Function at 0x40aeb0
Capabilities:
Copy file
Create directory
Create process on windows
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432a06
mov eax, dword fs:[0]
push eax
mov eax, 0x1048
call fcn.00419050
mov eax, dword [0x449048]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xff8], eax
mov dword [ebp - 0xfd8], 0x44b718
mov ecx, dword [ebp - 0xfd8]
mov dword [ebp - 0x104c], ecx
mov edx, dword [ebp - 0xff8]
mov ax, word [edx]
mov word [ebp - 0xf9c], ax
mov ecx, dword [ebp - 0xfd8]
mov dx, word [ebp - 0xf9c]
mov word [ecx], dx
mov eax, dword [ebp - 0xff8]
add eax, 2
mov dword [ebp - 0xff8], eax
mov ecx, dword [ebp - 0xfd8]
add ecx, 2
mov dword [ebp - 0xfd8], ecx
cmp word [ebp - 0xf9c], 0
jne 0x40af00
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x1000], edx
mov dword [ebp - 0xfd4], 0x44b0f8
mov eax, dword [ebp - 0xfd4]
mov dword [ebp - 0x1048], eax
mov ecx, dword [ebp - 0x1000]
mov dx, word [ecx]
mov word [ebp - 0xf9e], dx
mov eax, dword [ebp - 0xfd4]
mov cx, word [ebp - 0xf9e]
mov word [eax], cx
mov edx, dword [ebp - 0x1000]
add edx, 2
mov dword [ebp - 0x1000], edx
mov eax, dword [ebp - 0xfd4]
add eax, 2
mov dword [ebp - 0xfd4], eax
cmp word [ebp - 0xf9e], 0
jne 0x40af67
push 0x208
push 0
lea ecx, [ebp - 0x620]
push ecx
call fcn.00419f90
add esp, 0xc
push 0x104
lea edx, [ebp - 0x620]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x620]
mov dword [ebp - 0x1004], eax
mov dword [ebp - 0xfb4], 0x44b300
mov ecx, dword [ebp - 0xfb4]
mov dword [ebp - 0x1044], ecx
mov edx, dword [ebp - 0x1004]
mov ax, word [edx]
mov word [ebp - 0xfa0], ax
mov ecx, dword [ebp - 0xfb4]
mov dx, word [ebp - 0xfa0]
mov word [ecx], dx
mov eax, dword [ebp - 0x1004]
add eax, 2
mov dword [ebp - 0x1004], eax
mov ecx, dword [ebp - 0xfb4]
add ecx, 2
mov dword [ebp - 0xfb4], ecx
cmp word [ebp - 0xfa0], 0
jne 0x40affb
push 0x5c
push 0x44b300
call fcn.00403230
add esp, 8
mov edx, 2
shl edx, 0
xor ecx, ecx
mov word [eax + edx], cx
push 0x208
push 0
lea edx, [ebp - 0x8f0]
push edx
call fcn.00419f90
add esp, 0xc
lea eax, [ebp - 0x620]
mov dword [ebp - 0xfe0], eax
lea ecx, [ebp - 0x8f0]
mov dword [ebp - 0xfb8], ecx
mov edx, dword [ebp - 0xfb8]
mov dword [ebp - 0x1040], edx
mov eax, dword [ebp - 0xfe0]
mov cx, word [eax]
mov word [ebp - 0xfa2], cx
mov edx, dword [ebp - 0xfb8]
mov ax, word [ebp - 0xfa2]
mov word [edx], ax
mov ecx, dword [ebp - 0xfe0]
add ecx, 2
mov dword [ebp - 0xfe0], ecx
mov edx, dword [ebp - 0xfb8]
add edx, 2
mov dword [ebp - 0xfb8], edx
cmp word [ebp - 0xfa2], 0
jne 0x40b09a
push 0x2e
lea eax, [ebp - 0x8f0]
push eax
call fcn.00403230
add esp, 8
mov ecx, 2
imul edx, ecx, 0
xor ecx, ecx
mov word [eax + edx], cx
push 0x5c
lea edx, [ebp - 0x8f0]
push edx
call fcn.00403230
add esp, 8
add eax, 2
mov dword [ebp - 0xfe4], eax
lea eax, [ebp - 0x8f0]
mov dword [ebp - 0xfbc], eax
mov ecx, dword [ebp - 0xfbc]
mov dword [ebp - 0x103c], ecx
mov edx, dword [ebp - 0xfe4]
mov ax, word [edx]
mov word [ebp - 0xfa4], ax
mov ecx, dword [ebp - 0xfbc]
mov dx, word [ebp - 0xfa4]
mov word [ecx], dx
mov eax, dword [ebp - 0xfe4]
add eax, 2
mov dword [ebp - 0xfe4], eax
mov ecx, dword [ebp - 0xfbc]
add ecx, 2
mov dword [ebp - 0xfbc], ecx
cmp word [ebp - 0xfa4], 0
jne 0x40b133
push 0x208
push 0
lea edx, [ebp - 0xaf8]
push edx
call fcn.00419f90
add esp, 0xc
push 0x5f
lea eax, [ebp - 0x8f0]
push eax
call fcn.00403230
add esp, 8
mov dword [ebp - 0x1014], eax
cmp dword [ebp - 0x1014], 0
je 0x40b220
mov ecx, dword [ebp - 0x1014]
add ecx, 2
mov dword [ebp - 0xfe8], ecx
lea edx, [ebp - 0xaf8]
mov dword [ebp - 0xfc0], edx
mov eax, dword [ebp - 0xfc0]
mov dword [ebp - 0x1054], eax
mov ecx, dword [ebp - 0xfe8]
mov dx, word [ecx]
mov word [ebp - 0xfa6], dx
mov eax, dword [ebp - 0xfc0]
mov cx, word [ebp - 0xfa6]
mov word [eax], cx
mov edx, dword [ebp - 0xfe8]
add edx, 2
mov dword [ebp - 0xfe8], edx
mov eax, dword [ebp - 0xfc0]
add eax, 2
mov dword [ebp - 0xfc0], eax
cmp word [ebp - 0xfa6], 0
jne 0x40b1d8
push 0x1fe
push 0
lea ecx, [ebp - 0x210]
push ecx
call fcn.00419f90
add esp, 0xc
push 0
push 0x1a
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
add eax, 0xfffffffe
mov dword [ebp - 0xfc4], eax
mov ecx, dword [ebp - 0xfc4]
mov dx, word [ecx + 2]
mov word [ebp - 0xff2], dx
add dword [ebp - 0xfc4], 2
cmp word [ebp - 0xff2], 0
jne 0x40b258
mov edi, dword [ebp - 0xfc4]
mov eax, dword [0x44219c]
mov dword [edi], eax
mov dword [ebp - 0xfac], 0x44b0f8
mov ecx, dword [ebp - 0xfac]
mov dword [ebp - 0x1018], ecx
mov edx, dword [ebp - 0xfac]
mov ax, word [edx]
mov word [ebp - 0xfea], ax
add dword [ebp - 0xfac], 2
cmp word [ebp - 0xfea], 0
jne 0x40b29d
mov ecx, dword [ebp - 0xfac]
sub ecx, dword [ebp - 0x1018]
mov edx, dword [ebp - 0x1018]
mov dword [ebp - 0x1034], edx
mov dword [ebp - 0x1030], ecx
lea eax, [ebp - 0x210]
add eax, 0xfffffffe
mov dword [ebp - 0xfc8], eax
mov ecx, dword [ebp - 0xfc8]
mov dx, word [ecx + 2]
mov word [ebp - 0xfec], dx
add dword [ebp - 0xfc8], 2
cmp word [ebp - 0xfec], 0
jne 0x40b2eb
mov edi, dword [ebp - 0xfc8]
mov esi, dword [ebp - 0x1034]
mov eax, dword [ebp - 0x1030]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x210]
add ecx, 0xfffffffe
mov dword [ebp - 0xfcc], ecx
mov edx, dword [ebp - 0xfcc]
mov ax, word [edx + 2]
mov word [ebp - 0xfee], ax
add dword [ebp - 0xfcc], 2
cmp word [ebp - 0xfee], 0
jne 0x40b33c
mov edi, dword [ebp - 0xfcc]
mov ecx, dword [0x442224]
mov dword [edi], ecx
push 0x208
push 0
lea edx, [ebp - 0x418]
push edx
call fcn.00419f90
add esp, 0xc
push 0x44b0f8
lea eax, [ebp - 0x210]
push eax
push 0x442228
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x208
push 0
lea edx, [ebp - 0xf08]
push edx
call fcn.00419f90
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push str._lsconfig
lea ecx, [ebp - 0xf08]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0xf08]
push edx
push 0x104
push 0x44aef0
push 0x442254
push 0x442258
push 0x442268
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.Works_
lea eax, [ebp - 0x620]
push eax
call fcn.00403250
add esp, 8
lea ecx, [ebp - 0x620]
push ecx
lea edx, [ebp - 0x418]
push edx
call fcn.0041cf7b
add esp, 8
test eax, eax
jne 0x40b47f
lea eax, [ebp - 0xaf8]
mov dword [ebp - 0xfb0], eax
mov ecx, dword [ebp - 0xfb0]
add ecx, 2
mov dword [ebp - 0x102c], ecx
mov edx, dword [ebp - 0xfb0]
mov ax, word [edx]
mov word [ebp - 0xff0], ax
add dword [ebp - 0xfb0], 2
cmp word [ebp - 0xff0], 0
jne 0x40b444
mov ecx, dword [ebp - 0xfb0]
sub ecx, dword [ebp - 0x102c]
sar ecx, 1
mov dword [ebp - 0x1028], ecx
je 0x40b852
mov byte [ebp - 0xf99], 0
push 6
lea edx, [ebp - 0x418]
push edx
call fcn.0041ccf3
add esp, 8
test eax, eax
je 0x40b619
push 6
lea eax, [ebp - 0x210]
push eax
call fcn.0041ccf3
add esp, 8
test eax, eax
je 0x40b60d
push 1
lea ecx, [ebp - 0xf64]
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov dword [ebp - 0xf6c], 0
lea edx, [ebp - 0xf6c]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0xf68], 0
mov dword [ebp - 0xfdc], 0
lea eax, [ebp - 0xf68]
push eax
push 0
push 0
push 6
mov ecx, dword [ebp - 0xf6c]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edx, dword [ebp - 0xf68]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xfdc], eax
lea eax, [ebp - 0xf68]
push eax
mov ecx, dword [ebp - 0xf68]
push ecx
mov edx, dword [ebp - 0xfdc]
push edx
push 6
mov eax, dword [ebp - 0xf6c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [ebp - 0xfdc]
mov dword [ebp - 0x1024], ecx
push 0
mov edx, dword [ebp - 0x1024]
mov eax, dword [edx]
push eax
push 1
lea ecx, [ebp - 0xf64]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [ebp - 0xf98], 0xc
mov dword [ebp - 0xf90], 0
lea edx, [ebp - 0xf64]
mov dword [ebp - 0xf94], edx
lea eax, [ebp - 0xf98]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40b60d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1020], eax
push 0xc8
push 0
lea edx, [ebp - 0x6e8]
push edx
call fcn.00419f90
add esp, 0xc
mov eax, dword [ebp - 0x1020]
push eax
push 0x442288
lea ecx, [ebp - 0x6e8]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x10
push 0x4422a8
lea edx, [ebp - 0x6e8]
push edx
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
or eax, 0xffffffff
jmp 0x40b93e
mov byte [ebp - 0xf99], 1
jmp 0x40b703
lea eax, [ebp - 0x418]
push eax
call sym.Adobe_Dreamweaver.exe_void____cdecl_FVOpen_wchar_t_const__
add esp, 4
mov dword [ebp - 0x100c], eax
mov ecx, dword [ebp - 0x100c]
push ecx
call sym.Adobe_Dreamweaver.exe_wchar_t_const____cdecl_FVGetFileVersion_void__
add esp, 4
push eax
lea ecx, [ebp - 0xf38]
call fcn.0040d280
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x100c]
push edx
call sym.Adobe_Dreamweaver.exe_void___cdecl_FVClose_void__
add esp, 4
lea eax, [ebp - 0x620]
push eax
call sym.Adobe_Dreamweaver.exe_void____cdecl_FVOpen_wchar_t_const__
add esp, 4
mov dword [ebp - 0x1010], eax
mov ecx, dword [ebp - 0x1010]
push ecx
call sym.Adobe_Dreamweaver.exe_wchar_t_const____cdecl_FVGetFileVersion_void__
add esp, 4
push eax
lea ecx, [ebp - 0xf50]
call fcn.0040d280
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1010]
push edx
call sym.Adobe_Dreamweaver.exe_void___cdecl_FVClose_void__
add esp, 4
lea ecx, [ebp - 0xf50]
