Function at 0x506a1a
Capabilities:
Create process on windows
Delete file

Disassembly:
mov eax, 0x67507a
call fcn.006313fc
sub esp, 0x16c
push ebx
mov ebx, ecx
lea ecx, [esp + 0xf8]
push edi
call fcn.005051ac
and dword [esp + 0x17c], 0
lea eax, [esp + 0xfc]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [ebx + 0x18]
push eax
call fcn.0053bd39
or edi, 0xffffffff
test al, al
je 0x506ebc
mov eax, dword [esp + 0x10]
push ebp
push esi
mov ecx, dword [eax + 0xd8]
imul eax, dword [esp + 0x160], 0x9c
add eax, dword [ecx + 4]
push eax
lea eax, [esp + 0x64]
push eax
call fcn.004fd6a4
lea ebp, [ebx + 0x78]
push eax
mov ecx, ebp
call fcn.0044dbe6
push 0
push 1
lea ecx, [esp + 0x68]
call fcn.0042341c
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x104]
push ecx
lea esi, [ebx + 0x60]
mov ecx, dword [eax + 0xd4]
call fcn.005055ef
add eax, 0x9c
mov ecx, esi
push eax
call fcn.00422f9e
cmp dword [esi + 0x14], 8
jb 0x506ad1
mov eax, dword [esi]
jmp 0x506ad3
mov eax, esi
push eax
call fcn.0045e93a
test al, al
je 0x506ae8
mov byte [ebx], 1
mov dword [ebx + 4], edi
jmp 0x506eba
cmp dword [esi + 0x14], 8
jb 0x506af2
mov eax, dword [esi]
jmp 0x506af4
mov eax, esi
push 0x5c
push eax
call fcn.00637ecd
mov dword [esp + 0x24], eax
pop ecx
pop ecx
test eax, eax
je 0x506eba
push 8
pop edi
cmp dword [esi + 0x14], edi
jb 0x506b16
mov ecx, dword [esi]
jmp 0x506b18
mov ecx, esi
sub eax, ecx
lea ecx, [esp + 0x48]
sar eax, 1
push eax
push 0
push esi
call fcn.0045da84
mov ecx, eax
mov byte [esp + 0x184], 1
cmp dword [ecx + 0x14], edi
jb 0x506b3a
mov ecx, dword [ecx]
mov eax, dword [esp + 0x1c]
add eax, 2
push eax
push ecx
lea eax, [esp + 0x68]
push str._s_s
push eax
call fcn.0047224d
add esp, 0x10
lea esi, [ebx + 0x48]
mov ecx, esi
push eax
call fcn.0044dbe6
push 0
push 1
lea ecx, [esp + 0x68]
call fcn.0042341c
push 0
push 1
lea ecx, [esp + 0x50]
mov byte [esp + 0x18c], 0
call fcn.0042341c
cmp dword [ebp + 0x14], edi
jb 0x506b8a
mov ebp, dword [ebp]
push ebp
mov ebp, 0x68fab4
lea eax, [esp + 0x94]
push ebp
push eax
call fcn.0047224d
add esp, 0xc
mov byte [esp + 0x184], 2
cmp dword [esi + 0x14], edi
jb 0x506bb2
mov eax, dword [esi]
jmp 0x506bb4
mov eax, esi
push eax
lea eax, [esp + 0xac]
push ebp
push eax
call fcn.0047224d
add esp, 0xc
mov edx, dword [esp + 0xa8]
mov byte [esp + 0x184], 3
cmp dword [esp + 0xbc], edi
jae 0x506be5
lea edx, [esp + 0xa8]
mov ecx, dword [esp + 0x90]
cmp dword [esp + 0xa4], edi
jae 0x506bfc
lea ecx, [esp + 0x90]
lea eax, [ebx + 0x30]
cmp dword [eax + 0x14], edi
jb 0x506c06
mov eax, dword [eax]
push edx
push ecx
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.0047224d
add esp, 0x10
lea eax, [esp + 0x60]
mov byte [esp + 0x184], 4
push eax
call fcn.0050595c
mov ecx, dword [esp + 0x20]
mov byte [esp + 0x184], 5
cmp dword [esp + 0x34], edi
jae 0x506c3e
lea ecx, [esp + 0x20]
cmp dword [eax + 0x14], edi
jb 0x506c45
mov eax, dword [eax]
push ecx
push eax
lea eax, [esp + 0x50]
push str.__s___s
push eax
call fcn.0047224d
add esp, 0x10
lea ecx, [esp + 0x20]
push eax
call fcn.0044dbe6
xor edi, edi
lea ecx, [esp + 0x48]
push edi
push 1
call fcn.0042341c
push edi
push 1
