Function at 0x58ad50
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d3a62
mov eax, dword fs:[0]
push eax
sub esp, 0x318
mov eax, dword [0x638fe4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x248], ecx
push 0x60ab98
lea ecx, [ebp - 0x244]
mov dword [ebp - 4], 0
xor esi, esi
call fcn.00403280
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], esi
jge 0x58adbb
push 0x80070057
call fcn.00402650
cmp word [eax], 0x40
jne 0x58b1ea
mov ecx, str._None
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x58adf6
test dx, dx
je 0x58adf2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x58adf6
add eax, 4
add ecx, 4
test dx, dx
jne 0x58add0
xor eax, eax
jmp 0x58adfb
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
je 0x58ae0b
xor esi, esi
jmp 0x58b2c3
lea eax, [ebp + 8]
push 0x60dd00
push eax
call fcn.004044f0
add esp, 8
test al, al
je 0x58ae2a
mov esi, 1
jmp 0x58b2c3
lea eax, [ebp + 8]
push str._Manual
push eax
call fcn.004044f0
add esp, 8
test al, al
je 0x58ae49
mov esi, 1
jmp 0x58b2c3
lea eax, [ebp + 8]
push str._ManualSend
push eax
call fcn.004044f0
add esp, 8
test al, al
je 0x58ae68
mov esi, 1
jmp 0x58b2c3
lea eax, [ebp + 8]
push str._Mailer
push eax
call fcn.004044f0
add esp, 8
test al, al
je 0x58af60
lea ecx, [ebp - 0x240]
call fcn.00402be0
push str._Mailer
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 2
call fcn.00403280
push 0
push 0
lea edx, [ebp - 0x240]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x23c]
call fcn.005b2920
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x23c]
call fcn.00402b90
mov eax, dword [ebp - 0x240]
cmp dword [eax - 0xc], 0
jne 0x58aef0
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 1
mov esi, 1
call fcn.00402b90
jmp 0x58b2c3
mov esi, 4
call fcn.004196a0
lea ecx, [ebp + 8]
mov eax, dword [eax + 4]
add eax, 0xd8
push eax
call fcn.00403220
mov eax, dword [ebp + 8]
mov edx, 1
mov edi, eax
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, 0x104
or ecx, edx
jge 0x58af35
push 0x104
lea ecx, [ebp + 8]
call fcn.00402cf0
mov eax, dword [ebp + 8]
push str.MAPI.exe
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.00404860
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 1
call fcn.00402b90
jmp 0x58b2c3
lea eax, [ebp + 8]
push str._OCR
push eax
call fcn.004044f0
add esp, 8
test al, al
je 0x58af94
lea eax, [ebp - 0x244]
xor ecx, ecx
push ebx
push eax
lea edx, [ebp + 8]
mov esi, 4
call fcn.005af420
add esp, 8
jmp 0x58b2c3
lea eax, [ebp + 8]
push str._SUOCR
push eax
call fcn.004044f0
add esp, 8
test al, al
je 0x58afb3
mov esi, 0xa
jmp 0x58b2c3
lea eax, [ebp + 8]
push str._NewApp
push eax
call fcn.004044f0
add esp, 8
test al, al
je 0x58afcc
push 0
jmp 0x58afe3
lea eax, [ebp + 8]
push str._NewAppOCR
push eax
call fcn.004044f0
add esp, 8
test al, al
je 0x58b002
push 4
lea eax, [ebp - 0x244]
xor ecx, ecx
push ebx
push eax
lea edx, [ebp + 8]
mov esi, 9
call fcn.005ad8c0
add esp, 0xc
jmp 0x58b2c3
lea eax, [ebp + 8]
push 0x60e2c4
push eax
call fcn.004044f0
add esp, 8
test al, al
je 0x58b021
mov esi, 2
jmp 0x58b2c3
lea eax, [ebp + 8]
push str._Viewer
push eax
call fcn.004044f0
add esp, 8
test al, al
je 0x58b040
mov esi, 7
jmp 0x58b2c3
lea eax, [ebp + 8]
push str._Evernote
push eax
call fcn.004044f0
add esp, 8
test al, al
je 0x58b0c8
lea ecx, [ebp - 0x240]
call fcn.00402be0
push 0
push 0
lea edx, [ebp - 0x240]
mov byte [ebp - 4], 4
lea ecx, [ebp + 8]
call fcn.005b2920
mov eax, dword [ebp - 0x240]
add esp, 8
cmp dword [eax - 0xc], 0
je 0x58b5ca
lea edx, [ebp + 8]
mov esi, 4
lea ecx, [ebp - 0x23c]
call fcn.005af130
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 5
call fcn.00403220
lea ecx, [ebp - 0x23c]
call fcn.00402b90
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 1
call fcn.00402b90
jmp 0x58b2c3
lea eax, [ebp + 8]
push str._Box_Sync
push eax
call fcn.004044f0
add esp, 8
test al, al
je 0x58b0f9
lea edx, [ebp + 8]
mov esi, 6
lea ecx, [ebp - 0x23c]
call fcn.005af130
mov byte [ebp - 4], 6
jmp 0x58b23c
lea eax, [ebp + 8]
push str._DropBox
push eax
call fcn.004044f0
add esp, 8
test al, al
je 0x58b181
lea ecx, [ebp - 0x240]
call fcn.00402be0
push 0
push 0
lea edx, [ebp - 0x240]
mov byte [ebp - 4], 7
lea ecx, [ebp + 8]
call fcn.005b2920
mov eax, dword [ebp - 0x240]
add esp, 8
cmp dword [eax - 0xc], 0
je 0x58b5ca
lea edx, [ebp + 8]
mov esi, 6
lea ecx, [ebp - 0x23c]
call fcn.005af130
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 8
call fcn.00403220
lea ecx, [ebp - 0x23c]
call fcn.00402b90
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 1
call fcn.00402b90
jmp 0x58b2c3
lea eax, [ebp + 8]
push str._OneDrive
push eax
call fcn.004044f0
add esp, 8
test al, al
je 0x58b1b2
lea edx, [ebp + 8]
mov esi, 6
lea ecx, [ebp - 0x23c]
call fcn.005af130
mov byte [ebp - 4], 9
jmp 0x58b23c
lea eax, [ebp + 8]
push 0x60d1a0
push eax
call fcn.004044f0
add esp, 8
test al, al
je 0x58b2c3
lea eax, [ebp - 0x244]
xor ecx, ecx
push ebx
push eax
lea edx, [ebp + 8]
mov esi, 0xb
call fcn.005af7f0
add esp, 8
jmp 0x58b2c3
mov edx, str.AdobeDC
mov ecx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x58b217
test si, si
je 0x58b213
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x58b217
add ecx, 4
add edx, 4
test si, si
jne 0x58b1f1
xor ecx, ecx
jmp 0x58b21c
sbb ecx, ecx
or ecx, 1
test ecx, ecx
sete cl
test cl, cl
je 0x58b256
lea edx, [ebp + 8]
mov esi, 4
lea ecx, [ebp - 0x23c]
call fcn.005af130
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp + 8]
call fcn.00403220
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 1
call fcn.00402b90
jmp 0x58b2c3
push eax
call dword [sym.imp.SHELL32.dll_PathIsExe]
test eax, eax
je 0x58b2ad
push ecx
mov esi, esp
mov dword [ebp - 0x23c], esi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
call fcn.004035b0
add esp, 4
add eax, 0x10
mov dword [esi], eax
call fcn.005af660
add esp, 4
test al, al
je 0x58b2a6
lea eax, [ebp - 0x244]
xor ecx, ecx
push ebx
push eax
lea edx, [ebp + 8]
mov esi, 0xb
call fcn.005af7f0
add esp, 8
jmp 0x58b2c3
mov esi, 4
jmp 0x58b2c3
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x58b5d5
mov esi, 6
mov ecx, dword [0x64417c]
mov eax, 0x92492493
sub ecx, dword [0x644178]
imul ecx
add edx, ecx
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
neg edi
sbb edi, edi
and edi, 0x644178
je 0x58b5d5
dec esi
cmp esi, 0xa
ja case.0x58b2fc.3
jmp dword [esi*4 + 0x58b6ac]
push 1
mov edx, edi
lea ecx, [ebp + 8]
call fcn.005862e0
add esp, 4
jmp 0x58b33f
push 0
mov edx, edi
lea ecx, [ebp + 8]
call fcn.005862e0
add esp, 4
jmp 0x58b33f
push ebx
push 0
jmp 0x58b32d
push ebx
push 1
push edi
lea edx, [ebp - 0x244]
lea ecx, [ebp + 8]
call fcn.00586910
add esp, 0xc
cmp eax, 0x20
jl 0x58b5d5
mov bl, 1
jmp 0x58b5d7
push 0xa
lea ecx, [ebp - 0x238]
call fcn.0041cee0
mov byte [ebp - 4], 0xb
mov esi, dword [edi]
