Function at 0x78d7a0
Capabilities:
Acquire debug privileges
Create process on windows
Empty the recycle bin

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x13
push 0
push 0
dec ecx
jne 0x78d7a8
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov ebx, 0x809198
xor eax, eax
push ebp
push 0x78e153
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0078ae38
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x78e164
mov eax, dword [0x8017bc]
mov eax, dword [eax]
call eax
push 0
push 0xf4240
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
call fcn.0040c634
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
xor eax, eax
mov dword [0x809420], eax
xor eax, eax
mov dword [0x809424], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x43c]
mov edx, dword [eax]
call dword [edx + 0x12c]
mov eax, 0x809430
mov edx, 0x78e178
call fcn.0040ab84
mov eax, dword [ebp - 8]
call fcn.0078ae38
mov ecx, ebx
mov edx, 0x1ff
mov eax, dword [0x809430]
call fcn.00427920
test eax, eax
jne 0x78dcb3
test byte [ebx + 0x10], 0x10
je 0x78dca4
mov eax, dword [ebx + 0x14]
mov edx, 0x78e1a0
call fcn.0040b8b4
je 0x78dca4
mov eax, dword [ebx + 0x14]
mov edx, 0x78e1b0
call fcn.0040b8b4
je 0x78dca4
mov eax, dword [ebx + 0x14]
mov edx, 0x78e1c4
call fcn.0040b8b4
je 0x78dca4
mov eax, dword [ebx + 0x14]
mov edx, 0x78e1ec
call fcn.0040b8b4
je 0x78dca4
mov eax, dword [ebx + 0x14]
mov edx, 0x78e21c
call fcn.0040b8b4
je 0x78dca4
mov eax, dword [ebx + 0x14]
mov edx, 0x78e238
call fcn.0040b8b4
je 0x78dca4
mov eax, dword [ebx + 0x14]
mov edx, 0x78e258
call fcn.0040b8b4
je 0x78dca4
mov eax, dword [ebx + 0x14]
mov edx, 0x78e280
call fcn.0040b8b4
je 0x78dca4
inc dword [0x809424]
lea eax, [ebp - 0x3c]
mov ecx, dword [ebx + 0x14]
mov edx, 0x78e29c
call fcn.0040b71c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x43c]
mov eax, dword [eax + 0x2d8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x408]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78d93f
mov eax, 0x78e2cc
call fcn.004279b0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3d8]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78d976
push 0x78e304
push dword [ebx + 0x14]
push 0x78e324
lea eax, [ebp - 0x40]
mov edx, 3
call fcn.0040b7a4
mov eax, dword [ebp - 0x40]
call fcn.00788610
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3f0]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78d9f4
push 0x78e304
push dword [ebx + 0x14]
push 0x78e358
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.0040b7a4
mov eax, dword [ebp - 0x44]
call fcn.00788610
push 0x78e3d8
push dword [ebx + 0x14]
push 0x78e41c
lea eax, [ebp - 0x48]
mov edx, 3
call fcn.0040b7a4
mov eax, dword [ebp - 0x48]
call fcn.00788610
push 0
push 0x78e47c
push dword [ebx + 0x14]
push 0x78e358
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.0040b7a4
mov eax, dword [ebp - 0x4c]
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x410]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78da2b
push 0x78e304
push dword [ebx + 0x14]
push 0x78e4bc
lea eax, [ebp - 0x50]
mov edx, 3
call fcn.0040b7a4
mov eax, dword [ebp - 0x50]
call fcn.00788610
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3f4]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78da62
push 0x78e304
push dword [ebx + 0x14]
push 0x78e51c
lea eax, [ebp - 0x54]
mov edx, 3
call fcn.0040b7a4
mov eax, dword [ebp - 0x54]
call fcn.00788610
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x414]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78da99
push 0x78e304
push dword [ebx + 0x14]
push 0x78e594
lea eax, [ebp - 0x58]
mov edx, 3
call fcn.0040b7a4
mov eax, dword [ebp - 0x58]
call fcn.00788610
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x400]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78dad0
push 0x78e304
push dword [ebx + 0x14]
push 0x78e610
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.0040b7a4
mov eax, dword [ebp - 0x5c]
call fcn.00788610
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3f8]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78db07
push 0x78e304
push dword [ebx + 0x14]
push 0x78e66c
lea eax, [ebp - 0x60]
mov edx, 3
call fcn.0040b7a4
mov eax, dword [ebp - 0x60]
call fcn.00788610
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x418]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78db3e
push 0x78e304
push dword [ebx + 0x14]
push 0x78e6bc
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.0040b7a4
mov eax, dword [ebp - 0x64]
call fcn.004279b0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x41c]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78db75
push 0x78e304
push dword [ebx + 0x14]
push 0x78e728
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.0040b7a4
mov eax, dword [ebp - 0x68]
call fcn.00788610
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x420]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78dbac
push 0x78e304
push dword [ebx + 0x14]
push 0x78e790
lea eax, [ebp - 0x6c]
mov edx, 3
call fcn.0040b7a4
mov eax, dword [ebp - 0x6c]
call fcn.004279b0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3fc]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78dbe3
push 0x78e304
push dword [ebx + 0x14]
push 0x78e808
lea eax, [ebp - 0x70]
mov edx, 3
call fcn.0040b7a4
mov eax, dword [ebp - 0x70]
call fcn.00788610
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x428]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78dc1a
push 0x78e304
push dword [ebx + 0x14]
push 0x78e868
lea eax, [ebp - 0x74]
mov edx, 3
call fcn.0040b7a4
mov eax, dword [ebp - 0x74]
call fcn.00788610
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x434]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78dc73
push 0x78e304
push dword [ebx + 0x14]
push 0x78e8b8
lea eax, [ebp - 0x78]
mov edx, 3
call fcn.0040b7a4
mov eax, dword [ebp - 0x78]
call fcn.00788610
push 0x78e304
push dword [ebx + 0x14]
push 0x78e904
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.0040b7a4
mov eax, dword [ebp - 0x7c]
call fcn.00788610
push 0x78e29c
push dword [ebx + 0x14]
push 0x78e97c
lea eax, [ebp - 0x80]
mov edx, 3
call fcn.0040b7a4
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x43c]
mov eax, dword [eax + 0x2d8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, ebx
call fcn.00427970
test eax, eax
je 0x78d851
mov eax, ebx
call fcn.00427994
mov eax, dword [ebp - 8]
call fcn.0078ae38
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3d4]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78dd09
mov eax, 0x78e9a0
call fcn.00788610
mov eax, 0x78ea28
call fcn.00788610
mov eax, 0x78eaac
call fcn.00788610
mov eax, 0x78eb30
call fcn.00788610
mov eax, 0x78eb5c
call fcn.00788610
mov eax, dword [ebp - 8]
call fcn.0078ae38
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3dc]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78dd30
mov eax, 0x78eb78
call fcn.00788610
mov eax, dword [ebp - 8]
call fcn.0078ae38
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78dd57
mov eax, 0x78ebac
call fcn.00788610
mov eax, dword [ebp - 8]
call fcn.0078ae38
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3e4]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78ddfc
xor eax, eax
push ebp
push 0x78ddd9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x78ebd4
call sub.kernel32.dll_WinExec
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x78ebf4
call sub.kernel32.dll_WinExec
push 0x64
call sub.kernel32.dll_Sleep
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00565c34
push eax
call sub.shell32.dll_SHEmptyRecycleBinA
push 0x64
call sub.kernel32.dll_Sleep
mov eax, 0x78ec1c
call fcn.00788610
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x78ddfc
mov eax, dword [ebp - 8]
call fcn.0078ae38
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3e8]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78de23
mov eax, 0x78ec88
call fcn.00788610
mov eax, dword [ebp - 8]
call fcn.0078ae38
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ec]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78de4a
mov eax, 0x78ecbc
call fcn.00788610
mov eax, dword [ebp - 8]
call fcn.0078ae38
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x430]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78de71
mov eax, 0x78ed1c
call fcn.00788610
lea edx, [ebp - 0x88]
mov eax, dword [0x809424]
call fcn.004269d8
mov ecx, dword [ebp - 0x88]
lea eax, [ebp - 0x84]
mov edx, 0x78ed40
call fcn.0040b71c
mov edx, dword [ebp - 0x84]
mov eax, dword [0x809190]
mov eax, dword [eax + 0x43c]
mov eax, dword [eax + 0x2d8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x78ed84
lea edx, [ebp - 0x90]
mov eax, dword [0x809420]
call fcn.004269d8
push dword [ebp - 0x90]
push 0x78ede8
lea eax, [ebp - 0x8c]
mov edx, 3
call fcn.0040b7a4
mov edx, dword [ebp - 0x8c]
mov eax, dword [0x809190]
mov eax, dword [eax + 0x43c]
mov eax, dword [eax + 0x2d8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
fild dword [0x80942c]
fmul dword [0x78edec]
fdiv dword [0x78edf0]
fstp xword [0x80a3f0]
wait
xor eax, eax
mov dword [0x80942c], eax
xor eax, eax
mov dword [0x80a3f0], eax
mov dword [0x80a3f4], eax
mov word [0x80a3f8], ax
mov eax, dword [ebp - 8]
call fcn.0078ae38
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3e4]
mov edx, dword [eax]
call dword [edx + 0x130]
test al, al
je 0x78df99
mov edx, 0x78ee00
mov al, 1
call fcn.00788554
test al, al
jne 0x78df7e
mov eax, dword [0x809190]
mov eax, dword [eax + 0x43c]
mov eax, dword [eax + 0x2d8]
mov edx, 0x78ee30
mov ecx, dword [eax]
call dword [ecx + 0x3c]
jmp 0x78df99
mov eax, dword [0x809190]
mov eax, dword [eax + 0x43c]
mov eax, dword [eax + 0x2d8]
mov edx, 0x78ee5c
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [ebp - 8]
call fcn.0078ae38
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x78e164
mov eax, dword [0x8017bc]
mov eax, dword [eax]
call eax
push 0
push 0xf4240
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
call fcn.0040c634
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
fild qword [ebp - 0x18]
fdiv dword [0x78edf0]
fild qword [ebp - 0x10]
fdiv dword [0x78edf0]
fsubp st(1)
fstp qword [ebp - 0x20]
wait
fldz
fld qword [ebp - 0x20]
fucompp
wait
fnstsw ax
sahf
jae 0x78e000
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x78e050
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040a7a4
fld qword [ebp - 0x20]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea edx, [ebp - 4]
mov eax, dword [0x801bb0]
call fcn.004299e0
mov eax, 0x809434
mov edx, dword [ebp - 4]
call fcn.0040ab84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x78e057
lea eax, [ebp - 4]
call fcn.0040a7a4
ret