Function at 0x4ebb94
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x11d
push 0
push 0
dec ecx
jne 0x4ebb9c
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f48
mov eax, dword [ebp - 8]
call fcn.00405f48
xor eax, eax
push ebp
push 0x4ec6a7
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004bcb04
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov edx, 0x4ec6c4
mov eax, dword [ebp - 0x14]
call fcn.0040a21c
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x28]
call fcn.00405fb4
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x14]
call fcn.0040c8ec
test al, al
jne 0x4ebc08
xor eax, eax
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x848]
mov eax, dword [0x4f6634]
mov eax, dword [eax]
call fcn.00476948
mov eax, dword [ebp - 0x848]
lea edx, [ebp - 0x20]
call fcn.0040d03c
mov dword [ebp - 0x3c], 1
mov dl, 1
mov eax, dword [0x42e3f8]
call fcn.0042e5dc
mov dword [ebp - 0x40], eax
mov edx, reloc.MLoad.dll_Ordinal_2
mov eax, dword [ebp - 0x40]
call fcn.0042e67c
xor ecx, ecx
mov edx, 0x4ec6d4
mov eax, dword [ebp - 0x40]
call fcn.0042e7c0
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x4ebc8e
mov edx, 0x4ec700
mov eax, dword [ebp - 0x40]
call fcn.0042ef3c
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jl 0x4ebc7f
cmp dword [ebp - 0x3c], 2
jle 0x4ebc86
mov dword [ebp - 0x3c], 1
mov eax, dword [ebp - 0x40]
call fcn.0042e64c
mov eax, dword [ebp - 0x40]
call fcn.0040428c
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00405fb4
mov dl, 1
mov eax, dword [0x42e3f8]
call fcn.0042e5dc
mov dword [ebp - 0x40], eax
mov edx, reloc.MLoad.dll_Ordinal_2
mov eax, dword [ebp - 0x40]
call fcn.0042e67c
push 0x4ec71c
lea edx, [ebp - 0x850]
mov eax, dword [ebp - 0x3c]
call fcn.0040c63c
push dword [ebp - 0x850]
push 0x4ec754
push dword [ebp - 8]
lea eax, [ebp - 0x84c]
mov edx, 4
call fcn.004063ec
mov edx, dword [ebp - 0x84c]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
call fcn.0042e7c0
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x4ebd42
xor eax, eax
push ebp
push 0x4ebd2e
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
mov edx, 0x4ec778
mov eax, dword [ebp - 0x40]
call fcn.0042eeb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ebd42
mov eax, dword [ebp - 0x40]
call fcn.0040428c
mov eax, dword [ebp - 0xc]
call fcn.0040cd44
test al, al
jne 0x4ebd5f
mov dword [ebp - 0x38], 0xffffffff
jmp 0x4ebdb4
mov eax, dword [ebp - 0xc]
call fcn.00405fec
mov edx, eax
lea eax, [ebp - 0x854]
call fcn.0040610c
mov eax, dword [ebp - 0x854]
lea edx, [ebp - 0x10]
call fcn.004bcb04
lea eax, [ebp - 0x2c]
push eax
xor ecx, ecx
mov edx, 0x4ec6c4
mov eax, dword [ebp - 0x10]
call fcn.0040a21c
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x2c]
call fcn.00405fb4
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0x10]
call fcn.0040c8ec
test al, al
jne 0x4ebdb4
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jle 0x4ebe04
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x38]
jle 0x4ebe04
mov eax, dword [ebp - 8]
call fcn.004ed14c
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
call fcn.00405fb4
push 0
mov eax, dword [ebp - 0x18]
call fcn.00405fec
push eax
lea eax, [ebp - 0x858]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
call fcn.0040631c
mov eax, dword [ebp - 0x858]
call fcn.00405fec
push eax
call sub.kernel32.dll_CopyFileW
jmp 0x4ebe0f
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
call fcn.00405fb4
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4ebe2c
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4ebe2c
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004056d0
test eax, eax
je 0x4ebe35
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x4ebeb2
cmp dword [ebp - 0x38], 0
jge 0x4ebeb2
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
call fcn.00405fb4
xor eax, eax
push ebp
push 0x4ebe7b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x85c]
mov eax, dword [ebp - 0x18]
call fcn.0040d03c
mov eax, dword [ebp - 0x85c]
call fcn.0040cdb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ebe85
push 0
mov eax, dword [ebp - 0x18]
call fcn.00405fec
push eax
lea eax, [ebp - 0x860]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
call fcn.0040631c
mov eax, dword [ebp - 0x860]
call fcn.00405fec
push eax
call sub.kernel32.dll_CopyFileW
cmp byte [ebp - 0x41], 0
jne 0x4ec085
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00405fb4
lea edx, [ebp - 0x1c]
mov eax, 0x4ec798
call fcn.00414640
mov eax, dword [ebp - 0x1c]
call fcn.0040cd8c
test al, al
jne 0x4ebf05
push 0
push 5
lea eax, [ebp - 0x844]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0x844]
mov ecx, 0x401
call fcn.00406148
mov eax, dword [ebp - 0x1c]
call fcn.0040cd8c
test al, al
je 0x4ebfd0
push dword [ebp - 0x1c]
push 0x4ec7b4
push dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004063ec
xor eax, eax
push ebp
push 0x4ebf4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
call fcn.0040cdb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ebf57
mov eax, dword [ebp - 0x1c]
call fcn.0040cd8c
test al, al
je 0x4ebfd0
push dword [ebp - 0x1c]
push 0x4ec7b4
lea edx, [ebp - 0x864]
mov eax, dword [ebp - 4]
call fcn.0040d078
push dword [ebp - 0x864]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004063ec
push 0
mov eax, dword [ebp - 0x18]
call fcn.00405fec
push eax
lea eax, [ebp - 0x868]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
call fcn.0040631c
mov eax, dword [ebp - 0x868]
call fcn.00405fec
push eax
call sub.kernel32.dll_CopyFileW
mov eax, dword [ebp - 0x18]
call fcn.0040cd44
test al, al
jne 0x4ebfd0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00405fb4
push 0
push 0
push 0x4ec7b8
mov eax, dword [ebp - 0x18]
call fcn.00405fec
push eax
push 0x4ec7cc
push 0
call sub.shell32.dll_ShellExecuteW
mov ebx, 1
push 0x64
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4f6634]
mov eax, dword [eax]
call fcn.00476158
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
test edx, edx
jne 0x4ec07b
lea eax, [ebp - 0x870]
mov ecx, 0x4ec7e4
mov edx, dword [ebp - 8]
call fcn.0040631c
mov eax, dword [ebp - 0x870]
mov edx, 0x4ec7fc
call fcn.004ed3e0
mov edx, eax
lea eax, [ebp - 0x86c]
call fcn.0040610c
mov eax, dword [ebp - 0x86c]
lea edx, [ebp - 0xc]
call fcn.0040ba28
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4ec06f
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4ec06f
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004056d0
test eax, eax
je 0x4ec078
sub eax, 4
mov eax, dword [eax]
dec eax
jg 0x4ec085
inc ebx
cmp ebx, 0x1f
jne 0x4ebff3
mov dl, 1
mov eax, dword [0x42e3f8]
call fcn.0042e5dc
mov dword [ebp - 0x40], eax
mov edx, reloc.MLoad.dll_Ordinal_2
mov eax, dword [ebp - 0x40]
call fcn.0042e67c
push 0x4ec71c
lea edx, [ebp - 0x878]
mov eax, dword [ebp - 0x3c]
call fcn.0040c63c
push dword [ebp - 0x878]
push 0x4ec754
push dword [ebp - 8]
lea eax, [ebp - 0x874]
mov edx, 4
call fcn.004063ec
mov edx, dword [ebp - 0x874]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
call fcn.0042e7c0
