Function at 0x432970
Capabilities:
Copy file
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x498371
mov eax, dword fs:[0]
push eax
mov eax, 0x1b1c
call fcn.00463a70
mov eax, dword [0x4b6640]
xor eax, esp
mov dword [esp + 0x1b18], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b6640]
xor eax, esp
push eax
lea eax, [esp + 0x1b30]
mov dword fs:[0], eax
xor ebp, ebp
lea eax, [esp + 0x128]
push ebp
push eax
call fcn.00439820
add esp, 8
cmp dword [esp + 0x13c], ebp
mov dword [esp + 0x1b38], ebp
jne 0x4329f5
cmp dword [esp + 0x140], 8
jb 0x433259
mov ecx, dword [esp + 0x12c]
push ecx
call fcn.004629d9
add esp, 4
jmp 0x433259
lea edx, [esp + 0xb8]
push ebp
push edx
call fcn.00439770
add esp, 8
cmp dword [esp + 0xcc], ebp
mov byte [esp + 0x1b38], 1
jne 0x432a58
mov esi, 8
cmp dword [esp + 0xd0], esi
jb 0x432a35
mov eax, dword [esp + 0xbc]
push eax
call fcn.004629d9
add esp, 4
cmp dword [esp + 0x140], esi
mov dword [esp + 0xd0], 7
mov dword [esp + 0xcc], ebp
mov word [esp + 0xbc], bp
jmp 0x4329da
push str.dlcore.dll
lea edx, [esp + 0x12c]
push edx
lea eax, [esp + 0x114]
push eax
call fcn.0040a130
push str._tnproxy.dll
lea ecx, [esp + 0x138]
push ecx
lea edx, [esp + 0x174]
push edx
mov byte [esp + 0x1b50], 2
call fcn.0040a130
push str.extract.dll
lea eax, [esp + 0x144]
push eax
lea ecx, [esp + 0x19c]
push ecx
mov byte [esp + 0x1b5c], 3
call fcn.0040a130
add esp, 0x24
mov eax, dword [esp + 0xbc]
mov ebx, 8
cmp dword [esp + 0xd0], ebx
mov byte [esp + 0x1b38], 4
jae 0x432add
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0x228]
call fcn.00434ac0
xor eax, eax
lea edx, [esp + 0x1b14]
push edx
lea ecx, [esp + 0x228]
mov byte [esp + 0x1b3c], 5
mov word [esp + 0x1b18], bp
mov dword [esp + 0x1b1a], eax
mov word [esp + 0x1b1e], ax
call fcn.004346d0
movzx esi, word [esp + 0x1b18]
push 0x4a15f0
lea ecx, [esp + 0x18]
call fcn.0040a0f0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xd8]
push ecx
mov byte [esp + 0x1b40], 6
call fcn.00439070
add esp, 8
cmp dword [esp + 0x2c], ebx
mov byte [esp + 0x1b38], 8
jb 0x432b6d
mov edx, dword [esp + 0x18]
push edx
call fcn.004629d9
add esp, 4
cmp dword [esp + 0xe8], ebp
mov edi, 7
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
jne 0x432cad
cmp dword [esp + 0xec], ebx
jb 0x432ba5
mov eax, dword [esp + 0xd8]
push eax
call fcn.004629d9
add esp, 4
lea ecx, [esp + 0x224]
mov dword [esp + 0xec], edi
mov dword [esp + 0xe8], ebp
mov word [esp + 0xd8], bp
mov byte [esp + 0x1b38], 4
call fcn.00434740
cmp dword [esp + 0x194], ebx
jb 0x432be8
mov ecx, dword [esp + 0x180]
push ecx
call fcn.004629d9
add esp, 4
cmp dword [esp + 0x178], ebx
mov dword [esp + 0x194], edi
mov dword [esp + 0x190], ebp
mov word [esp + 0x180], bp
jb 0x432c17
mov edx, dword [esp + 0x164]
push edx
call fcn.004629d9
add esp, 4
cmp dword [esp + 0x124], ebx
mov dword [esp + 0x178], edi
mov dword [esp + 0x174], ebp
mov word [esp + 0x164], bp
jb 0x432c46
mov eax, dword [esp + 0x110]
push eax
call fcn.004629d9
add esp, 4
cmp dword [esp + 0xd0], ebx
mov dword [esp + 0x124], edi
mov dword [esp + 0x120], ebp
mov word [esp + 0x110], bp
jb 0x432c75
mov ecx, dword [esp + 0xbc]
push ecx
