Function at 0x401550
Capabilities:
Get common file path
Move file
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x14a4
call fcn.00414250
mov eax, dword [0x41d008]
xor eax, esp
mov dword [esp + 0x14a0], eax
mov edx, dword [ebp + 0x10]
xor eax, eax
push ebx
mov ecx, edx
mov dword [esp + 0x70], 0
push esi
push edi
mov dword [esp + 0x7c], 7
mov word [esp + 0x68], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401590
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x70]
call fcn.00402510
cmp dword [esp + 0x7c], 8
lea edx, [esp + 0x68]
mov eax, dword [esp + 0x78]
lea ebx, [esp + 0x68]
cmovae edx, dword [esp + 0x68]
lea ecx, [esp + 0x50]
cmovae ebx, dword [esp + 0x68]
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0xf
lea esi, [edx + eax*2]
mov byte [esp + 0x50], 0
mov eax, esi
sub eax, ebx
sar eax, 1
push eax
call fcn.00402d70
push dword [esp + 0x10]
lea ecx, [esp + 0x54]
push esi
push ebx
call fcn.00402f10
cmp dword [esp + 0x64], 0x10
lea ecx, [esp + 0x50]
mov ebx, dword [esp + 0x50]
cmovae ecx, ebx
cmp dword [esp + 0x60], 2
jne 0x40162d
movzx eax, byte [ecx]
cmp al, 0x2f
jne 0x401624
cmp byte [ecx + 1], 0x73
jne 0x401624
xor eax, eax
jmp 0x401629
sbb eax, eax
or eax, 1
test eax, eax
je 0x40164a
push 0x34
push 0x41aa7c
push str.Are_You_sure_you_want_to_run_this_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x401f3f
call fcn.00401150
mov ecx, eax
test ecx, ecx
je 0x401fc8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x44], eax
lea eax, [esp + 0x2a0]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x98]
push eax
push 0
push 0x41aae0
lea eax, [esp + 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [esp + 0x98]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4016a0
sub ecx, edx
lea eax, [esp + 0x98]
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.00402ad0
call fcn.00401150
mov ecx, eax
test ecx, ecx
je 0x401fd2
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, 1
sub ecx, dword [eax + 0xc]
lea esi, [eax + 0x10]
mov eax, dword [esi - 8]
sub eax, 0x104
mov dword [esp + 0x4c], esi
or eax, ecx
jge 0x401702
push 0x104
lea ecx, [esp + 0x50]
call fcn.00402c20
mov esi, dword [esp + 0x4c]
cmp dword [esi - 8], 0x104
jl 0x401fdc
push 0x104
xor eax, eax
mov dword [esi - 0xc], 0x104
push esi
push eax
mov word [esi + 0x208], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401738
call ebx
push dword [esi - 8]
push esi
call fcn.004071d3
add esp, 8
test eax, eax
js 0x401fdc
cmp eax, dword [esi - 8]
jg 0x401fdc
xor ecx, ecx
mov dword [esi - 0xc], eax
push ecx
push 0x80
push 3
push ecx
push 1
push 0x80000000
push esi
mov word [esi + eax*2], cx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, eax
push 2
push 0
push 0xfffffffffffffffc
push edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x58], 0
mov dword [esp + 0x50], 0
call esi
cmp eax, 0xffffffff
jne 0x4017a1
call ebx
push 0
lea eax, [esp + 0x4c]
push eax
push 4
lea eax, [esp + 0x4c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4017bc
call ebx
mov eax, dword [esp + 0x40]
add eax, dword [esp + 0x48]
push 2
push 0
neg eax
push eax
push edi
call esi
cmp eax, 0xffffffff
jne 0x4017d5
call ebx
call fcn.00401150
mov ecx, eax
test ecx, ecx
je 0x401fe6
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, 1
sub ecx, dword [eax + 0xc]
lea esi, [eax + 0x10]
mov eax, dword [esi - 8]
sub eax, 0x104
mov dword [esp + 0x3c], esi
or eax, ecx
jge 0x401816
push 0x104
lea ecx, [esp + 0x40]
call fcn.00402c20
mov esi, dword [esp + 0x3c]
cmp dword [esi - 8], 0x104
jl 0x401ff0
xor eax, eax
mov dword [esi - 0xc], 0x104
push eax
mov word [esi + 0x208], ax
lea eax, [esp + 0x4c]
push eax
push 0x104
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40184c
call ebx
push dword [esi - 8]
push esi
call fcn.004071d3
add esp, 8
test eax, eax
js 0x401fdc
cmp eax, dword [esi - 8]
jg 0x401fdc
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov dword [esp + 0x18], ecx
cmp dword [esi - 0xc], ecx
jl 0x401b6d
push 0x41aae8
push esi
call fcn.00404e16
add esp, 8
test eax, eax
je 0x401b6d
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x401b6d
mov eax, dword [esi - 0xc]
mov dword [esp + 0xc], eax
inc eax
push eax
mov dword [esp + 0x1c], eax
call fcn.004071c8
mov edi, eax
lea ebx, [esi - 0x10]
add esp, 4
mov dword [esp + 0x10], ebx
mov dword [edi], 0
mov ecx, dword [ebx]
mov edx, dword [ecx]
call dword [edx + 0x10]
cmp dword [ebx + 0xc], 0
mov ecx, eax
lea eax, [ebx + 0xc]
jl 0x4018e3
cmp ecx, dword [ebx]
jne 0x4018e3
mov esi, ebx
lock inc dword [eax]
jmp 0x401910
mov eax, dword [ecx]
push 2
push dword [ebx + 4]
call dword [eax]
mov esi, eax
test esi, esi
je 0x401ffa
mov eax, dword [ebx + 4]
lea ecx, [esi + 0x10]
mov dword [esi + 4], eax
lea eax, [ebx + 0x10]
mov edx, dword [ebx + 4]
inc edx
push edx
push eax
call fcn.00402a40
add esp, 8
add esi, 0x10
mov dword [esp + 0x34], esi
cmp dword [esi - 4], 1
jle 0x40192d
push dword [esi - 0xc]
lea ecx, [esp + 0x38]
call fcn.004027a0
mov esi, dword [esp + 0x34]
push 0
push 0
push dword [esp + 0x20]
push edi
push dword [esp + 0x1c]
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x401960
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, edi
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0xf
mov byte [esp + 0x80], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401983
sub ecx, edx
push ecx
push edi
lea ecx, [esp + 0x88]
call fcn.00402660
push edi
call fcn.00406f14
sub esp, 0x14
mov ecx, esp
push 7
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.console
mov byte [ecx], 0
call fcn.00402660
sub esp, 0x18
lea eax, [esp + 0xb0]
mov ecx, esp
push eax
call fcn.00402310
lea ecx, [esp + 0x4c]
call fcn.004013c0
mov ebx, eax
add esp, 0x30
cmp dword [ebx + 0x14], 0x10
jb 0x4019ea
mov ebx, dword [ebx]
call fcn.00401150
mov ecx, eax
test ecx, ecx
je 0x401fff
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x34], esi
test ebx, ebx
je 0x401a7a
test ebx, 0xffff0000
jne 0x401a20
movzx eax, bx
lea ecx, [esp + 0x34]
push eax
call fcn.00402830
jmp 0x401a83
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax - 1]
test edi, edi
jle 0x401a7a
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x401a57
push edi
lea ecx, [esp + 0x38]
call fcn.00402c20
mov esi, dword [esp + 0x34]
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp edi, dword [esi - 8]
jg 0x401fdc
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
jmp 0x401a87
lea ecx, [esp + 0x34]
call fcn.00402bc0
mov esi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
cmp edx, 0x10
jb 0x401abd
mov ecx, dword [esp + 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x401ab3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402009
push edx
push ecx
call fcn.0040383a
add esp, 8
mov edi, dword [esp + 0x10]
lea ebx, [esi - 0x10]
cmp ebx, edi
je 0x401b0a
cmp dword [edi + 0xc], 0
jl 0x401afd
mov eax, dword [ebx]
cmp eax, dword [edi]
jne 0x401afd
mov ecx, ebx
call fcn.004029d0
mov esi, eax
lea edx, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x401af4
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
lea eax, [esi + 0x10]
mov dword [esp + 0x3c], eax
jmp 0x401b0a
push dword [esi - 0xc]
lea ecx, [esp + 0x40]
push esi
call fcn.00402ad0
mov dword [esp + 0x18], 1
or eax, 0xffffffff
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x401b27
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 0x94]
cmp edx, 0x10
jb 0x401b63
mov ecx, dword [esp + 0x80]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x401b59
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40200e
push edx
push ecx
call fcn.0040383a
add esp, 8
mov edi, dword [esp + 0x38]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
lea eax, [esp + 0x4c]
push eax
push 4
lea eax, [esp + 0x4c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401b88
call ebx
mov edi, dword [esp + 0x44]
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [esp + 0x40]
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov edi, eax
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov dword [esp + 0xc], eax
test ecx, ecx
jne 0x401bcb
mov ecx, 0x1000
jmp 0x401bf5
sub ecx, esi
mov eax, 0
sbb eax, ebx
test eax, eax
jb 0x401bf1
ja 0x401be2
cmp ecx, 0x1000
jbe 0x401bf1
mov ecx, 0x1000
mov dword [esp + 0x14], 0
jmp 0x401bf5
mov dword [esp + 0x14], eax
push 0
lea eax, [esp + 0x38]
mov dword [esp + 0x38], ecx
push eax
push ecx
lea eax, [esp + 0x4b4]
push eax
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x34]
test eax, eax
je 0x401c36
push 0
lea ecx, [esp + 0x38]
push ecx
push eax
lea eax, [esp + 0x4b4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x40]
add esi, eax
adc ebx, 0
test ebx, ebx
ja 0x401c51
jb 0x401c49
cmp esi, ecx
jae 0x401c51
test eax, eax
jne 0x401bc0
push dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x38]
call esi
mov edi, dword [esp + 0x44]
mov ecx, dword [edi - 0x10]
test ecx, ecx
je 0x401c79
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x401c8f
call fcn.00401150
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x402013
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edx, dword [edi - 0xc]
mov dword [esp + 0x38], edx
lea esi, [eax + 0x10]
lea ebx, [edx + 4]
mov dword [esp + 0xc], esi
test ebx, ebx
js 0x40201d
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, ebx
or eax, ecx
jge 0x401cd0
push ebx
lea ecx, [esp + 0x10]
call fcn.00402c20
mov esi, dword [esp + 0xc]
mov edx, dword [esp + 0x38]
push edx
push edi
mov ecx, esi
call fcn.00402a40
mov eax, dword [esp + 0x40]
mov edx, 4
push 4
push str..ps1
lea ecx, [esi + eax*2]
call fcn.00402a40
add esp, 0x10
cmp ebx, dword [esi - 8]
jg 0x401fdc
push esi
xor eax, eax
mov dword [esi - 0xc], ebx
push edi
mov word [esi + ebx*2], ax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x401d26
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi - 0xc]
mov ebx, str..ps1
push 4
sub ebx, edi
mov dword [esp + 0x10], esi
push str..ps1
sar ebx, 1
call fcn.004071d3
mov edx, eax
mov ecx, 0x7fffffff
sub ecx, edx
mov dword [esp + 0x18], edx
add esp, 8
cmp ecx, esi
jl 0x402027
add esi, edx
js 0x402031
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, esi
or eax, ecx
jge 0x401d85
push esi
lea ecx, [esp + 0x48]
call fcn.00402c20
mov edi, dword [esp + 0x44]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
lea ecx, [edi + ebx*2]
cmp ebx, eax
jbe 0x401d95
mov ecx, str..ps1
push edx
push ecx
lea ecx, [edi + eax*2]
call fcn.00402a40
add esp, 8
cmp esi, dword [edi - 8]
jg 0x401fdc
xor eax, eax
mov dword [edi - 0xc], esi
push edi
mov word [edi + esi*2], ax
lea eax, [esp + 0x40]
push str.__ExecutionPolicy_Bypass__file___s_
push eax
call fcn.00402cc0
add esp, 0xc
call fcn.00401150
mov ecx, eax
test ecx, ecx
je 0x40203b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], eax
mov eax, str._windir_System32WindowsPowerShell_v1.0powershell.exe
test eax, 0xffff0000
jne 0x401dfd
movzx eax, ax
push eax
call fcn.00402830
jmp 0x401e09
push 0x37
push str._windir_System32WindowsPowerShell_v1.0powershell.exe
call fcn.00402ad0
mov esi, dword [esp + 0x3c]
add esi, 0xfffffff0
push ecx
mov dword [esp + 0x14], esp
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x401e32
cmp ecx, dword [esi]
jne 0x401e32
mov ebx, esi
lock inc dword [eax]
jmp 0x401e5f
mov eax, dword [ecx]
push 2
push dword [esi + 4]
call dword [eax]
mov ebx, eax
test ebx, ebx
je 0x402045
mov eax, dword [esi + 4]
lea ecx, [ebx + 0x10]
mov dword [ebx + 4], eax
lea eax, [esi + 0x10]
mov edx, dword [esi + 4]
inc edx
push edx
push eax
call fcn.00402a40
add esp, 8
mov ecx, dword [esp + 0x14]
lea eax, [ebx + 0x10]
mov ebx, dword [esp + 0x3c]
add ebx, 0xfffffff0
push ecx
mov dword [ecx], eax
mov dword [esp + 0x14], esp
mov ecx, dword [ebx]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [ebx + 0xc], 0
lea edx, [ebx + 0xc]
mov ecx, eax
jl 0x401e91
cmp ecx, dword [ebx]
jne 0x401e91
mov eax, ebx
lock inc dword [edx]
jmp 0x401ec6
mov eax, dword [ecx]
push 2
push dword [ebx + 4]
call dword [eax]
mov ecx, eax
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x40204a
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
lea eax, [ebx + 0x10]
mov edx, dword [ebx + 4]
add ecx, 0x10
inc edx
push edx
push eax
call fcn.00402a40
mov eax, dword [esp + 0x20]
add esp, 8
mov edx, dword [esp + 0x14]
add eax, 0x10
mov ecx, dword [esp + 0x20]
mov dword [edx], eax
call fcn.00402060
add esp, 8
lea ecx, [ebx + 0xc]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x401ef2
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
or ebx, 0xffffffff
lea ecx, [esi + 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x401f0b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 0x4c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401f26
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x401f3b
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [esp + 0x50]
mov eax, dword [esp + 0x64]
cmp eax, 0x10
jb 0x401f73
lea ecx, [eax + 1]
mov eax, ebx
cmp ecx, 0x1000
jb 0x401f69
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40204f
push ecx
push ebx
call fcn.0040383a
add esp, 8
mov edx, dword [esp + 0x7c]
cmp edx, 8
jb 0x401faf
mov ecx, dword [esp + 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401fa5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402054
push edx
push ecx
call fcn.0040383a
add esp, 8
mov ecx, dword [esp + 0x14ac]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00403334
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00403200
push 0x80004005
call fcn.00403200
push 0x80070057
call fcn.00403200
push 0x80004005
call fcn.00403200
push 0x80070057
call fcn.00403200
call fcn.00402a30
push 0x80004005
call fcn.00403200
call fcn.004070eb
call fcn.004070eb
push 0x80004005
call fcn.00403200
push 0x80070057
call fcn.00403200
push 0x80070057
call fcn.00403200
push 0x80070057
call fcn.00403200
push 0x80004005
call fcn.00403200
call fcn.00402a30
call fcn.00402a30
call fcn.004070eb
call fcn.004070eb
int3