call fcn.0040d120
mov esi, eax
lea ecx, [ebp - 0xf38]
call fcn.0040d120
cmp esi, eax
ja 0x40b6db
lea eax, [ebp - 0xf38]
push eax
lea ecx, [ebp - 0xf50]
push ecx
call fcn.0040f9b0
add esp, 8
movzx edx, al
test edx, edx
je 0x40b6e2
mov byte [ebp - 0xf99], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf50]
call fcn.0040d210
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf38]
call fcn.0040d210
movzx eax, byte [ebp - 0xf99]
test eax, eax
je 0x40b77c
xor ecx, ecx
mov dword [ebp - 0xf8c], ecx
mov dword [ebp - 0xf88], ecx
mov dword [ebp - 0xf84], ecx
mov dword [ebp - 0xf80], ecx
mov dword [ebp - 0xf7c], ecx
mov dword [ebp - 0xf78], ecx
mov dword [ebp - 0xf74], ecx
mov word [ebp - 0xf70], cx
mov edx, 0x210
mov word [ebp - 0xf7c], dx
mov dword [ebp - 0xf88], 2
lea eax, [ebp - 0x620]
mov dword [ebp - 0xf84], eax
lea ecx, [ebp - 0x418]
mov dword [ebp - 0xf80], ecx
lea edx, [ebp - 0xf8c]
push edx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
lea eax, [ebp - 0xaf8]
push eax
push 0x44aef0
call fcn.0041cf7b
add esp, 8
test eax, eax
je 0x40b81e
lea ecx, [ebp - 0xaf8]
mov dword [ebp - 0xffc], ecx
mov dword [ebp - 0xfd0], 0x44aef0
mov edx, dword [ebp - 0xfd0]
mov dword [ebp - 0x1050], edx
mov eax, dword [ebp - 0xffc]
mov cx, word [eax]
mov word [ebp - 0xfa8], cx
mov edx, dword [ebp - 0xfd0]
mov ax, word [ebp - 0xfa8]
mov word [edx], ax
mov ecx, dword [ebp - 0xffc]
add ecx, 2
mov dword [ebp - 0xffc], ecx
mov edx, dword [ebp - 0xfd0]
add edx, 2
mov dword [ebp - 0xfd0], edx
cmp word [ebp - 0xfa8], 0
jne 0x40b7ba
lea eax, [ebp - 0xf08]
push eax
push 0x44aef0
push str.channel
push str.product
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x418]
push ecx
call fcn.0040a130
add esp, 4
push 5
push 0
push 0x4422d0
lea edx, [ebp - 0x418]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or eax, 0xffffffff
jmp 0x40b93e
mov dword [ebp - 0x1038], 0x20c82f8
push 0x208
push 0
lea eax, [ebp - 0xd00]
push eax
call fcn.00419f90
add esp, 0xc
push 0x44b300
push str._lsnode.dll
lea ecx, [ebp - 0xd00]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0xd00]
push edx
call sym.Adobe_Dreamweaver.exe_void____cdecl_FVOpen_wchar_t_const__
add esp, 4
mov dword [ebp - 0x1008], eax
lea ecx, [ebp - 0xf20]
call fcn.0040d390
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1008], 0
je 0x40b8e6
mov eax, dword [ebp - 0x1008]
push eax
call sym.Adobe_Dreamweaver.exe_wchar_t_const____cdecl_FVGetFileVersion_void__
add esp, 4
push eax
lea ecx, [ebp - 0xf20]
call fcn.0040d180
mov ecx, dword [ebp - 0x1008]
push ecx
call sym.Adobe_Dreamweaver.exe_void___cdecl_FVClose_void__
add esp, 4
push str.2022
lea ecx, [ebp - 0xf20]
call fcn.0040d140
push eax
call fcn.00409d30
add esp, 8
movzx edx, al
test edx, edx
je 0x40b91c
lea eax, [ebp - 0xd00]
push eax
push 0x20c82f8
push 0x6e
call fcn.00409e00
add esp, 0xc
mov dword [ebp - 0x101c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf20]
call fcn.0040d210
mov eax, dword [ebp - 0x101c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00418129
mov esp, ebp
pop ebp
ret