call fcn.004629d9
add esp, 4
cmp dword [esp + 0x140], ebx
mov dword [esp + 0xd0], edi
mov dword [esp + 0xcc], ebp
mov word [esp + 0xbc], bp
jb 0x433259
mov edx, dword [esp + 0x12c]
push edx
call fcn.004629d9
add esp, 4
jmp 0x433259
lea eax, [esp + 0xd4]
push esi
push eax
call fcn.00432550
add esp, 8
test al, al
je 0x4331fd
push 1
push 3
lea ecx, [esp + 0x38]
call fcn.004322d0
push esi
push 0x4a05a4
lea ecx, [esp + 0xdc]
push ecx
lea edx, [esp + 0x44]
mov bl, 9
push edx
mov byte [esp + 0x1b48], bl
call fcn.00431500
add esp, 8
push eax
call fcn.00431790
add esp, 8
mov ecx, eax
call fcn.004319b0
lea eax, [esp + 0x144]
push eax
lea ecx, [esp + 0x34]
call fcn.0042f860
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1b44], 0xa
call fcn.00409950
lea ecx, [esp + 0x144]
mov byte [esp + 0x1b38], bl
call fcn.0041f270
lea ecx, [esp + 0xd4]
push ecx
call fcn.00438a50
add esp, 4
test al, al
jne 0x432d67
lea edx, [esp + 0xd4]
push edx
call fcn.00438bb0
add esp, 4
push 0x4a18a8
lea eax, [esp + 0xd8]
push eax
lea ecx, [esp + 0xf8]
push ecx
call fcn.0040a130
push str.dlcore.dll
lea edx, [esp + 0xe4]
push edx
lea eax, [esp + 0x1ac]
push eax
mov byte [esp + 0x1b50], 0xb
call fcn.0040a130
push str._tnproxy.dll
lea ecx, [esp + 0xf0]
push ecx
lea edx, [esp + 0x20c]
push edx
mov byte [esp + 0x1b5c], 0xc
call fcn.0040a130
push str.extract.dll
lea eax, [esp + 0xfc]
push eax
lea ecx, [esp + 0x1fc]
push ecx
mov byte [esp + 0x1b68], 0xd
call fcn.0040a130
add esp, 0x30
mov ecx, dword [esp + 0xf4]
mov esi, 8
cmp dword [esp + 0x108], esi
mov byte [esp + 0x1b38], 0xe
jae 0x432e0e
lea ecx, [esp + 0xf4]
cmp dword [esp + 0xd0], esi
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
jb 0x433281
mov eax, dword [esp + 0xbc]
cmp eax, ebp
je 0x432e35
cmp ecx, ebp
je 0x432e35
push ebp
push ecx
push eax
call edi
cmp dword [esp + 0x1b0], esi
mov eax, dword [esp + 0x19c]
mov bl, 1
jae 0x432e4e
lea eax, [esp + 0x19c]
push eax
call fcn.00413160
add esp, 4
test al, al
je 0x432f59
cmp dword [esp + 0x124], esi
mov eax, dword [esp + 0x110]
jae 0x432e76
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0xa78]
call fcn.00434ac0
xor eax, eax
lea edx, [esp + 0x1b24]
push edx
lea ecx, [esp + 0xa78]
mov byte [esp + 0x1b3c], 0xf
mov word [esp + 0x1b28], bp
mov dword [esp + 0x1b2a], eax
mov word [esp + 0x1b2e], ax
call fcn.004346d0
cmp dword [esp + 0x1b0], 8
movzx esi, word [esp + 0x1b28]
mov eax, dword [esp + 0x19c]
jae 0x432ed8
lea eax, [esp + 0x19c]
push eax
lea ecx, [esp + 0x12c8]
call fcn.00434ac0
xor eax, eax
mov dword [esp + 0x1b1e], eax
mov word [esp + 0x1b22], ax
lea eax, [esp + 0x1b1c]
push eax
lea ecx, [esp + 0x12c8]
mov byte [esp + 0x1b3c], 0x10
mov word [esp + 0x1b20], bp
call fcn.004346d0
movzx eax, word [esp + 0x1b20]
cmp esi, eax
jae 0x432f28
xor bl, bl
lea ecx, [esp + 0x12c4]
mov byte [esp + 0x1b38], 0xf
call fcn.00434740
lea ecx, [esp + 0xa74]
mov byte [esp + 0x1b38], 0xe
call fcn.00434740
test bl, bl
mov esi, 8
je 0x432f91
cmp dword [esp + 0x1b0], esi
mov ecx, dword [esp + 0x19c]
jae 0x432f70
lea ecx, [esp + 0x19c]
cmp dword [esp + 0x124], esi
jb 0x43328d
mov eax, dword [esp + 0x110]
cmp eax, ebp