cmp esi, dword [edi + 4]
je 0x58b384
jmp 0x58b370
push esi
lea ecx, [ebp - 0x238]
call fcn.0041cfe0
add esi, 0x1c
cmp esi, dword [edi + 4]
jne 0x58b370
mov eax, dword [0x643bf0]
mov esi, dword [ebp - 0x24c]
test eax, eax
jne 0x58b39b
mov dword [ebp - 0x23c], eax
jmp 0x58b3d3
xor ebx, ebx
cmp esi, 0x9fbf1
push 0x10008
setne bl
dec ebx
and ebx, 4
push dword [ebx + 0x644028]
call eax
mov dword [ebp - 0x23c], eax
mov eax, dword [0x643bf0]
test eax, eax
je 0x58b3d3
push 0x10019
push dword [ebx + 0x644028]
call eax
push esi
push eax
push dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.005903e0
mov esi, dword [edi]
cmp esi, dword [edi + 4]
je 0x58b3ff
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esi]
call ebx
add esi, 0x1c
cmp esi, dword [edi + 4]
jne 0x58b3f3
lea ecx, [ebp - 0x238]
call fcn.0041cf06
mov bl, 1
jmp 0x58b5d7
mov esi, dword [edi]
cmp esi, dword [edi + 4]
je case.0x58b2fc.3
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 5
push 0
push 0
push dword [esi]
push str.open
push 0
call ebx
add esi, 0x1c
cmp esi, dword [edi + 4]
jne 0x58b422
mov bl, 1
jmp 0x58b5d7
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.00547850
add esp, 0xc
mov ecx, edi
push 0
call fcn.00404170
push dword [eax]
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.0054cb78
add esp, 0xc
lea eax, [ebp - 0x21c]
push str..txt
push eax
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 0
push 0x60ab98
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0xc
call fcn.00403280
mov eax, 0x128e
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov word [ebp - 0x220], ax
mov byte [ebp - 0x21e], 0
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x238]
call fcn.004031d0
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x258]
call fcn.00404080
push ecx
lea ecx, [ebp - 0x324]
call fcn.0057aa40
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x258]
lea ecx, [ebp - 0x324]
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x274], 0x1fbf
mov dword [ebp - 0x270], 0x1fb2
mov dword [ebp - 0x26c], 0x23c1
mov dword [ebp - 0x268], eax
call fcn.0057a890
cmp eax, 1
jne 0x58b594
push 5
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x58b5a5
mov edx, dword [ebp - 0x260]
mov ecx, dword [ebp - 0x248]
call fcn.0056c650
lea ecx, [ebp - 0x324]
call fcn.0057aa10
lea ecx, [ebp - 0x238]
call fcn.00403c90
lea ecx, [ebp - 0x258]
call fcn.004042d0
mov bl, 1
jmp 0x58b5d7
lea ecx, [ebp - 0x240]
call fcn.00402b90
xor bl, bl
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov ecx, dword [ebp - 0x244]
mov eax, esi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jg 0x58b64a
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 0x248], edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x58b642
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 0x248], edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x58b638
push 0
push dword [edx + 4]
call edi
jmp 0x58b64a
mov ecx, edx
call dword [ebp - 0x248]
jmp 0x58b64a
mov ecx, edx
call dword [ebp - 0x248]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], esi
dec esi
test esi, esi
jg 0x58b68c
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x58b688
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x58b688
push 0
push dword [edx + 4]
call edi
jmp 0x58b68c
mov ecx, edx
call esi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00544774
mov esp, ebp
pop ebp
ret