Function at 0x401610
Capabilities:
Copy file
Create process on windows
Create process suspended
Get common file path

Disassembly:
sub esp, 0x598
mov edx, dword [0x4181dc]
mov eax, dword [esp + 0x59c]
lea ecx, [esp + 0x10]
push ebx
push esi
push edi
push 0
push ecx
push 0
push 0
push edx
mov dword [0x4181d8], eax
call fcn.0040a2e8
mov eax, dword [0x418204]
mov esi, 1
add esp, 0x14
cmp eax, esi
jle 0x401694
mov eax, dword [0x418208]
push 0xa
push str.idProcess
mov ecx, dword [eax + esi*4]
push ecx
call fcn.0040a2b0
add esp, 0xc
test eax, eax
je 0x401675
mov eax, dword [0x418204]
inc esi
cmp esi, eax
jl 0x40164d
jmp 0x401694
mov edx, dword [0x418208]
mov eax, dword [edx + esi*4]
add eax, 0xa
push eax
call fcn.0040a29c
mov esi, eax
add esp, 4
test esi, esi
jne 0x401770
lea ecx, [esp + 0x1c]
push str.uninst
push ecx
call fcn.00410240
add esp, 8
test eax, eax
je 0x4017fd
mov edx, dword [0x4181d8]
mov ebx, dword [sym.imp.USER32.dll_LoadStringA]
push 0x200
push 0x417fd4
push 0x7c
push edx
call ebx
push 1
push 1
mov ecx, 0x416e70
call fcn.00402ca0
mov edi, dword [0x4181dc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x416e74
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x416e70
call fcn.00403040
test al, al
push 0x200
jne 0x401750
mov edx, dword [0x4181d8]
lea ecx, [esp + 0x1a8]
push ecx
push 0x83
push edx
call ebx
mov ecx, dword [0x4181d4]
push 0x10
lea eax, [esp + 0x1a8]
push 0x417fd4
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x598
ret 0x10
push 0x417fd4
mov ecx, 0x416e70
call fcn.00402d50
call fcn.00401040
pop edi
pop esi
pop ebx
add esp, 0x598
ret 0x10
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x416e70
call fcn.004033b0
test al, al
push 0x200
jne 0x4017d6
mov eax, dword [0x4181d8]
lea edx, [esp + 0x1a8]
push edx
push 0x83
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
mov edx, dword [0x4181d4]
push 0x10
lea ecx, [esp + 0x1a8]
push 0x417fd4
push ecx
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x598
ret 0x10
push 0x417fd4
mov ecx, 0x416e70
call fcn.00402d50
call fcn.004013f0
call fcn.00401580
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x598
ret 0x10
lea eax, [esp + 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0xa0]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xa0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0xa4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xa4]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1ac]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea edx, [esp + 0xa0]
push esi
push edx
lea eax, [esp + 0x3ac]
push str.__s__idProcess_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x5c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x5c]
push ecx
push edx
push eax
push eax
push eax
push 1
push eax
mov dword [esp + 0x78], 0x44
push eax
lea eax, [esp + 0x3c4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x598
ret 0x10