Function at 0x4680e0
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504d60
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
push 0x468ad0
call fcn.004dbbc8
add esp, 4
mov byte [ebp - 0x11], 0
call fcn.004294f0
mov ecx, eax
call fcn.0048eb50
test al, al
jne 0x468151
mov eax, dword [ebp + 8]
test eax, eax
je 0x468592
mov dword [esi + 8], eax
mov ebx, dword [ebp + 0xc]
push ebx
lea ecx, [esi + 0xc]
call fcn.004199b0
jmp 0x468154
mov ebx, dword [ebp + 0xc]
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x28]
call fcn.00441cb0
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.004657f0
cmp byte [esi + 0x10], 0
jne 0x468525
mov byte [esi + 0x10], 1
mov ecx, esi
call fcn.00467a40
test al, al
je 0x468521
call fcn.00431060
mov ecx, eax
call fcn.004446f0
push 0x5422ee
lea ecx, [ebp - 0x18]
call fcn.0041ad50
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
push ecx
mov ecx, esi
call fcn.00466280
test al, al
je 0x468515
push 1
push 0
mov edi, dword [ebp - 0x18]
push edi
call fcn.0046dc30
add esp, 0xc
test al, al
je 0x468515
push 0x5422ee
lea ecx, [ebp + 8]
call fcn.0041ad50
mov byte [ebp - 4], 3
call fcn.004294f0
mov ecx, eax
call fcn.0048eb50
test al, al
je 0x46821c
lea edx, [ebp - 0x24]
push edx
call fcn.004294f0
mov ecx, eax
call fcn.0048f870
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp + 8]
call fcn.0041e3d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x24]
call fcn.00416630
jmp 0x46823e
cmp dword [esi + 8], 0
je 0x468565
lea eax, [esi + 0xc]
mov ecx, dword [eax]
cmp dword [ecx - 8], 1
jle 0x468565
push eax
lea ecx, [ebp + 8]
call fcn.0041e3d0
push 0x514670
lea ecx, [ebp + 8]
call fcn.0041d470
push str.ewallet.dat
lea ecx, [ebp + 8]
call fcn.0041d470
push 0
mov edx, dword [ebp + 8]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x468353
mov byte [ebp - 0x11], 1
call fcn.004294f0
mov ecx, eax
call fcn.0048eb50
test al, al
je 0x4682d0
push 0x51428c
lea ecx, [ebp + 0x10]
call fcn.0041ad50
mov bl, 5
mov byte [ebp - 4], bl
push str.EWalletRestoreSuccess
lea ecx, [ebp + 0xc]
call fcn.0041ad50
mov byte [ebp - 4], 6
push 0
push 0
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp + 0xc]
push ecx
call fcn.0044fcf0
mov ecx, eax
call fcn.004a4a40
mov byte [ebp - 4], bl
lea ecx, [ebp + 0xc]
call fcn.00416630
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x10]
jmp 0x468329
test ebx, ebx
je 0x46832e
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x46832e
push 0x51428c
lea ecx, [ebp - 0x1c]
call fcn.0041ad50
mov bl, 7
mov byte [ebp - 4], bl
push str.EWalletRestoreSuccess
lea ecx, [ebp + 0x10]
call fcn.0041ad50
mov byte [ebp - 4], 8
push edi
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0x10]
push ecx
call fcn.0044fcf0
mov ecx, eax
call fcn.004a4a40
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x10]
call fcn.00416630
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c]
call fcn.00416630
call fcn.0044fc50
mov ecx, eax
call fcn.00443740
test al, al
je 0x468509
call fcn.00431060
mov ecx, eax
call fcn.00446750
jmp 0x468509
call fcn.004294f0
mov ecx, eax
call fcn.0048eb50
test al, al
je 0x4683b2
push 0x51428c
lea ecx, [ebp + 0x10]
call fcn.0041ad50
mov bl, 9
mov byte [ebp - 4], bl
push str.EWalletRestoreFailure
lea ecx, [ebp + 0xc]
call fcn.0041ad50
mov byte [ebp - 4], 0xa
push 0
push 0
lea edx, [ebp + 0x10]
push edx
lea eax, [ebp + 0xc]
push eax
call fcn.0044fcf0
mov ecx, eax
call fcn.004a4a40
mov byte [ebp - 4], bl
lea ecx, [ebp + 0xc]
call fcn.00416630
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x10]
jmp 0x46840b
test ebx, ebx
je 0x468410
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x468410
push 0x51428c
lea ecx, [ebp - 0x20]
call fcn.0041ad50
mov bl, 0xb
mov byte [ebp - 4], bl
push str.EWalletRestoreFailure
lea ecx, [ebp + 0x10]
call fcn.0041ad50
mov byte [ebp - 4], 0xc
push edi
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.0044fcf0
mov ecx, eax
call fcn.004a4a40
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x10]
call fcn.00416630
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.00416630
push 0x15c0
lea ecx, [ebp - 0x24]
push ecx
call fcn.0042d4a0
mov ecx, eax
call fcn.0042d1d0
mov bl, 0xd
mov byte [ebp - 4], bl
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
lea edx, [ebp - 0x24]
push edx
call fcn.0041ea10
mov byte [ebp - 4], 0xe
push 0x66
push 0
push str.Vault_Auto_Recovery
push 0
mov byte [ebp - 4], bl
call fcn.00439230
add esp, 0x14
call fcn.0044fc50
mov ecx, eax
call fcn.00442270
call fcn.00431060
mov ecx, eax
call fcn.004446f0
push 0
call fcn.004294f0
mov ecx, eax
call fcn.0048ed70
push 0
push 0
push 0
push 0x901a
call fcn.004295b0
mov ecx, eax
call fcn.00492690
push str.http:__WEB_SERVICE_HOST_page_homepage.jsp_areasupportfeedbackaction1sitenameaxp
lea ecx, [ebp + 0xc]
call fcn.0041ad50
mov byte [ebp - 4], 0xf
push 0x5422ee
lea ecx, [ebp - 0x1c]
call fcn.0041ad50
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x1c]
push eax
call fcn.0046cf50
add esp, 4
mov ecx, dword [ebp - 0x1c]
push ecx
push str.WEB_SERVICE_HOST
lea ecx, [ebp + 0xc]
call fcn.004316b0
push 1
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1c]
call fcn.00416630
mov byte [ebp - 4], bl
lea ecx, [ebp + 0xc]
call fcn.00416630
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x24]
call fcn.00416630
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
call fcn.00416630
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00416630
mov byte [esi + 0x10], 0
mov dword [esi + 8], 0
push 0x5422ee
lea ecx, [esi + 0xc]
call fcn.004199b0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x28]
cmp dword [eax], 0
je 0x46854e
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
call fcn.00416630
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00416630
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x28]
cmp dword [eax], 0
je 0x468592
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc