Function at 0x4359a0
Capabilities:
Copy file
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a5d9c
mov eax, dword fs:[0]
push eax
mov eax, 0x1b5c
call fcn.00472b60
mov eax, dword [0x4c76b8]
xor eax, esp
mov dword [esp + 0x1b58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c76b8]
xor eax, esp
push eax
lea eax, [esp + 0x1b70]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1b80]
xor edi, edi
lea ecx, [esp + 0x130]
push edi
push ecx
mov dword [esp + 0x20], eax
call fcn.0043ca70
add esp, 8
cmp dword [esp + 0x144], edi
mov dword [esp + 0x1b78], edi
jne 0x435a30
cmp dword [esp + 0x148], 8
jb 0x43630a
mov edx, dword [esp + 0x134]
push edx
call fcn.00471a59
add esp, 4
jmp 0x43630a
lea eax, [esp + 0xdc]
push edi
push eax
call fcn.0043c9c0
add esp, 8
cmp dword [esp + 0xf0], edi
mov byte [esp + 0x1b78], 1
jne 0x435a93
mov esi, 8
cmp dword [esp + 0xf4], esi
jb 0x435a70
mov ecx, dword [esp + 0xe0]
push ecx
call fcn.00471a59
add esp, 4
cmp dword [esp + 0x148], esi
mov dword [esp + 0xf4], 7
mov dword [esp + 0xf0], edi
mov word [esp + 0xe0], di
jmp 0x435a15
push str.dlcore.dll
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x154]
push ecx
call fcn.0040a220
push str._tnproxy.dll
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x198]
push eax
mov byte [esp + 0x1b90], 2
call fcn.0040a220
push str.extract.dll
lea ecx, [esp + 0x14c]
push ecx
lea edx, [esp + 0x188]
push edx
mov byte [esp + 0x1b9c], 3
call fcn.0040a220
push str.DownloadProxyPS.dll
lea eax, [esp + 0x158]
push eax
lea ecx, [esp + 0x1cc]
push ecx
mov byte [esp + 0x1ba8], 4
call fcn.0040a220
add esp, 0x30
mov eax, dword [esp + 0xe0]
mov ebp, 8
cmp dword [esp + 0xf4], ebp
mov byte [esp + 0x1b78], 5
jae 0x435b3a
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x268]
call fcn.00437ea0
xor eax, eax
lea edx, [esp + 0x1b54]
push edx
lea ecx, [esp + 0x268]
mov byte [esp + 0x1b7c], 6
mov word [esp + 0x1b58], di
mov dword [esp + 0x1b5a], eax
mov word [esp + 0x1b5e], ax
call fcn.00437ab0
movzx esi, word [esp + 0x1b58]
push 0x4b09a8
lea ecx, [esp + 0x20]
call fcn.0040a1e0
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0xfc]
mov ebx, 7
push ecx
mov byte [esp + 0x1b80], bl
call fcn.0043c2c0
add esp, 8
cmp dword [esp + 0x34], ebp
mov byte [esp + 0x1b78], 9
jb 0x435bce
mov edx, dword [esp + 0x20]
push edx
call fcn.00471a59
add esp, 4
cmp dword [esp + 0x10c], edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], edi
mov word [esp + 0x20], di
jne 0x435d38
cmp dword [esp + 0x110], ebp
jb 0x435c01
mov eax, dword [esp + 0xfc]
push eax
call fcn.00471a59
add esp, 4
lea ecx, [esp + 0x264]
mov dword [esp + 0x110], ebx
mov dword [esp + 0x10c], edi
mov word [esp + 0xfc], di
mov byte [esp + 0x1b78], 5
call fcn.00437b20
cmp dword [esp + 0x1b8], ebp
jb 0x435c44
mov ecx, dword [esp + 0x1a4]
push ecx
call fcn.00471a59
add esp, 4
cmp dword [esp + 0x180], ebp
mov dword [esp + 0x1b8], ebx
mov dword [esp + 0x1b4], edi
mov word [esp + 0x1a4], di
jb 0x435c73
mov edx, dword [esp + 0x16c]
push edx
call fcn.00471a59
add esp, 4
cmp dword [esp + 0x19c], ebp
mov dword [esp + 0x180], ebx
mov dword [esp + 0x17c], edi
mov word [esp + 0x16c], di
jb 0x435ca2
mov eax, dword [esp + 0x188]
push eax
call fcn.00471a59
add esp, 4
cmp dword [esp + 0x164], ebp
mov dword [esp + 0x19c], ebx
mov dword [esp + 0x198], edi
mov word [esp + 0x188], di
jb 0x435cd1
mov ecx, dword [esp + 0x150]
push ecx
call fcn.00471a59
add esp, 4
cmp dword [esp + 0xf4], ebp
mov dword [esp + 0x164], ebx
mov dword [esp + 0x160], edi
mov word [esp + 0x150], di
jb 0x435d00
mov edx, dword [esp + 0xe0]
push edx
call fcn.00471a59
add esp, 4
cmp dword [esp + 0x148], ebp
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf0], edi
mov word [esp + 0xe0], di
jb 0x43630a
mov eax, dword [esp + 0x134]
push eax
call fcn.00471a59
add esp, 4
jmp 0x43630a
lea ecx, [esp + 0xf8]
push esi
push ecx
call fcn.00435580
add esp, 8
test al, al
je 0x4362a2
push 1
push 3
lea ecx, [esp + 0x5c]
call fcn.00435300
push esi
push 0x4af774
lea edx, [esp + 0x100]
push edx
lea eax, [esp + 0x68]
mov bl, 0xa
push eax
mov byte [esp + 0x1b88], bl
call fcn.00434530
add esp, 8
push eax
call fcn.004347c0
add esp, 8
mov ecx, eax
call fcn.004349e0
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x58]
call fcn.004329b0
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x104]
mov byte [esp + 0x1b84], 0xb
call fcn.00409a40
lea ecx, [esp + 0x38]
mov byte [esp + 0x1b78], bl
call fcn.00403980
lea edx, [esp + 0xf8]
push edx
call fcn.0043bca0
add esp, 4
test al, al
jne 0x435dec
lea eax, [esp + 0xf8]
push eax
call fcn.0043be00
add esp, 4
push 0x4b0c6c
lea ecx, [esp + 0xfc]
push ecx
lea edx, [esp + 0x11c]
push edx
call fcn.0040a220
push str.dlcore.dll
lea eax, [esp + 0x108]
push eax
lea ecx, [esp + 0x1d0]
push ecx
mov byte [esp + 0x1b90], 0xc
call fcn.0040a220
push str._tnproxy.dll
lea edx, [esp + 0x114]
push edx
lea eax, [esp + 0x24c]
push eax
mov byte [esp + 0x1b9c], 0xd
call fcn.0040a220
push str.extract.dll
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x220]
push edx
mov byte [esp + 0x1ba8], 0xe
call fcn.0040a220
push str.DownloadProxyPS.dll
lea eax, [esp + 0x12c]
push eax
lea ecx, [esp + 0x248]
push ecx
mov byte [esp + 0x1bb4], 0xf
call fcn.0040a220
add esp, 0x3c
cmp dword [esp + 0x12c], ebp
mov ecx, dword [esp + 0x118]
mov byte [esp + 0x1b78], 0x10
jae 0x435eb0
lea ecx, [esp + 0x118]
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, 8
cmp dword [esp + 0xf4], esi
jb 0x436332
mov eax, dword [esp + 0xe0]
cmp eax, edi
je 0x435edc
cmp ecx, edi
je 0x435edc
push edi
push ecx
push eax
call ebp
cmp dword [esp + 0x1d4], esi
mov eax, dword [esp + 0x1c0]
mov byte [esp + 0x17], 1
jae 0x435ef8
lea eax, [esp + 0x1c0]
push eax
call fcn.00413c70
add esp, 4
test al, al
je 0x436009
cmp dword [esp + 0x164], esi
mov eax, dword [esp + 0x150]
jae 0x435f20
lea eax, [esp + 0x150]
push eax
lea ecx, [esp + 0xab8]
call fcn.00437ea0
xor eax, eax
lea edx, [esp + 0x1b5c]
mov bl, 0x11
push edx
lea ecx, [esp + 0xab8]
mov byte [esp + 0x1b7c], bl
mov word [esp + 0x1b60], di
mov dword [esp + 0x1b62], eax
mov word [esp + 0x1b66], ax
call fcn.00437ab0
cmp dword [esp + 0x1d4], 8
movzx esi, word [esp + 0x1b60]
mov eax, dword [esp + 0x1c0]
jae 0x435f83
lea eax, [esp + 0x1c0]
push eax
lea ecx, [esp + 0x1308]
call fcn.00437ea0
xor eax, eax
mov dword [esp + 0x1b66], eax
mov word [esp + 0x1b6a], ax
lea eax, [esp + 0x1b64]
push eax
lea ecx, [esp + 0x1308]
mov byte [esp + 0x1b7c], 0x12
mov word [esp + 0x1b68], di
call fcn.00437ab0
movzx eax, word [esp + 0x1b68]
cmp esi, eax
jae 0x435fd6
mov byte [esp + 0x17], 0
lea ecx, [esp + 0x1304]
mov byte [esp + 0x1b78], bl
call fcn.00437b20
lea ecx, [esp + 0xab4]
mov byte [esp + 0x1b78], 0x10
call fcn.00437b20
cmp byte [esp + 0x17], 0
mov esi, 8
je 0x436041
cmp dword [esp + 0x1d4], esi
mov ecx, dword [esp + 0x1c0]
jae 0x436020
lea ecx, [esp + 0x1c0]
cmp dword [esp + 0x164], esi
jb 0x43633e
mov eax, dword [esp + 0x150]
cmp eax, edi
je 0x436041
cmp ecx, edi
je 0x436041
push edi
push ecx
push eax
call ebp
cmp dword [esp + 0x244], esi
mov ecx, dword [esp + 0x230]
jae 0x436058
lea ecx, [esp + 0x230]
cmp dword [esp + 0x19c], esi
jb 0x43634a
mov eax, dword [esp + 0x188]
cmp eax, edi
je 0x436079
cmp ecx, edi
je 0x436079
push edi
push ecx
push eax
call ebp
cmp dword [esp + 0x20c], esi
mov ecx, dword [esp + 0x1f8]
jae 0x436090
lea ecx, [esp + 0x1f8]
cmp dword [esp + 0x180], esi
jb 0x436356
mov eax, dword [esp + 0x16c]
cmp eax, edi
je 0x4360b1
cmp ecx, edi
je 0x4360b1
push edi
push ecx
push eax
call ebp
cmp dword [esp + 0x228], esi
mov ecx, dword [esp + 0x214]
jae 0x4360c8
lea ecx, [esp + 0x214]
cmp dword [esp + 0x1b8], esi
jb 0x436362
mov eax, dword [esp + 0x1a4]
cmp eax, edi
je 0x4360e9
cmp ecx, edi
je 0x4360e9
push edi
push ecx
push eax
call ebp
mov ecx, dword [esp + 0x18]
cmp ecx, edi
je 0x4360f6
call fcn.00450060
lea ecx, [esp + 0x1d8]
push ecx
call fcn.004327a0
lea edx, [esp + 0x118]
push edx
lea eax, [esp + 0x40]
mov bl, 0x13
push eax
mov byte [esp + 0x1b84], bl
call fcn.0043b690
add esp, 0xc
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x120]
mov byte [esp + 0x1b84], 0x14
call fcn.00409a40
lea ecx, [esp + 0x38]
mov byte [esp + 0x1b78], bl
call fcn.00403980
cmp dword [esp + 0x1ec], edi
je 0x4361b7
cmp dword [esp + 0x1f0], esi
mov eax, dword [esp + 0x1dc]
jae 0x436169
lea eax, [esp + 0x1dc]
push eax
call fcn.00413c70
add esp, 4
test al, al
je 0x4361b7
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x1dc]
push edx
call fcn.00414450
add esp, 8
test al, al
je 0x4361b7
cmp dword [esp + 0x1f0], esi
mov eax, dword [esp + 0x1dc]
jae 0x4361a9
lea eax, [esp + 0x1dc]
push 0x4b0cc4
push eax
call fcn.004381d0
add esp, 8
cmp dword [esp + 0x12c], esi
mov eax, dword [esp + 0x118]
jae 0x4361ce
lea eax, [esp + 0x118]
push eax
call fcn.00413c70
add esp, 4
test al, al
je 0x436202
cmp dword [esp + 0x12c], esi
mov eax, dword [esp + 0x118]
jae 0x4361f2
lea eax, [esp + 0x118]
push edi
push edi
push str.__RegServer
push eax
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.Installlog.txt
lea eax, [esp + 0xfc]
push eax
lea ecx, [esp + 0x250]
push ecx
call fcn.0040a220
add esp, 0xc
lea ecx, [esp + 0x248]
call fcn.00403980
lea ecx, [esp + 0x1d8]
call fcn.00403980
lea ecx, [esp + 0x210]
call fcn.00403980
lea ecx, [esp + 0x1f4]
call fcn.00403980
lea ecx, [esp + 0x22c]
call fcn.00403980
lea ecx, [esp + 0x1bc]
call fcn.00403980
lea ecx, [esp + 0x114]
call fcn.00403980
lea ecx, [esp + 0xa8]
mov byte [esp + 0x1b78], 9
call fcn.00431420
lea edx, [esp + 0xa8]
push edx
mov dword [esp + 0xac], 0x4af4ec
call fcn.0048f0c3
add esp, 4
lea ecx, [esp + 0xf8]
call fcn.00403980
lea ecx, [esp + 0x264]
mov byte [esp + 0x1b78], 5
call fcn.00437b20
lea ecx, [esp + 0x1a0]
call fcn.00403980
lea ecx, [esp + 0x168]
call fcn.00403980
lea ecx, [esp + 0x184]
call fcn.00403980
lea ecx, [esp + 0x14c]
call fcn.00403980
lea ecx, [esp + 0xdc]
call fcn.00403980
lea ecx, [esp + 0x130]
call fcn.00403980
mov ecx, dword [esp + 0x1b70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1b58]
xor ecx, esp
call fcn.00471a20
add esp, 0x1b68
ret
lea eax, [esp + 0xe0]
jmp 0x435ed3
lea eax, [esp + 0x150]
jmp 0x436038
lea eax, [esp + 0x188]
jmp 0x436070
lea eax, [esp + 0x16c]
jmp 0x4360a8
lea eax, [esp + 0x1a4]
jmp 0x4360e0