Function at 0x561518
Capabilities:
Copy file
Create process on windows
Delete file
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xd
push 0
push 0
dec ecx
jne 0x561520
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x561c48
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5834f4]
cmp byte [eax], 0
je 0x5617ff
mov eax, dword [0x583f5c]
mov eax, dword [eax]
call fcn.00483bcc
mov eax, dword [esi + 0x360]
mov eax, dword [eax + 0x2b4]
call fcn.004bf254
mov eax, dword [esi + 0x360]
mov eax, dword [eax + 0x68]
mov edx, 0xff00
call fcn.0042d2d4
xor edx, edx
mov eax, dword [esi + 0x360]
call fcn.00458300
push 0
mov eax, dword [esi + 0x360]
mov eax, dword [eax + 0x2b4]
mov ecx, 0x561c60
xor edx, edx
call fcn.004bf320
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x10]
mov edx, dword [0x583710]
add edx, 0x2bc
call fcn.00405848
mov ecx, dword [ebp - 0x10]
mov edx, dword [0x583774]
mov edx, dword [edx]
lea eax, [ebp - 8]
call fcn.004058fc
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0040d74c
mov eax, dword [ebp - 8]
call fcn.00405a74
push eax
call sub.kernel32.dll_DeleteFileA
push 0xa
call sub.kernel32.dll_Sleep_2
mov edx, dword [0x583774]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x561c80
call fcn.004058fc
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x429014]
call fcn.004290cc
mov ebx, eax
push 1
mov ecx, 0x561c98
mov edx, 0x561cb0
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
call fcn.004046a4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dl, 1
mov eax, dword [0x41c054]
call fcn.00404674
mov ebx, eax
mov eax, dword [0x583cc4]
mov eax, dword [eax]
cmp dword [eax + 0xc], 5
jle 0x5616ab
mov edx, 0x561cc4
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x561cd8
mov eax, dword [0x583608]
push dword [eax]
push 0x561ce8
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405978
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x5616df
mov edx, 0x561cf4
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x561cd8
mov eax, dword [0x583608]
push dword [eax]
push 0x561ce8
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405978
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x561d18
mov eax, dword [0x583ca4]
push dword [eax]
push 0x561d28
mov eax, dword [0x583608]
push dword [eax]
push 0x561d34
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00405978
mov edx, dword [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x561cd8
mov eax, dword [0x583ca4]
push dword [eax]
push 0x561ce8
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00405978
mov edx, dword [ebp - 0x20]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x561d44
mov eax, dword [0x583608]
push dword [eax]
push 0x561ce8
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00405978
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x561d58
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 4]
mov eax, ebx
call fcn.005612b0
mov eax, ebx
call fcn.004046a4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
lea edx, [ebp - 0x2c]
mov eax, dword [0x583cb8]
mov eax, dword [eax]
call fcn.00477518
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.0040d9a4
mov eax, dword [ebp - 0x28]
call fcn.00405a74
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405a74
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [0x583cb8]
mov eax, dword [eax]
call fcn.00476eb0
jmp 0x561c20
mov eax, dword [0x5838dc]
cmp byte [eax], 0
je 0x561c20
mov eax, dword [0x583f5c]
mov eax, dword [eax]
call fcn.00483bcc
mov eax, dword [esi + 0x360]
mov eax, dword [eax + 0x2b4]
call fcn.004bf254
mov eax, dword [esi + 0x360]
mov eax, dword [eax + 0x68]
mov edx, 0xff00
call fcn.0042d2d4
xor edx, edx
mov eax, dword [esi + 0x360]
call fcn.00458300
push 0
mov eax, dword [esi + 0x360]
mov eax, dword [eax + 0x2b4]
mov ecx, 0x561c60
xor edx, edx
call fcn.004bf320
lea eax, [ebp - 0xc]
call fcn.005610b8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0xc]
call fcn.0040d9a4
mov eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
mov edx, dword [0x583710]
add edx, 0x2bc
call fcn.00405848
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 8]
pop edx
call fcn.004058fc
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0040d74c
mov eax, dword [ebp - 8]
call fcn.00405a74
push eax
call sub.kernel32.dll_DeleteFileA
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.0040d9a4
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 8]
mov ecx, 0x561c80
call fcn.004058fc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x429014]
call fcn.004290cc
mov ebx, eax
push 1
mov ecx, 0x561c98
mov edx, 0x561cb0
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, ebx
call fcn.004046a4
push 0xa
call sub.kernel32.dll_Sleep_2
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.0040d9a4
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 8]
mov ecx, 0x561d68
call fcn.004058fc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x429014]
call fcn.004290cc
mov ebx, eax
mov eax, dword [0x583ca4]
mov eax, dword [eax]
push eax
mov ecx, 0x561d80
mov edx, 0x561cb0
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 4]
mov eax, ebx
call fcn.004046a4
mov ebx, dword [0x583608]
mov ebx, dword [ebx]
mov dword [ebp - 0x40], ebx
mov eax, dword [ebp - 0x40]
call fcn.00405a74
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov eax, dword [0x583608]
mov eax, dword [eax]
call fcn.0040d52c
test al, al
jne 0x5619d2
lea eax, [ebp - 0xc]
mov edx, dword [0x583608]
mov edx, dword [edx]
call fcn.0040567c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
call fcn.00405a74
push eax
mov eax, dword [0x583ca4]
mov eax, dword [eax]
call fcn.00405a74
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x561c0f
mov eax, dword [0x583cb8]
mov eax, dword [eax]
call fcn.00476b44
mov eax, dword [0x583608]
mov eax, dword [eax]
call fcn.00405a74
mov edx, eax
lea eax, [ebp - 0x44]
call fcn.004057dc
mov eax, dword [ebp - 0x44]
mov edx, 1
call fcn.00560fcc
mov eax, dword [0x583cb8]
mov eax, dword [eax]
call fcn.00476eb0
jmp 0x561c20
mov eax, esi
call fcn.004602f0
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0056116c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x561c4f
lea eax, [ebp - 0x68]
mov edx, 0xa
call fcn.00405608
lea eax, [ebp - 0x3c]
mov edx, 0xf
call fcn.00405608
ret