je 0x432f91
cmp ecx, ebp
je 0x432f91
push ebp
push ecx
push eax
call edi
cmp dword [esp + 0x204], esi
mov ecx, dword [esp + 0x1f0]
jae 0x432fa8
lea ecx, [esp + 0x1f0]
cmp dword [esp + 0x178], esi
jb 0x433299
mov eax, dword [esp + 0x164]
cmp eax, ebp
je 0x432fc9
cmp ecx, ebp
je 0x432fc9
push ebp
push ecx
push eax
call edi
cmp dword [esp + 0x1e8], esi
mov ecx, dword [esp + 0x1d4]
jae 0x432fe0
lea ecx, [esp + 0x1d4]
cmp dword [esp + 0x194], esi
jb 0x4332a5
mov eax, dword [esp + 0x180]
cmp eax, ebp
je 0x433001
cmp ecx, ebp
je 0x433001
push ebp
push ecx
push eax
call edi
lea ecx, [esp + 0x1b4]
push ecx
call fcn.0042f660
lea edx, [esp + 0xf4]
push edx
lea eax, [esp + 0x14c]
mov bl, 0x11
push eax
mov byte [esp + 0x1b44], bl
call fcn.00438570
add esp, 0xc
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0xfc]
mov byte [esp + 0x1b44], 0x12
call fcn.00409950
lea ecx, [esp + 0x144]
mov byte [esp + 0x1b38], bl
call fcn.0041f270
cmp dword [esp + 0x1c8], ebp
je 0x43311e
cmp dword [esp + 0x1cc], esi
mov eax, dword [esp + 0x1b8]
jae 0x43307e
lea eax, [esp + 0x1b8]
push eax
call fcn.00413160
add esp, 4
test al, al
je 0x43311e
lea ecx, [esp + 0xf0]
push ecx
lea edx, [esp + 0x1b8]
push edx
call fcn.00413790
add esp, 8
test al, al
je 0x43311e
mov dword [esp + 0x15c], 0xf
mov dword [esp + 0x158], ebp
mov byte [esp + 0x148], 0
lea eax, [esp + 0x144]
push eax
lea ecx, [esp + 0x1b8]
push ecx
mov byte [esp + 0x1b40], 0x13
call fcn.00442c70
mov eax, dword [esp + 0x150]
add esp, 8
cmp dword [esp + 0x15c], 0x10
jae 0x4330fd
lea eax, [esp + 0x148]
push 0x4a1900
push eax
call fcn.00435050
add esp, 8
lea ecx, [esp + 0x144]
mov byte [esp + 0x1b38], bl
call fcn.00417ab0
cmp dword [esp + 0x108], esi
mov eax, dword [esp + 0xf4]
jae 0x433135
lea eax, [esp + 0xf4]
push eax
call fcn.00413160
add esp, 4
test al, al
je 0x433169
cmp dword [esp + 0x108], esi
mov eax, dword [esp + 0xf4]
jae 0x433159
lea eax, [esp + 0xf4]
push ebp
push ebp
push str.__RegServer
push eax
push ebp
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.Installlog.txt
lea edx, [esp + 0xd8]
push edx
lea eax, [esp + 0x210]
push eax
call fcn.0040a130
add esp, 0xc
lea ecx, [esp + 0x208]
call fcn.0041f270
lea ecx, [esp + 0x1b4]
call fcn.0041f270
lea ecx, [esp + 0x1d0]
call fcn.0041f270
lea ecx, [esp + 0x1ec]
call fcn.0041f270
lea ecx, [esp + 0x198]
call fcn.0041f270
lea ecx, [esp + 0xf0]
call fcn.0041f270
lea ecx, [esp + 0x84]
mov byte [esp + 0x1b38], 8
call fcn.0042e4d0
lea ecx, [esp + 0x84]
push ecx
mov dword [esp + 0x88], 0x4a16e4
call fcn.004810a7
add esp, 4
lea ecx, [esp + 0xd4]
call fcn.0041f270
lea ecx, [esp + 0x224]
mov byte [esp + 0x1b38], 4
call fcn.00434740
lea ecx, [esp + 0x17c]
call fcn.0041f270
lea ecx, [esp + 0x160]
call fcn.0041f270
lea ecx, [esp + 0x10c]
call fcn.0041f270
lea ecx, [esp + 0xb8]
call fcn.0041f270
lea ecx, [esp + 0x128]
call fcn.0041f270
mov ecx, dword [esp + 0x1b30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1b18]
xor ecx, esp
call fcn.004629a0
add esp, 0x1b28
ret
lea eax, [esp + 0xbc]
jmp 0x432e2c
lea eax, [esp + 0x110]
jmp 0x432f88
lea eax, [esp + 0x164]
jmp 0x432fc0
lea eax, [esp + 0x180]
jmp 0x432ff8