Function at 0x40fbc0
Capabilities:
Copy file
Create process on windows
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x43e736
mov eax, dword fs:[0]
push eax
mov eax, 0x11cc
call fcn.00427010
mov eax, dword [0x44fb64]
xor eax, esp
mov dword [esp + 0x11c8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44fb64]
xor eax, esp
push eax
lea eax, [esp + 0x11e0]
mov dword fs:[0], eax
mov eax, dword [esp + 0x11f4]
xor ebx, ebx
push 0x207
mov esi, ecx
lea ecx, [esp + 0x3c1]
push ebx
push ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x3c8], bl
call fcn.00424c40
add esp, 0xc
push 0x7d000
call fcn.004133db
add esp, 4
push 0x208
mov dword [esp + 0x20], eax
xor eax, eax
lea edx, [esp + 0x5c8]
push ebx
push edx
mov byte [esp + 0x184], bl
mov dword [esp + 0x185], eax
mov dword [esp + 0x189], eax
mov dword [esp + 0x18d], eax
mov dword [esp + 0x191], eax
mov dword [esp + 0x195], eax
mov dword [esp + 0x199], eax
mov dword [esp + 0x19d], eax
mov word [esp + 0x1a1], ax
mov byte [esp + 0x1a3], al
call fcn.00424c40
add esp, 0xc
lea ebx, [esp + 0x178]
call fcn.00407db0
push 0x447a7c
push esi
call fcn.00422167
add esp, 8
mov dword [esp + 0x18], eax
test eax, eax
je 0x410242
push eax
call fcn.004227eb
add esp, 4
test eax, eax
jne 0x40fed6
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
push esi
mov dword [ebp], 0
call fcn.004227a1
add esp, 4
push esi
push 0x7d000
push 1
push ebp
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], edx
call fcn.00422af3
mov edi, eax
add esp, 0x10
xor esi, esi
mov dword [esp + 0x2c], edi
test edi, edi
jbe 0x40fec1
jmp 0x40fd20
lea ecx, [esp + 0x178]
mov eax, ebp
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40fd50
test dl, dl
je 0x40fd4c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40fd50
add eax, 2
add ecx, 2
test dl, dl
jne 0x40fd30
xor eax, eax
jmp 0x40fd55
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40fd6e
add esi, 0x200
add ebp, 0x200
cmp esi, edi
jb 0x40fd20
jmp 0x40fec1
mov eax, dword [esp + 0x11f0]
lea edx, [esp + 0x3bc]
mov dword [esp + 0x14], esi
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x40fd82
lea edi, [esp + 0x3bc]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40fd94
mov bx, word [0x4478d8]
lea eax, [ebp + 0x90]
mov word [edi], bx
mov ecx, eax
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40fdb0
lea edi, [esp + 0x3bc]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40fdc3
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebp + 0x2c]
mov edx, 0x448368
mov ecx, esi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40fe03
test al, al
je 0x40fdff
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40fe03
add ecx, 2
add edx, 2
test al, al
jne 0x40fde3
xor eax, eax
jmp 0x40fe08
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40fe6a
mov ecx, dword [esp + 0x11f0]
lea eax, [esp + 0x5c4]
sub eax, ecx
lea esp, [esp]
mov dl, byte [ecx]
mov byte [ecx + eax], dl
inc ecx
test dl, dl
jne 0x40fe20
lea edi, [esp + 0x5c4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40fe32
mov eax, esi
mov word [edi], bx
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40fe41
lea edi, [esp + 0x5c4]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40fe54
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x18]
push 0
push 0
push 0
push esi
call fcn.00422bac
mov edx, dword [ebp + 0x20]
push 0
lea eax, [esp + 0x3d0]
push eax
lea ecx, [ebp + 0x24]
push esi
call fcn.004120b0
mov edi, dword [esp + 0x30]
mov ecx, dword [ebp + 0xf4]
add esp, 0x1c
mov eax, edi
cdq
xor ebx, ebx
add ecx, eax
adc ebx, edx
add ecx, dword [esp + 0x24]
push 0
adc ebx, dword [esp + 0x2c]
push ebx
push ecx
push esi
call fcn.00422bac
add esp, 0x10
cmp edi, dword [esp + 0x2c]
jb 0x40fed6
mov edx, dword [esp + 0x18]
push edx
call fcn.004227eb
add esp, 4
test eax, eax
je 0x40fcd6
push 0x400
lea eax, [esp + 0xce0]
push 0
push eax
call fcn.00424c40
mov ecx, dword [esp + 0x24]
add esp, 0xc
push ecx
call fcn.004227eb
add esp, 4
test eax, eax
jne 0x410235
mov edi, dword [esp + 0x18]
push edi
push 0x400
lea edx, [esp + 0xce4]
push 1
push edx
call fcn.00422af3
push edi
mov esi, eax
call fcn.004227a1
add esp, 0x14
mov ebx, eax
mov ebp, edx
cmp esi, 0x400
jne 0x410220
mov ecx, str.LeaderCab
lea eax, [esp + 0xcdc]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ff62
test dl, dl
je 0x40ff5e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ff62
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ff42
xor eax, eax
jmp 0x40ff67
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410220
push 0x208
push eax
lea eax, [esp + 0x3c4]
push eax
call fcn.00424c40
mov eax, dword [esp + 0x11fc]
lea edx, [esp + 0x3c8]
add esp, 0xc
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x40ff95
lea edi, [esp + 0x3bc]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40ffa7
mov cx, word [0x4478d8]
lea edx, [esp + 0xd00]
mov word [edi], cx
push edx
lea ecx, [esp + 0x18]
call fcn.004098c0
mov dword [esp + 0x11e8], 0
mov edx, dword [esp + 0x14]
mov esi, dword [edx - 0xc]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x40fffb
push esi
lea ecx, [esp + 0x18]
call fcn.00409bc0
mov edx, dword [esp + 0x14]
lea eax, [esi + 1]
push eax
push edx
call fcn.00423331
add esp, 8
cmp eax, 0x50
ja case.0x410018.0
movzx ecx, byte [eax + 0x410780]
jmp dword [ecx*4 + 0x410770]
test esi, esi
jl 0x4102b5
mov eax, dword [esp + 0x14]
cmp esi, dword [eax - 8]
jg 0x4102b5
mov dword [eax - 0xc], esi
mov edx, dword [esp + 0x14]
push str.kernel32.dll
mov byte [esi + edx], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.GetNativeSystemInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4100d1
lea ecx, [esp + 0x178]
push ecx
call eax
xor eax, eax
cmp word [esp + 0x178], 9
sete al
test eax, eax
je 0x4100d1
mov edx, dword [esp + 0x14]
push str.LDX64.EXE
push edx
call fcn.00422dad
add esp, 8
test eax, eax
sete al
test al, al
je 0x4100aa
lea eax, [esp + 0x3bc]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4100a0
jmp 0x4100fc
lea eax, [esp + 0xd00]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4100b3
lea edi, [esp + 0x3bc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4100c4
jmp 0x410189
mov eax, dword [esp + 0x14]
push str.LDX32.EXE
push eax
call fcn.00422dad
add esp, 8
test eax, eax
sete al
test al, al
je 0x410112
lea eax, [esp + 0x3bc]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4100f4
mov ecx, dword [str.Ldx.exe]
mov edx, dword [0x448bc0]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0x410199
mov eax, dword [esp + 0x14]
push str.LDDISK32.SYS
push eax
call fcn.00422dad
add esp, 8
test eax, eax
sete al
test al, al
je 0x410164
lea eax, [esp + 0x3bc]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x410135
mov ecx, dword [str.Lddisk.sys]
mov edx, dword [0x448be4]
mov dword [eax], ecx
mov cx, word [0x448be8]
mov dword [eax + 4], edx
mov dl, byte [0x448bea]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
jmp 0x410199
lea eax, [esp + 0xd00]
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410170
lea edi, [esp + 0x3bc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x410181
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x18]
push 0
push ebp
push ebx
push esi
call fcn.00422bac
mov eax, dword [esp + 0xd0c]
mov edx, dword [esp + 0xd7c]
push eax
lea ecx, [esp + 0x3d0]
push ecx
push esi
lea ecx, [esp + 0xd80]
call fcn.004120b0
mov edx, dword [esp + 0xd88]
mov eax, dword [esp + 0xd8c]
add esp, 0x1c
add edx, ebx
push 0
adc eax, ebp
push eax
push edx
push esi
call fcn.00422bac
mov dword [esp + 0x11f8], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0x10
mov dword [esp + 0x20], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410220
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004227eb
add esp, 4
test eax, eax
je 0x40ff02
mov edx, dword [esp + 0x18]
push edx
call fcn.004221f5
add esp, 4
mov eax, dword [esp + 0x1c]
push eax
call fcn.004133e6
add esp, 4
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x5c8]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x410744
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x207
lea eax, [esp + 0x1b9]
push 0
push eax
mov byte [esp + 0x1c0], 0
call fcn.00424c40
add esp, 0xc
call fcn.004133f1
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4102bf
push 0x80004005
call fcn.00409d60
call fcn.004139e7
call fcn.00413a1f
push 0x80070057
call fcn.00409d60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x10dc]
push ecx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x9dc]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x5d4]
push edx
mov dword [esp + 0x11fc], 1
call fcn.00422057
add esp, 0x14
push 0x448bec
push 0x448bf0
lea eax, [esp + 0x9dc]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x7dc]
push edx
call fcn.00423cff
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add esp, 0x14
push 0x208
lea eax, [esp + 0x1b8]
push eax
push 0
call ebp
lea eax, [esp + 0x1b4]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410350
sub eax, edx
add eax, 0xffffffff
mov bl, 0x5c
js 0x41036e
cmp byte [esp + eax + 0x1b4], bl
