Function at 0x463afc
Capabilities:
Copy file
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x15
push 0
push 0
dec ecx
jne 0x463b04
push ebx
mov ebx, dword [0x469830]
xor eax, eax
push ebp
push 0x4640f6
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0044c254
mov dl, 1
mov eax, dword [0x41fd00]
call fcn.0041fdb4
mov edx, dword [0x4698d8]
mov dword [edx], eax
mov ecx, dword [0x4698d8]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x420c20]
call fcn.00420c74
mov edx, dword [0x469888]
mov dword [edx], eax
mov eax, dword [0x469888]
mov eax, dword [eax]
push eax
push 0
push 0
mov ecx, dword [0x4698d8]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x4499e8]
call fcn.00449e8c
mov edx, dword [0x469654]
mov dword [edx], eax
mov eax, dword [0x469888]
mov eax, dword [eax]
push eax
push 0
push 0
mov ecx, dword [0x4698d8]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x422a34]
call fcn.00422ab4
mov edx, dword [0x4698c0]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x45d8b0]
call fcn.0045d90c
mov dword [ebx], eax
mov word [ebp - 2], 0x27f
wait
fnstcw word [ebp - 2]
fldcw word [ebp - 2]
push 0
lea eax, [ebp - 0x1c]
call fcn.0044bf1c
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, 0x46410c
call fcn.0041d440
mov edx, dword [ebp - 0x20]
pop eax
call fcn.00404f4c
mov eax, dword [ebp - 0x1c]
call fcn.00405110
push eax
lea eax, [ebp - 0x24]
call fcn.0044bf1c
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x464124
call fcn.0041d440
mov edx, dword [ebp - 0x28]
pop eax
call fcn.00404f4c
mov eax, dword [ebp - 0x24]
call fcn.00405110
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x463c8a
lea eax, [ebp - 0x30]
call fcn.0044bf1c
lea eax, [ebp - 0x30]
push eax
lea edx, [ebp - 0x34]
mov eax, 0x46410c
call fcn.0041d440
mov edx, dword [ebp - 0x34]
pop eax
call fcn.00404f4c
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x2c]
xor edx, edx
call fcn.0044da7c
mov eax, dword [ebp - 0x2c]
push eax
lea edx, [ebp - 0x38]
mov eax, 0x464138
call fcn.0041d440
mov edx, dword [ebp - 0x38]
pop eax
call fcn.004050a8
je 0x463ca6
lea edx, [ebp - 0x3c]
mov eax, 0x46414c
call fcn.0041d440
mov eax, dword [ebp - 0x3c]
call fcn.0044d45c
push 0
call sub.kernel32.dll_ExitProcess_1
lea edx, [ebp - 0x40]
mov eax, 0x464164
call fcn.0041d440
mov eax, dword [ebp - 0x40]
call fcn.0044d45c
push 0
call sub.kernel32.dll_ExitProcess_1
push 0
lea eax, [ebp - 0x44]
call fcn.0044bf1c
lea eax, [ebp - 0x44]
push eax
lea edx, [ebp - 0x48]
mov eax, 0x464180
call fcn.0041d440
mov edx, dword [ebp - 0x48]
pop eax
call fcn.00404f4c
mov eax, dword [ebp - 0x44]
call fcn.00405110
push eax
lea eax, [ebp - 0x4c]
call fcn.0044bf1c
lea eax, [ebp - 0x4c]
push eax
lea edx, [ebp - 0x50]
mov eax, 0x464198
call fcn.0041d440
mov edx, dword [ebp - 0x50]
pop eax
call fcn.00404f4c
mov eax, dword [ebp - 0x4c]
call fcn.00405110
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x463d70
lea eax, [ebp - 0x58]
call fcn.0044bf1c
lea eax, [ebp - 0x58]
push eax
lea edx, [ebp - 0x5c]
mov eax, 0x464180
call fcn.0041d440
mov edx, dword [ebp - 0x5c]
pop eax
call fcn.00404f4c
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x54]
xor edx, edx
call fcn.0044da7c
mov eax, dword [ebp - 0x54]
push eax
lea edx, [ebp - 0x60]
mov eax, 0x4641ac
call fcn.0041d440
mov edx, dword [ebp - 0x60]
pop eax
call fcn.004050a8
je 0x463d8c
lea edx, [ebp - 0x64]
mov eax, 0x4641c0
call fcn.0041d440
mov eax, dword [ebp - 0x64]
call fcn.0044d45c
push 0
call sub.kernel32.dll_ExitProcess_1
lea edx, [ebp - 0x68]
mov eax, 0x4641dc
call fcn.0041d440
mov eax, dword [ebp - 0x68]
call fcn.0044d45c
push 0
call sub.kernel32.dll_ExitProcess_1
mov edx, 0x463a58
mov eax, 0x4a8e1e
call fcn.0044bcfc
mov edx, 0x463ad4
mov eax, 0x4c4544
call fcn.0044bcfc
mov edx, 0x462a94
mov eax, 0x41a970
call fcn.0044bcfc
mov edx, 0x462ae4
mov eax, 0x434ad0
call fcn.0044bcfc
lea eax, [ebp - 0x6c]
call fcn.0044bf1c
mov eax, dword [ebp - 0x6c]
mov ecx, 0x10000000
mov edx, 0x4641fc
call fcn.00448b9c
test al, al
je 0x463e0c
mov eax, dword [0x4698b4]
mov eax, dword [eax]
mov ecx, 0x10000000
mov edx, 0x4641fc
call fcn.00448b9c
test al, al
je 0x463e0c
mov eax, 0x46420c
call fcn.0044d45c
jmp 0x463e16
mov eax, 0x464230
call fcn.0044d45c
call fcn.0044badc
test al, al
je 0x463e2b
mov eax, 0x464258
call fcn.0044d45c
jmp 0x463e35
mov eax, 0x464268
call fcn.0044d45c
lea eax, [ebp - 0x70]
call fcn.0044bf1c
lea eax, [ebp - 0x70]
mov edx, 0x464284
call fcn.00404f4c
mov eax, dword [ebp - 0x70]
call fcn.0040b668
test al, al
jne 0x463e97
push 1
mov edx, dword [0x4698b4]
mov edx, dword [edx]
lea eax, [ebp - 0x74]
mov ecx, 0x464294
call fcn.00404f98
mov eax, dword [ebp - 0x74]
call fcn.00405110
push eax
call sub.kernel32.dll_WinExec
lea edx, [ebp - 0x78]
mov eax, 0x4642ac
call fcn.0041d440
mov eax, dword [ebp - 0x78]
call fcn.0044d45c
push 0
call sub.kernel32.dll_ExitProcess_1
lea eax, [ebp - 0x7c]
call fcn.0044bf1c
lea eax, [ebp - 0x7c]
mov edx, 0x4642e0
call fcn.00404f4c
mov eax, dword [ebp - 0x7c]
call fcn.0040b668
test al, al
je 0x463edb
lea eax, [ebp - 0x80]
call fcn.0044bf1c
lea eax, [ebp - 0x80]
mov edx, 0x4642e0
call fcn.00404f4c
mov eax, dword [ebp - 0x80]
call fcn.00405110
push eax
call sub.kernel32.dll_DeleteFileA
lea edx, [ebp - 0xc]
mov eax, 1
call fcn.004034a8
call fcn.0040cbc0
fstp qword [ebp - 0x18]
wait
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 0x4642f8
call fcn.0040d7f4
lea eax, [ebp - 0x84]
mov ecx, 0x464304
mov edx, dword [ebp - 8]
call fcn.00404f98
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0xc]
call fcn.004050a8
je 0x463f6b
lea edx, [ebp - 0x88]
mov eax, 0x464310
call fcn.0041d440
mov eax, dword [ebp - 0x88]
call fcn.0044d45c
lea edx, [ebp - 0x90]
xor eax, eax
call fcn.004034a8
mov eax, dword [ebp - 0x90]
lea edx, [ebp - 0x8c]
call fcn.0040b7e4
mov eax, dword [ebp - 0x8c]
call fcn.0044bd24
lea edx, [ebp - 0x94]
mov eax, 2
call fcn.004034a8
mov eax, dword [ebp - 0x94]
push eax
lea edx, [ebp - 0x98]
mov eax, 0x464330
call fcn.0041d440
mov edx, dword [ebp - 0x98]
pop eax
call fcn.004050a8
jne 0x463fe4
lea eax, [ebp - 0x9c]
call fcn.0044bf1c
mov eax, dword [ebp - 0x9c]
call fcn.0040b94c
mov eax, dword [0x4696e4]
cmp dword [eax], 0
jne 0x463fcc
mov eax, dword [0x4696e4]
xor edx, edx
call fcn.004511c4
mov eax, dword [0x4696e4]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
call fcn.0044ff8c
mov byte [0x4695ac], 1
jmp 0x464036
lea edx, [ebp - 0xa0]
mov eax, 2
call fcn.004034a8
mov eax, dword [ebp - 0xa0]
push eax
lea edx, [ebp - 0xa4]
mov eax, 0x464348
call fcn.0041d440
mov edx, dword [ebp - 0xa4]
pop eax
call fcn.004050a8
jne 0x464036
lea eax, [ebp - 0xa8]
call fcn.0044bf1c
mov eax, dword [ebp - 0xa8]
call fcn.0040b94c
mov byte [0x4695ac], 1
push 0x4636ec
push 0x3e8
push 0
push 0
call sub.user32.dll_SetTimer
mov edx, dword [0x469708]
mov dword [edx], eax
push 0x463948
push 0x1388
push 0
push 0
call sub.user32.dll_SetTimer
mov edx, dword [0x4697d8]
mov dword [edx], eax
push 0x45f7c8
push 0xdbba0
push 0
push 0
call sub.user32.dll_SetTimer
mov edx, dword [0x469874]
mov dword [edx], eax
call fcn.004266fc
mov eax, dword [ebx]
call fcn.0045d9ac
mov eax, dword [ebx]
call fcn.0045d9ac
mov eax, dword [ebx]
call fcn.0045d9ac
mov eax, dword [ebx]
call fcn.0045d9ac
mov eax, dword [ebx]
call fcn.0045d9ac
mov eax, dword [ebx]
call fcn.0045d9ac
mov eax, dword [ebx]
call fcn.0045d9ac
mov eax, dword [ebx]
call fcn.0045d9ac
mov eax, dword [ebx]
call fcn.0045d9ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4640fd
lea eax, [ebp - 0xa8]
mov edx, 0x24
call fcn.00404ca4
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404ca4
ret