Function at 0x42ecf0
Capabilities:
Copy file
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x492f81
mov eax, dword fs:[0]
push eax
sub esp, 0xef0
mov eax, dword [0x4b0650]
xor eax, esp
mov dword [esp + 0xeec], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b0650]
xor eax, esp
push eax
lea eax, [esp + 0xf04]
mov dword fs:[0], eax
xor ebp, ebp
lea eax, [esp + 0x148]
push ebp
push eax
call fcn.00435df0
add esp, 8
cmp dword [esp + 0x15c], ebp
mov dword [esp + 0xf0c], ebp
jne 0x42ed71
cmp dword [esp + 0x160], 0x10
jb 0x42f775
mov ecx, dword [esp + 0x14c]
push ecx
call fcn.004604e8
add esp, 4
jmp 0x42f775
lea edx, [esp + 0xd8]
push ebp
push edx
call fcn.00435d40
add esp, 8
cmp dword [esp + 0xec], ebp
mov byte [esp + 0xf0c], 1
jne 0x42edd4
mov esi, 0x10
cmp dword [esp + 0xf0], esi
jb 0x42edb1
mov eax, dword [esp + 0xdc]
push eax
call fcn.004604e8
add esp, 4
cmp dword [esp + 0x160], esi
mov dword [esp + 0xf0], 0xf
mov dword [esp + 0xec], ebp
mov byte [esp + 0xdc], 0
jmp 0x42ed56
push str.dlcore.dll
lea edx, [esp + 0x14c]
push edx
lea eax, [esp + 0x134]
push eax
call fcn.00409f50
push str._tnproxy.dll
lea ecx, [esp + 0x158]
push ecx
lea edx, [esp + 0x1b0]
push edx
mov byte [esp + 0xf24], 2
call fcn.00409f50
push str.extract.dll
lea eax, [esp + 0x164]
push eax
lea ecx, [esp + 0x1a0]
push ecx
mov byte [esp + 0xf30], 3
call fcn.00409f50
add esp, 0x24
mov eax, dword [esp + 0xdc]
mov ebx, 0x10
cmp dword [esp + 0xf0], ebx
mov byte [esp + 0xf0c], 4
jae 0x42ee59
lea eax, [esp + 0xdc]
push eax
lea ecx, [esp + 0x22c]
call fcn.00430ae0
xor eax, eax
lea edx, [esp + 0xef8]
push edx
lea ecx, [esp + 0x22c]
mov byte [esp + 0xf10], 5
mov word [esp + 0xefc], bp
mov dword [esp + 0xefe], eax
mov word [esp + 0xf02], ax
call fcn.004306c0
movzx esi, word [esp + 0xefc]
push ebp
mov edi, 0xf
push 0x49a44b
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebp
mov byte [esp + 0x24], 0
call fcn.00404a30
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0xf8]
push ecx
mov byte [esp + 0xf14], 6
call fcn.00435680
add esp, 8
cmp dword [esp + 0x30], ebx
mov byte [esp + 0xf0c], 8
jb 0x42eefc
mov edx, dword [esp + 0x1c]
push edx
call fcn.004604e8
add esp, 4
cmp dword [esp + 0x108], ebp
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x1c], 0
jne 0x42f037
cmp dword [esp + 0x10c], ebx
jb 0x42ef2f
mov eax, dword [esp + 0xf8]
push eax
call fcn.004604e8
add esp, 4
lea ecx, [esp + 0x228]
mov dword [esp + 0x10c], edi
mov dword [esp + 0x108], ebp
mov byte [esp + 0xf8], 0
mov byte [esp + 0xf0c], 4
call fcn.00430730
cmp dword [esp + 0x198], ebx
jb 0x42ef72
mov ecx, dword [esp + 0x184]
push ecx
call fcn.004604e8
add esp, 4
cmp dword [esp + 0x1b4], ebx
mov dword [esp + 0x198], edi
mov dword [esp + 0x194], ebp
mov byte [esp + 0x184], 0
jb 0x42efa1
mov edx, dword [esp + 0x1a0]
push edx
call fcn.004604e8
add esp, 4
cmp dword [esp + 0x144], ebx
mov dword [esp + 0x1b4], edi
mov dword [esp + 0x1b0], ebp
mov byte [esp + 0x1a0], 0
jb 0x42efd0
mov eax, dword [esp + 0x130]
push eax
call fcn.004604e8
add esp, 4
cmp dword [esp + 0xf0], ebx
mov dword [esp + 0x144], edi
mov dword [esp + 0x140], ebp
mov byte [esp + 0x130], 0
jb 0x42efff
mov ecx, dword [esp + 0xdc]
push ecx
call fcn.004604e8
add esp, 4
cmp dword [esp + 0x160], ebx
mov dword [esp + 0xf0], edi
mov dword [esp + 0xec], ebp
mov byte [esp + 0xdc], 0
jb 0x42f775
mov edx, dword [esp + 0x14c]
push edx
call fcn.004604e8
add esp, 4
jmp 0x42f775
lea eax, [esp + 0xf4]
push esi
push eax
call fcn.0042e8c0
add esp, 8
test al, al
je 0x42f719
push 1
push 3
lea ecx, [esp + 0x58]
call fcn.00407ff0
push esi
push 0x49a4f0
lea ecx, [esp + 0xfc]
push ecx
lea edx, [esp + 0x64]
mov bl, 9
push edx
mov byte [esp + 0xf1c], bl
call fcn.00407c90
add esp, 8
push eax
call fcn.0042d5c0
add esp, 8
mov ecx, eax
call fcn.0042d460
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x54]
call fcn.00405730
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x100]
mov byte [esp + 0xf18], 0xa
call fcn.00404950
lea ecx, [esp + 0x34]
mov byte [esp + 0xf0c], bl
call fcn.00417660
lea ecx, [esp + 0xf4]
push ecx
call fcn.00435070
add esp, 4
test al, al
jne 0x42f0eb
lea edx, [esp + 0xf4]
push edx
call fcn.004351d0
add esp, 4
push 0x49b628
lea eax, [esp + 0xf8]
push eax
lea ecx, [esp + 0x118]
push ecx
call fcn.00409f50
push str.dlcore.dll
lea edx, [esp + 0x104]
push edx
lea eax, [esp + 0x178]
push eax
mov byte [esp + 0xf24], 0xb
call fcn.00409f50
push str._tnproxy.dll
lea ecx, [esp + 0x110]
push ecx
lea edx, [esp + 0x22c]
push edx
mov byte [esp + 0xf30], 0xc
call fcn.00409f50
push str.extract.dll
lea eax, [esp + 0x11c]
push eax
lea ecx, [esp + 0x21c]
push ecx
mov byte [esp + 0xf3c], 0xd
call fcn.00409f50
add esp, 0x30
cmp dword [esp + 0x128], 0x10
mov ecx, dword [esp + 0x114]
mov byte [esp + 0xf0c], 0xe
jae 0x42f18e
lea ecx, [esp + 0x114]
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, 0x10
cmp dword [esp + 0xf0], esi
jb 0x42f1c0
mov eax, dword [esp + 0xdc]
cmp eax, ebp
je 0x42f1c9
cmp ecx, ebp
je 0x42f1c9
push ebp
push ecx
push eax
call edi
cmp eax, 1
sete byte [esp + 0x16]
jmp 0x42f1ce
lea eax, [esp + 0xdc]
jmp 0x42f1ad
mov byte [esp + 0x16], 0
cmp dword [esp + 0x17c], esi
mov dl, byte [esp + 0x16]
mov eax, dword [esp + 0x168]
mov byte [esp + 0x17], dl
mov bl, 1
jae 0x42f1ef
lea eax, [esp + 0x168]
push eax
call fcn.00412e50
add esp, 4
test al, al
je 0x42f2fa
cmp dword [esp + 0x144], esi
mov eax, dword [esp + 0x130]
jae 0x42f217
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x66c]
call fcn.00430ae0
xor eax, eax
mov dword [esp + 0xef2], eax
mov word [esp + 0xef6], ax
lea eax, [esp + 0xef0]
push eax
lea ecx, [esp + 0x66c]
mov byte [esp + 0xf10], 0xf
mov word [esp + 0xef4], bp
call fcn.004306c0
cmp dword [esp + 0x17c], 0x10
movzx esi, word [esp + 0xef4]
mov eax, dword [esp + 0x168]
jae 0x42f279
lea eax, [esp + 0x168]
push eax
lea ecx, [esp + 0xaac]
call fcn.00430ae0
lea ecx, [esp + 0xee8]
xor eax, eax
push ecx
lea ecx, [esp + 0xaac]
mov byte [esp + 0xf10], 0x10
mov word [esp + 0xeec], bp
mov dword [esp + 0xeee], eax
mov word [esp + 0xef2], ax
call fcn.004306c0
movzx eax, word [esp + 0xeec]
cmp esi, eax
jae 0x42f2c9
xor bl, bl
lea ecx, [esp + 0xaa8]
mov byte [esp + 0xf0c], 0xf
call fcn.00430730
lea ecx, [esp + 0x668]
mov byte [esp + 0xf0c], 0xe
call fcn.00430730
test bl, bl
mov esi, 0x10
je 0x42f332
cmp dword [esp + 0x17c], esi
mov ecx, dword [esp + 0x168]
jae 0x42f311
lea ecx, [esp + 0x168]
cmp dword [esp + 0x144], esi
jb 0x42f515
mov eax, dword [esp + 0x130]
cmp eax, ebp
je 0x42f332
cmp ecx, ebp
je 0x42f332
push ebp
push ecx
push eax
call edi
cmp dword [esp + 0x224], esi
mov ecx, dword [esp + 0x210]
jae 0x42f349
lea ecx, [esp + 0x210]
cmp dword [esp + 0x1b4], esi
jb 0x42f521
mov eax, dword [esp + 0x1a0]
cmp eax, ebp
je 0x42f36a
cmp ecx, ebp
je 0x42f36a
push ebp
push ecx
push eax
call edi
cmp dword [esp + 0x208], esi
mov ecx, dword [esp + 0x1f4]
jae 0x42f381
lea ecx, [esp + 0x1f4]
cmp dword [esp + 0x198], esi
jb 0x42f52d
mov eax, dword [esp + 0x184]
cmp eax, ebp
je 0x42f3a2
cmp ecx, ebp
je 0x42f3a2
push ebp
push ecx
push eax
call edi
lea edx, [esp + 0x1d4]
xor esi, esi
push edx
mov dword [esp + 0xef4], esi
call fcn.0042d260
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0x3c]
mov bl, 0x11
push ecx
mov byte [esp + 0xf18], bl
call fcn.004349a0
add esp, 0xc
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x11c]
mov byte [esp + 0xf18], 0x12
call fcn.00404950
lea ecx, [esp + 0x34]
mov byte [esp + 0xf0c], bl
call fcn.00417660
cmp dword [esp + 0x1e8], ebp
lea edi, [esi + 0x10]
je 0x42f46f
cmp dword [esp + 0x1ec], edi
mov eax, dword [esp + 0x1d8]
jae 0x42f421
lea eax, [esp + 0x1d8]
push eax
call fcn.00412e50
add esp, 4
test al, al
je 0x42f46f
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x1d8]
push eax
call fcn.00413430
add esp, 8
test al, al
je 0x42f46f
cmp dword [esp + 0x1ec], edi
mov eax, dword [esp + 0x1d8]
jae 0x42f461
lea eax, [esp + 0x1d8]
push 0x49b698
push eax
call fcn.00431070
add esp, 8
cmp dword [esp + 0x128], edi
mov eax, dword [esp + 0x114]
jae 0x42f486
lea eax, [esp + 0x114]
push eax
call fcn.00412e50
add esp, 4
test al, al
je 0x42f4c3
cmp dword [esp + 0x128], edi
mov eax, dword [esp + 0x114]
jae 0x42f4aa
lea eax, [esp + 0x114]
push ebp
push ebp
push str.__RegServer
push eax
push ebp
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
mov dword [esp + 0xef0], esi
push str.Installlog.txt
lea ecx, [esp + 0xf8]
push ecx
lea edx, [esp + 0x1c0]
push edx
call fcn.00409f50
add esp, 0xc
cmp byte [esp + 0x16], 0
mov byte [esp + 0xf0c], 0x13
je 0x42f59b
cmp esi, 0x20
jle 0x42f59b
cmp dword [esp + 0x1d0], edi
jb 0x42f539
mov eax, dword [esp + 0x1bc]
mov dword [esp + 0xee8], eax
jmp 0x42f547
lea eax, [esp + 0x130]
jmp 0x42f329
lea eax, [esp + 0x1a0]
jmp 0x42f361
lea eax, [esp + 0x184]
jmp 0x42f399
lea ecx, [esp + 0x1bc]
mov dword [esp + 0xee8], ecx
lea edx, [esp + 0xee8]
push edx
call fcn.0042ec80
mov esi, eax
add esp, 4
mov ecx, esi
call fcn.0042deb0
mov ecx, dword [esi]
push str.Install_OK__from
call fcn.0042d9e0
mov ecx, dword [esi]
lea eax, [esp + 0xd8]
push eax
call fcn.0042d7d0
mov ecx, dword [esi]
push str.__to
call fcn.0042d9e0
lea ecx, [esp + 0x110]
push ecx
mov ecx, dword [esi]
call fcn.0042d7d0
jmp 0x42f693
cmp dword [esp + 0x1d0], edi
jb 0x42f5b4
mov eax, dword [esp + 0x1bc]
mov dword [esp + 0xee8], eax
jmp 0x42f5c2
lea ecx, [esp + 0x1bc]
mov dword [esp + 0xee8], ecx
lea edx, [esp + 0xee8]
push edx
call fcn.0042ec80
mov esi, eax
add esp, 4
mov ecx, esi
call fcn.0042deb0
mov ecx, dword [esi]
push str.Install_Failed__from
call fcn.0042d9e0
mov ecx, dword [esi]
lea eax, [esp + 0xd8]
push eax
call fcn.0042d7d0
mov ecx, dword [esi]
push str.__to
call fcn.0042d9e0
lea ecx, [esp + 0x110]
push ecx
mov ecx, dword [esi]
call fcn.0042d7d0
movzx edx, byte [0x4b2c11]
push edx
mov ecx, esi
call fcn.0042e5b0
cmp dword [esp + 0x1d0], edi
jb 0x42f639
mov eax, dword [esp + 0x1bc]
mov dword [esp + 0xee8], eax
jmp 0x42f647
lea ecx, [esp + 0x1bc]
mov dword [esp + 0xee8], ecx
lea edx, [esp + 0xee8]
push edx
call fcn.0042ec80
mov esi, eax
add esp, 4
mov ecx, esi
call fcn.0042deb0
mov ecx, dword [esi]
push str.copy
call fcn.0042d9e0
mov ecx, dword [esi]
lea eax, [esp + 0x17]
push eax
call fcn.0042e110
mov ecx, dword [esi]
push str.__Reg
call fcn.0042d9e0
lea ecx, [esp + 0xef0]
push ecx
mov ecx, dword [esi]
call fcn.0042e310
movzx edx, byte [0x4b2c11]
push edx
mov ecx, esi
call fcn.0042e5b0
lea ecx, [esp + 0x1b8]
call fcn.00417660
lea ecx, [esp + 0x1d4]
call fcn.00417660
lea ecx, [esp + 0x1f0]
call fcn.00417660
lea ecx, [esp + 0x20c]
call fcn.00417660
lea ecx, [esp + 0x164]
call fcn.00417660
lea ecx, [esp + 0x110]
call fcn.00417660
lea ecx, [esp + 0xa4]
mov byte [esp + 0xf0c], 8
call fcn.004035e0
lea eax, [esp + 0xa4]
push eax
mov dword [esp + 0xa8], 0x49a288
call fcn.0047bd82
add esp, 4
lea ecx, [esp + 0xf4]
call fcn.00417660
lea ecx, [esp + 0x228]
mov byte [esp + 0xf0c], 4
call fcn.00430730
lea ecx, [esp + 0x180]
call fcn.00417660
lea ecx, [esp + 0x19c]
call fcn.00417660
lea ecx, [esp + 0x12c]
call fcn.00417660
lea ecx, [esp + 0xd8]
call fcn.00417660
lea ecx, [esp + 0x148]
call fcn.00417660
mov ecx, dword [esp + 0xf04]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xeec]
xor ecx, esp
call fcn.004604af
add esp, 0xefc
ret