lea ecx, [esp + 0x68]
mov byte [esp + 0x18c], 4
call fcn.0042341c
lea eax, [esp + 0x78]
push eax
call fcn.0050595c
cmp dword [esi + 0x14], 8
mov byte [esp + 0x184], 6
jb 0x506ca1
mov eax, dword [esi]
jmp 0x506ca3
mov eax, esi
push eax
lea eax, [esp + 0x4c]
push str._s.log
push eax
call fcn.0047224d
add esp, 0xc
lea ebp, [ebx + 0x90]
mov ecx, ebp
push eax
call fcn.0044dbe6
push edi
push 1
lea ecx, [esp + 0x50]
call fcn.0042341c
push edi
push ebp
call fcn.0045df1f
cmp dword [ebp + 0x14], 8
jb 0x506ce2
mov eax, dword [ebp]
jmp 0x506ce4
mov eax, ebp
mov edi, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push eax
call edi
cmp dword [esi + 0x14], 8
jb 0x506cf5
mov esi, dword [esi]
push esi
call edi
cmp dword [ebp + 0x14], 8
jb 0x506d03
mov eax, dword [ebp]
jmp 0x506d05
mov eax, ebp
xor esi, esi
push esi
push 0x80
push 2
push esi
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebx + 0xa8], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea eax, [esp + 0x14]
push 2
push 1
push esi
push eax
call edi
push eax
push dword [ebx + 0xa8]
call edi
mov esi, dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
push eax
call esi
push 2
push 1
push 0
lea eax, [esp + 0x1c]
push eax
call edi
push eax
push dword [ebx + 0xa8]
call edi
push eax
call esi
push dword [ebx + 0xa8]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
cmp dword [ebp + 0x14], 8
jb 0x506d7e
mov ebp, dword [ebp]
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
push ebp
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
push 0x44
pop ebp
push ebp
mov dword [ebx + 0xa8], eax
lea eax, [esp + 0xc4]
push 0
push eax
call fcn.00635a30
xor eax, eax
mov dword [esp + 0xcc], ebp
lea edi, [esp + 0x44]
add esp, 0xc
stosd dword es:[edi], eax
push 0xfffffffffffffff6
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x100], eax
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
cmp dword [esp + 0x34], 8
mov ecx, dword [esp + 0x20]
mov dword [esp + 0xf8], eax
mov dword [esp + 0xec], 0x100
mov byte [ebx], 1
jae 0x506e06
lea ecx, [esp + 0x20]
cmp dword [esp + 0x8c], 8
mov eax, dword [esp + 0x78]
jae 0x506e18
lea eax, [esp + 0x78]
lea edx, [esp + 0x38]
push edx
lea edx, [esp + 0xc4]
push edx
xor edx, edx
push edx
push edx
push 0x8004000
push 1
push edx
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
push dword [esp + 0x14]
test eax, eax
je 0x506e62
call esi
push dword [esp + 0x10]
call esi
mov eax, dword [esp + 0x40]
push dword [esp + 0x3c]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [ebx + 8], eax
call esi
xor edi, edi
jmp 0x506e81
call esi
push dword [esp + 0x10]
call esi
push dword [ebx + 0xa8]
call esi
or dword [ebx + 0xa8], 0xffffffff
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
xor ebx, ebx
lea ecx, [esp + 0x78]
push 0
inc ebx
push ebx
call fcn.0042341c
push 0
push ebx
lea ecx, [esp + 0x28]
call fcn.0042341c
push 0
push ebx
lea ecx, [esp + 0xb0]
call fcn.0042341c
push 0
push ebx
lea ecx, [esp + 0x98]
call fcn.0042341c
pop esi
pop ebp
lea ecx, [esp + 0xfc]
call fcn.00499bad
mov ecx, dword [esp + 0x174]
mov eax, edi
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret