Function at 0x61dc84
Capabilities:
Copy file
Create process on windows
Get number of processors

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x61dc8c
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x61e04d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67d258]
cmp dword [eax], 0
je 0x61dd4f
mov eax, dword [0x67d258]
mov eax, dword [eax]
mov edx, 0x61e064
call fcn.0040508c
je 0x61dd4f
mov eax, dword [0x67d258]
mov eax, dword [eax]
mov edx, 0x61e070
call fcn.0040508c
je 0x61dd4f
mov eax, dword [ebp - 4]
call fcn.0061ffa8
push 0
mov al, byte [0x61e074]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f0]
mov ecx, 0x61e080
mov edx, 0x61e090
call fcn.0040f7a4
mov eax, dword [ebp - 0x24]
call fcn.00405140
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f0]
call fcn.00405140
push eax
call sub.kernel32.dll_CopyFileA
push 3
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f0]
call fcn.00405140
push eax
push 0x61e098
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x61e01d
xor edx, edx
mov eax, 1
call fcn.0052d5f4
test eax, eax
ja 0x61e01d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1d4], 0
jne 0x61dd77
mov eax, dword [ebp - 4]
call fcn.0063adec
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
test eax, eax
je 0x61e01d
mov byte [eax + 0x25a], 0
xor edx, edx
call fcn.0053b8fc
xor eax, eax
push ebp
push 0x61deb6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
call fcn.0053bb30
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
mov edx, dword [0x604624]
call fcn.0040407c
test al, al
je 0x61dde2
mov eax, ebx
mov edx, dword [0x604624]
call fcn.004040a0
cmp dword [eax + 0x3ec], 0
jne 0x61ddf3
mov eax, dword [ebp - 4]
call fcn.00606b4c
cmp byte [eax + 0x229], 0
jne 0x61de14
push 0x61e0a8
push 0
push 1
push 0x61e0b4
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.00411e1c
add esp, 0x18
jmp 0x61deac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d0]
mov edx, dword [0x67d8e4]
mov edx, dword [edx]
call fcn.0040508c
je 0x61de6d
push 0xffffffffffffffff
push 0x61e0c4
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.00411e1c
add esp, 0x10
push 0xffffffffffffffff
push 0x61e0d8
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.00411e1c
add esp, 0x10
push 0xffffffffffffffff
push 0x61e0ec
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.00411e1c
add esp, 0x10
jmp 0x61deac
push 0
push 0x61e0c4
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.00411e1c
add esp, 0x10
push 0xffffffffffffffff
push 0x61e0d8
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.00411e1c
add esp, 0x10
push 0xffffffffffffffff
push 0x61e0ec
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.00411e1c
add esp, 0x10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61dec0
mov eax, 0xc8
call fcn.0052a444
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1cc]
mov eax, 0x61e108
call fcn.00405284
mov ecx, eax
dec ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1cc]
mov edx, 1
call fcn.004051a0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1cc]
mov eax, 0x61e108
call fcn.00405284
mov edx, eax
inc edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1cc]
mov ecx, 0xa
call fcn.004051a0
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x61e108
call fcn.00405284
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.004051a0
push 1
push 0
lea eax, [ebp - 0x2c]
call fcn.005211d4
push dword [ebp - 0x2c]
push 0x61e114
push dword [ebp - 8]
push 0x61e114
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
mov edx, 5
call fcn.00405000
mov eax, dword [ebp - 0x28]
call fcn.00405140
push eax
push 0x61e118
push 0x61e098
push 0
call sub.shell32.dll_ShellExecuteA
xor ebx, ebx
xor esi, esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d4]
cmp byte [eax + 0x25a], 0
je 0x61dfab
or ebx, 0xffffffff
mov byte [eax + 0x25a], 0
mov eax, 0x64
call fcn.0052a444
push 0x61e128
push 0
call sub.user32.dll_FindWindowA
test eax, eax
je 0x61dfde
push 0
push 0x61e14c
call sub.user32.dll_FindWindowA
test eax, eax
je 0x61dfde
test ebx, ebx
je 0x61df8f
or esi, 0xffffffff
jmp 0x61df8f
mov eax, dword [ebp - 4]
cmp dword [eax + 0x218], 0
je 0x61e01d
test esi, esi
je 0x61dff5
mov ebx, 5
jmp 0x61dffa
mov ebx, 6
push 0
push ebx
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00606b4c
call fcn.00485df4
push eax
call sub.user32.dll_PostMessageA
mov eax, dword [ebp - 4]
call fcn.0061dc7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61e054
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00404ca4
lea eax, [ebp - 0x20]
call fcn.00411e14
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404ca4
ret