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x4ec174
xor eax, eax
push ebp
push 0x4ec116
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4ec824
mov eax, dword [ebp - 0x40]
call fcn.0042ef3c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ec122
cmp ebx, 2
je 0x4ec16c
push 0
push 0
push 0x4ec830
mov eax, dword [ebp - 0x18]
call fcn.00405fec
push eax
push 0x4ec7cc
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [0x4f6634]
mov eax, dword [eax]
call fcn.00476158
mov ebx, 0x14
mov eax, dword [0x4f6634]
mov eax, dword [eax]
call fcn.00476158
push 0x64
call sub.kernel32.dll_Sleep_1
dec ebx
jne 0x4ec156
mov eax, dword [ebp - 0x40]
call fcn.0042e64c
mov eax, dword [ebp - 0x40]
call fcn.0040428c
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.004bcb04
lea eax, [ebp - 0x30]
push eax
xor ecx, ecx
mov edx, 0x4ec6c4
mov eax, dword [ebp - 0x14]
call fcn.0040a21c
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x30]
call fcn.00405fb4
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x14]
call fcn.0040c8ec
test al, al
jne 0x4ec1b9
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xdac
jl 0x4ec202
lea eax, [ebp - 0x880]
mov ecx, 0x4ec7e4
mov edx, dword [ebp - 8]
call fcn.0040631c
mov eax, dword [ebp - 0x880]
mov edx, 0x4ec7fc
call fcn.004ed3e0
mov edx, eax
lea eax, [ebp - 0x87c]
call fcn.0040610c
mov eax, dword [ebp - 0x87c]
lea edx, [ebp - 0xc]
call fcn.0040ba28
jmp 0x4ec22c
mov edx, 0x4ec7fc
mov eax, 0x4ec850
call fcn.004ed3e0
mov edx, eax
lea eax, [ebp - 0x884]
call fcn.0040610c
mov eax, dword [ebp - 0x884]
lea edx, [ebp - 0xc]
call fcn.0040ba28
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4ec249
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4ec249
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004056d0
test eax, eax
je 0x4ec252
sub eax, 4
mov eax, dword [eax]
cmp eax, 5
jg 0x4ec25f
mov eax, dword [ebp - 8]
call fcn.004ece00
cmp dword [ebp - 0x34], 0xdac
jl 0x4ec2a8
lea eax, [ebp - 0x88c]
mov ecx, 0x4ec7e4
mov edx, dword [ebp - 8]
call fcn.0040631c
mov eax, dword [ebp - 0x88c]
mov edx, 0x4ec7fc
call fcn.004ed3e0
mov edx, eax
lea eax, [ebp - 0x888]
call fcn.0040610c
mov eax, dword [ebp - 0x888]
lea edx, [ebp - 0xc]
call fcn.0040ba28
jmp 0x4ec2d2
mov edx, 0x4ec7fc
mov eax, 0x4ec850
call fcn.004ed3e0
mov edx, eax
lea eax, [ebp - 0x890]
call fcn.0040610c
mov eax, dword [ebp - 0x890]
lea edx, [ebp - 0xc]
call fcn.0040ba28
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4ec2ef
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4ec2ef
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004056d0
test eax, eax
je 0x4ec2f8
sub eax, 4
mov eax, dword [eax]
cmp eax, 5
jg 0x4ec34a
push 0
push 0
push 0x4ec830
mov eax, dword [ebp - 0x18]
call fcn.00405fec
push eax
push 0x4ec7cc
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [0x4f6634]
mov eax, dword [eax]
call fcn.00476158
mov ebx, 0x14
mov eax, dword [0x4f6634]
mov eax, dword [eax]
call fcn.00476158
push 0x64
call sub.kernel32.dll_Sleep_1
dec ebx
jne 0x4ec32c
mov eax, dword [ebp - 8]
call fcn.004ece00
xor ebx, ebx
cmp dword [ebp - 0x34], 0xdac
jl 0x4ec395
lea eax, [ebp - 0x898]
mov ecx, 0x4ec7e4
mov edx, dword [ebp - 8]
call fcn.0040631c
mov eax, dword [ebp - 0x898]
mov edx, 0x4ec7fc
call fcn.004ed3e0
mov edx, eax
lea eax, [ebp - 0x894]
call fcn.0040610c
mov eax, dword [ebp - 0x894]
lea edx, [ebp - 0xc]
call fcn.0040ba28
jmp 0x4ec3bf
mov edx, 0x4ec7fc
mov eax, 0x4ec850
call fcn.004ed3e0
mov edx, eax
lea eax, [ebp - 0x89c]
