Function at 0x564bf8
Capabilities:
Copy file
Create process on windows
Delete file
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xd
push 0
push 0
dec ecx
jne 0x564c00
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x5655c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5884e4]
cmp byte [eax], 0
je 0x564fdf
mov eax, dword [0x588f48]
mov eax, dword [eax]
call fcn.004933c4
mov eax, dword [esi + 0x360]
mov eax, dword [eax + 0x2b4]
call fcn.00486ee0
mov eax, dword [esi + 0x360]
mov eax, dword [eax + 0x68]
mov edx, 0xff00
call fcn.0042d2cc
xor edx, edx
mov eax, dword [esi + 0x360]
call fcn.004582f8
push 0
mov eax, dword [esi + 0x360]
mov eax, dword [eax + 0x2b4]
mov ecx, 0x5655d8
xor edx, edx
call fcn.00486fac
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x10]
mov edx, dword [0x588700]
add edx, 0x2bc
call fcn.00405848
mov ecx, dword [ebp - 0x10]
mov edx, dword [0x588764]
mov edx, dword [edx]
lea eax, [ebp - 8]
call fcn.004058fc
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0040d744
mov eax, dword [ebp - 8]
call fcn.00405a74
push eax
call sub.kernel32.dll_DeleteFileA
push 0xa
call sub.kernel32.dll_Sleep_2
mov edx, dword [0x588764]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x5655f8
call fcn.004058fc
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x42900c]
call fcn.004290c4
mov ebx, eax
push 1
mov ecx, 0x565610
mov edx, 0x565628
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
call fcn.004046a4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dl, 1
mov eax, dword [0x41c04c]
call fcn.00404674
mov ebx, eax
mov eax, dword [0x588cb4]
mov eax, dword [eax]
cmp dword [eax + 0xc], 5
jle 0x564e0b
mov edx, 0x56563c
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x565650
mov eax, dword [0x5885f8]
push dword [eax]
push 0x565660
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405978
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x564e3f
mov edx, 0x56566c
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x565650
mov eax, dword [0x5885f8]
push dword [eax]
push 0x565660
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405978
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x565690
mov eax, dword [0x588c94]
push dword [eax]
push 0x5656a0
mov eax, dword [0x5885f8]
push dword [eax]
push 0x5656ac
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00405978
mov edx, dword [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x565650
mov eax, dword [0x588c94]
push dword [eax]
push 0x565660
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00405978
mov edx, dword [ebp - 0x20]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x5656bc
mov eax, dword [0x5885f8]
push dword [eax]
push 0x565660
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00405978
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5656d0
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00564910
mov eax, ebx
call fcn.004046a4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
lea edx, [ebp - 0x2c]
mov eax, dword [0x588ca8]
mov eax, dword [eax]
call fcn.00477510
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.0040d99c
mov eax, dword [ebp - 0x28]
call fcn.00405a74
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405a74
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [0x588ca8]
mov eax, dword [eax]
call fcn.00476ea8
jmp 0x56559a
mov eax, dword [0x5888cc]
cmp byte [eax], 0
je 0x56559a
mov eax, dword [0x588f48]
mov eax, dword [eax]
call fcn.004933c4
mov eax, dword [esi + 0x360]
mov eax, dword [eax + 0x2b4]
call fcn.00486ee0
mov eax, dword [esi + 0x360]
mov eax, dword [eax + 0x68]
mov edx, 0xff00
call fcn.0042d2cc
xor edx, edx
mov eax, dword [esi + 0x360]
call fcn.004582f8
push 0
mov eax, dword [esi + 0x360]
mov eax, dword [eax + 0x2b4]
mov ecx, 0x5655d8
xor edx, edx
call fcn.00486fac
lea eax, [ebp - 0xc]
call fcn.00564618
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0xc]
call fcn.0040d99c
mov eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
mov edx, dword [0x588700]
add edx, 0x2bc
call fcn.00405848
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 8]
pop edx
call fcn.004058fc
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0040d744
mov eax, dword [ebp - 8]
call fcn.00405a74
push eax
call sub.kernel32.dll_DeleteFileA
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.0040d99c
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 8]
mov ecx, 0x5655f8
call fcn.004058fc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x42900c]
call fcn.004290c4
mov ebx, eax
push 1
mov ecx, 0x565610
mov edx, 0x565628
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, ebx
call fcn.004046a4
push 0xa
call sub.kernel32.dll_Sleep_2
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.0040d99c
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 8]
mov ecx, 0x5656e0
call fcn.004058fc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x42900c]
call fcn.004290c4
mov ebx, eax
mov eax, dword [0x588c94]
mov eax, dword [eax]
push eax
mov ecx, 0x5656f8
mov edx, 0x565628
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 4]
mov eax, ebx
call fcn.004046a4
mov ebx, dword [0x5885f8]
mov ebx, dword [ebx]
mov dword [ebp - 0x40], ebx
mov eax, dword [ebp - 0x40]
call fcn.00405a74
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov eax, dword [0x5885f8]
mov eax, dword [eax]
call fcn.0040d524
test al, al
jne 0x56527f
lea eax, [ebp - 0xc]
mov edx, dword [0x5885f8]
mov edx, dword [edx]
call fcn.0040567c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
call fcn.00405a74
push eax
mov eax, dword [0x588c94]
mov eax, dword [eax]
call fcn.00405a74
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x565589
mov eax, dword [0x588ca8]
mov eax, dword [eax]
call fcn.00476b3c
mov eax, dword [0x5885f8]
mov eax, dword [eax]
call fcn.00405a74
mov edx, eax
lea eax, [ebp - 0x44]
call fcn.004057dc
mov eax, dword [ebp - 0x44]
mov edx, 1
call fcn.005644ac
mov eax, dword [0x588ca8]
mov eax, dword [eax]
call fcn.00476ea8
jmp 0x56559a
mov eax, esi
call fcn.004602e8
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.005646cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5655c9
lea eax, [ebp - 0x68]
mov edx, 0xa
call fcn.00405608
lea eax, [ebp - 0x3c]
mov edx, 0xf
call fcn.00405608
ret