je 0x41036e
sub eax, 1
jns 0x410360
mov byte [esp + eax + 0x1b4], 0
lea eax, [esp + 0x1b4]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x410380
mov ecx, dword [str.Ldx.EN]
mov edx, dword [0x448bf8]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [eax], ecx
mov dword [eax + 4], edx
push 0
lea eax, [esp + 0x7d0]
push eax
lea ecx, [esp + 0x1bc]
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
lea edx, [esp + 0x7d0]
push edx
lea eax, [esp + 0x1c]
push str.Replace_CopyFile__s___d_
push eax
call fcn.00409670
mov ecx, dword [esp + 0x24]
add esp, 0x10
push 0
push ecx
push 0x453d09
call fcn.0040d390
push 0x208
lea edx, [esp + 0x7d0]
push 0
push edx
call fcn.00424c40
add esp, 0xc
push 0x208
lea eax, [esp + 0x1b8]
push 0
push eax
call fcn.00424c40
add esp, 0xc
push 0x448c18
push str.LdxShareData32
lea ecx, [esp + 0x9dc]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x7dc]
push eax
call fcn.00423cff
add esp, 0x14
push 0x208
lea ecx, [esp + 0x1b8]
push ecx
push 0
call ebp
lea eax, [esp + 0x1b4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410457
sub eax, edx
add eax, 0xffffffff
js 0x410473
cmp byte [esp + eax + 0x1b4], bl
je 0x410473
sub eax, 1
jns 0x410465
mov byte [esp + eax + 0x1b4], 0
lea eax, [esp + 0x1b4]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x410483
mov edx, dword [str.LdxShareData32.dll]
mov ecx, dword [0x448c30]
mov dword [eax], edx
mov edx, dword [0x448c34]
mov dword [eax + 4], ecx
mov ecx, dword [0x448c38]
mov dword [eax + 8], edx
mov edx, dword [0x448c3c]
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edx
push 0
lea eax, [esp + 0x7d0]
push eax
lea ecx, [esp + 0x1bc]
push ecx
call esi
call edi
push eax
lea edx, [esp + 0x7d0]
push edx
lea eax, [esp + 0x1c]
push str.Replace_CopyFile___s____d_
push eax
call fcn.00409670
mov ecx, dword [esp + 0x24]
add esp, 0x10
push 0
push ecx
push 0x453d09
call fcn.0040d390
push 0x208
lea edx, [esp + 0x1b8]
push 0
push edx
call fcn.00424c40
add esp, 0xc
push 0x208
lea eax, [esp + 0x1b8]
push eax
push 0
call ebp
lea eax, [esp + 0x1b4]
lea edx, [eax + 1]
jmp 0x410530
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410530
sub eax, edx
add eax, 0xffffffff
js 0x41054e
mov edi, edi
cmp byte [esp + eax + 0x1b4], bl
je 0x41054e
sub eax, 1
jns 0x410540
mov byte [esp + eax + 0x1b4], 0
lea eax, [esp + 0x1b4]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x410560
mov ecx, dword [0x448b38]
mov edx, dword [0x448b3c]
mov dword [eax], ecx
mov cl, byte [0x448b40]
mov dword [eax + 4], edx
xor ebx, ebx
push ebx
lea edx, [esp + 0x5c8]
mov byte [eax + 8], cl
push edx
lea eax, [esp + 0x1bc]
push eax
call esi
call edi
push eax
lea ecx, [esp + 0x5c8]
push ecx
lea edx, [esp + 0x1c]
push str.Replace_CopyFile__s___d_
push edx
call fcn.00409670
mov ebp, dword [esp + 0x24]
add esp, 0x10
push ebx
push ebp
push 0x453d09
call fcn.0040d390
push 0x207
lea eax, [esp + 0xad9]
push ebx
push eax
mov byte [esp + 0xae0], bl
call fcn.00424c40
lea eax, [esp + 0xae0]
add esp, 0xc
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4105f0
mov ecx, dword [str.__Back__]
mov edx, dword [0x448b24]
mov dword [eax], ecx
mov cl, byte [0x448b28]
mov dword [eax + 4], edx
mov byte [eax + 8], cl
mov eax, dword [esp + 0x30]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x410618
lea edi, [esp + 0xad4]
sub eax, ecx
mov esi, ecx
dec edi
jmp 0x410630
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x410630
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xad4]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410650
mov dx, word [0x44846c]
mov word [edi], dx
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0x448368
lea ecx, [esp + 0x20]
call fcn.004098c0
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x184], eax
lea eax, [esp + 0x178]
lea ecx, [esp + 0x5c4]
lea edx, [esp + 0xad4]
push eax
mov dword [esp + 0x17c], 0x3c
mov dword [esp + 0x180], 0x40
mov dword [esp + 0x184], ebx
mov dword [esp + 0x18c], ecx
mov dword [esp + 0x190], edx
mov dword [esp + 0x194], ebx
mov dword [esp + 0x198], 5
mov dword [esp + 0x19c], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x4106f5
mov ecx, dword [esp + 0x1b0]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x410715
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x20], 3
mov dword [esp + 0x11e8], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410744
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x11e0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x11c8]
xor ecx, esp
call fcn.0042179d
add esp, 0x11d8
ret