
call fcn.100037bc
mov eax, dword [0x1000791c]
call fcn.10005414
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x10005d8c
cmp byte [0x100076d5], 1
jne 0x10005d8c
push 0
lea eax, [ebp - 0x74]
mov ecx, dword [0x1000791c]
mov edx, 0x10005f98
call fcn.100038cc
mov eax, dword [ebp - 0x74]
call fcn.10003a80
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x10007928]
call fcn.10005840
push 0
call dword [0x10007744]
mov esi, 5
lea edx, [ebp - 0x78]
mov eax, edi
call fcn.10004244
mov edx, dword [ebp - 0x78]
mov eax, 0x100076c8
call fcn.100037bc
mov eax, dword [0x100076c8]
call fcn.10003a80
mov edx, eax
mov eax, 0x100076c4
call fcn.10004140
mov ebx, eax
test ebx, ebx
je 0x10005e8b
mov eax, 0x100076c0
mov edx, dword [0x100076c4]
call fcn.10003b18
mov eax, 0x100076c0
call fcn.10003ad0
mov edx, eax
mov eax, ebx
mov ecx, dword [0x100076c4]
call fcn.100025bc
lea ecx, [ebp - 0x7c]
mov edx, dword [0x10007740]
mov eax, dword [0x100076c0]
call fcn.100040bc
mov edx, dword [ebp - 0x7c]
mov eax, 0x100076c0
call fcn.100037bc
lea eax, [ebp - 0x40]
mov edx, 0x10007731
mov ecx, 0xd
call fcn.10002eb0
lea eax, [ebp - 0x40]
mov edx, 0x10005f30
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.10002b68
jne 0x10005e49
mov eax, 0x10007748
mov edx, dword [0x10007928]
call fcn.100037bc
jmp 0x10005e5d
mov eax, 0x10007748
mov edx, 0x10007731
mov ecx, 0xd
call fcn.10003868
push eax
nop
push eax
pop eax
pop eax
lea edx, [ebp - 0x80]
mov eax, 1
call fcn.100026e8
mov eax, dword [ebp - 0x80]
push eax
mov eax, 0x100076c0
call fcn.10003ad0
mov edx, dword [0x10007748]
pop ecx
call fcn.100042a4
jmp 0x10005ec4
cmp byte [0x100076d4], 1
jne 0x10005ea3
call fcn.100051d0
mov eax, dword [0x10007928]
call fcn.10005258
cmp byte [0x100076d5], 1
jne 0x10005ebc
mov eax, dword [0x1000791c]
call fcn.10003a80
push eax
call sub.kernel32.dll_DeleteFileA
push 0
call dword [0x10007744]
inc edi
dec esi
jne 0x10005d91
push 0
call dword [0x10007744]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10005f03
lea eax, [ebp - 0x80]
mov edx, 0x10
call fcn.1000378c
lea eax, [ebp - 0x30]
mov edx, 8
call fcn.1000378c
ret