call fcn.0040610c
mov eax, dword [ebp - 0x89c]
lea edx, [ebp - 0xc]
call fcn.0040ba28
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4ec3dc
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4ec3dc
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004056d0
test eax, eax
je 0x4ec3e5
sub eax, 4
mov eax, dword [eax]
cmp eax, 5
jle 0x4ec3ec
mov bl, 1
lea edx, [ebp - 0x8a0]
mov eax, dword [ebp - 0x18]
call fcn.0040d03c
mov edx, dword [ebp - 0x8a0]
lea eax, [ebp - 0x24]
mov ecx, 0x4ec874
call fcn.0040631c
lea edx, [ebp - 0x8a4]
mov eax, dword [0x4f6634]
mov eax, dword [eax]
call fcn.00476948
mov eax, dword [ebp - 0x8a4]
lea edx, [ebp - 0x20]
call fcn.0040d03c
lea eax, [ebp - 0x8a8]
mov ecx, 0x4ec898
mov edx, dword [ebp - 0x20]
call fcn.0040631c
mov eax, dword [ebp - 0x8a8]
call fcn.0040cd44
test al, al
je 0x4ec67c
lea eax, [ebp - 0x8ac]
mov ecx, 0x4ec8c4
mov edx, dword [ebp - 0x20]
call fcn.0040631c
mov eax, dword [ebp - 0x8ac]
call fcn.0040cd44
test al, al
je 0x4ec67c
lea eax, [ebp - 0x8b0]
mov ecx, 0x4ec8e4
mov edx, dword [ebp - 0x20]
call fcn.0040631c
mov eax, dword [ebp - 0x8b0]
call fcn.0040cd44
test al, al
je 0x4ec67c
lea eax, [ebp - 0x8b4]
mov ecx, 0x4ec904
mov edx, dword [ebp - 0x20]
call fcn.0040631c
mov eax, dword [ebp - 0x8b4]
call fcn.0040cd44
test al, al
je 0x4ec67c
lea eax, [ebp - 0x8b8]
mov ecx, 0x4ec924
mov edx, dword [ebp - 0x20]
call fcn.0040631c
mov eax, dword [ebp - 0x8b8]
call fcn.0040cd44
test al, al
je 0x4ec67c
lea eax, [ebp - 0x8bc]
mov ecx, 0x4ec944
mov edx, dword [ebp - 0x20]
call fcn.0040631c
mov eax, dword [ebp - 0x8bc]
call fcn.0040cd44
test al, al
je 0x4ec67c
mov eax, dword [ebp - 0x24]
call fcn.0040cdb0
lea eax, [ebp - 0x24]
mov edx, 0x4ec7b4
call fcn.0040629c
lea eax, [ebp - 0x8c0]
mov ecx, 0x4ec898
mov edx, dword [ebp - 0x24]
call fcn.0040631c
mov eax, dword [ebp - 0x8c0]
push eax
lea eax, [ebp - 0x8c4]
mov ecx, 0x4ec898
mov edx, dword [ebp - 0x20]
call fcn.0040631c
mov eax, dword [ebp - 0x8c4]
pop edx
call fcn.004bc8c4
lea eax, [ebp - 0x8c8]
mov ecx, 0x4ec8c4
mov edx, dword [ebp - 0x24]
call fcn.0040631c
mov eax, dword [ebp - 0x8c8]
push eax
lea eax, [ebp - 0x8cc]
mov ecx, 0x4ec8c4
mov edx, dword [ebp - 0x20]
call fcn.0040631c
mov eax, dword [ebp - 0x8cc]
pop edx
call fcn.004bc8c4
lea eax, [ebp - 0x8d0]
mov ecx, 0x4ec8e4
mov edx, dword [ebp - 0x24]
call fcn.0040631c
mov eax, dword [ebp - 0x8d0]
push eax
lea eax, [ebp - 0x8d4]
mov ecx, 0x4ec8e4
mov edx, dword [ebp - 0x20]
call fcn.0040631c
mov eax, dword [ebp - 0x8d4]
pop edx
call fcn.004bc8c4
lea eax, [ebp - 0x8d8]
mov ecx, 0x4ec904
mov edx, dword [ebp - 0x24]
call fcn.0040631c
mov eax, dword [ebp - 0x8d8]
push eax
lea eax, [ebp - 0x8dc]
mov ecx, 0x4ec904
mov edx, dword [ebp - 0x20]
call fcn.0040631c
mov eax, dword [ebp - 0x8dc]
pop edx
call fcn.004bc8c4
lea eax, [ebp - 0x8e0]
mov ecx, 0x4ec924
mov edx, dword [ebp - 0x24]
call fcn.0040631c
mov eax, dword [ebp - 0x8e0]
push eax
lea eax, [ebp - 0x8e4]
mov ecx, 0x4ec924
mov edx, dword [ebp - 0x20]
call fcn.0040631c
mov eax, dword [ebp - 0x8e4]
pop edx
call fcn.004bc8c4
lea eax, [ebp - 0x8e8]
mov ecx, 0x4ec944
mov edx, dword [ebp - 0x24]
call fcn.0040631c
mov eax, dword [ebp - 0x8e8]
push eax
lea eax, [ebp - 0x8ec]
mov ecx, 0x4ec944
mov edx, dword [ebp - 0x20]
call fcn.0040631c
mov eax, dword [ebp - 0x8ec]
pop edx
call fcn.004bc8c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec6ae
lea eax, [ebp - 0x8ec]
mov edx, 0x2a
call fcn.00405f58
lea eax, [ebp - 0x30]
mov edx, 0xc
call fcn.00405f58
ret