Function at 0x401cda
Capabilities:
Copy file
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3cc
push ebx
push esi
push edi
xor ebx, ebx
push 0x3f
lea eax, [esp + 0x3d]
push ebx
push eax
mov byte [esp + 0x44], bl
call fcn.00403610
add esp, 0xc
push 0x103
lea eax, [esp + 0xc5]
push ebx
push eax
mov dword [esp + 0x1c], 1
mov byte [esp + 0xcc], bl
call fcn.00403610
add esp, 0xc
push 0x40
lea eax, [esp + 0x80]
push ebx
push eax
mov dword [esp + 0x84], ebx
call fcn.00403610
mov esi, dword [ebp + 8]
mov dword [esp + 0x2c], ebx
xor eax, eax
lea edi, [esp + 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
push str._nodel
stosd dword es:[edi], eax
call fcn.00401bdd
mov dword [esp + 0x18], eax
mov dword [esp], str._ghost
call fcn.00401bdd
mov dword [esp + 0x1c], eax
mov dword [esp], str._stop
call fcn.00401bdd
mov dword [esp + 0x34], eax
mov dword [esp], str._service
call fcn.00401bdd
mov dword [esp + 0x38], eax
mov dword [esp], str._norunonce
call fcn.00401bdd
pop ecx
mov edi, 0x405330
push edi
mov dword [esp + 0x20], eax
call fcn.00401bdd
test eax, eax
pop ecx
je 0x401dde
push str._unattid
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x40
pop ebx
sub ebx, eax
lea eax, [esp + eax + 0x38]
push eax
push edi
mov eax, esi
call fcn.00401c3a
pop ecx
pop ecx
xor ebx, ebx
mov edi, str._app
push edi
mov dword [esp + 0x10], ebx
call fcn.00401bdd
test eax, eax
pop ecx
je 0x401e38
push 0xa
push 0x7d00
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
mov dword [0x406394], eax
je 0x401e10
call fcn.0040179f
jmp 0x401e12
xor eax, eax
cmp eax, ebx
je 0x401e38
push 0x406030
call fcn.004030cb
pop ecx
call fcn.004017e4
push ebx
push str.LMI_Rescue_srv.exe
push dword [0x406030]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str._params
call fcn.00401bdd
test eax, eax
pop ecx
je 0x401f02
push 1
push ebx
push str.eula.txt
push 0x2717
call fcn.00401811
push 0x405135
call fcn.00401a28
add esp, 0x14
cmp dword [esp + 0x14], ebx
je 0x401e7b
push str._nodel
call fcn.00401a28
pop ecx
cmp dword [esp + 0x1c], ebx
je 0x401e8c
push str._norunonce
call fcn.00401a28
pop ecx
cmp dword [esp + 0x18], ebx
je 0x401eae
push str._ghost
call fcn.00401a28
cmp byte [esp + 0x3c], bl
pop ecx
je 0x401eae
lea eax, [esp + 0x38]
push eax
call fcn.00401a28
pop ecx
push ebx
push ebx
push str.params.txt
push 0x2710
call fcn.00401811
push ebx
call fcn.00401abd
add esp, 0x14
push ebx
call fcn.00401b71
pop ecx
push 1
mov esi, str.script
push esi
push 0x2712
push 0x2713
call fcn.00401811
push 1
push esi
push 0x2714
push 0x2715
call fcn.00401811
add esp, 0x20
xor eax, eax
jmp 0x40217d
push edi
call fcn.00401bdd
test eax, eax
pop ecx
jne 0x401efb
mov esi, dword [ebp + 8]
mov edi, 0x405378
push edi
call fcn.00401bdd
test eax, eax
pop ecx
lea eax, [esp + 0x1c8]
push eax
je 0x401f65
push edi
mov ebx, 0x104
mov eax, esi
call fcn.00401c3a
pop ecx
pop ecx
lea eax, [esp + 0x1c8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
xor ebx, ebx
push 0xa
push 0x7d00
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
mov dword [0x406394], eax
je 0x401f96
call fcn.0040179f
jmp 0x401f98
lea ebx, [esp + 0x2d4]
lea esi, [esp + 0x10]
call fcn.0040162b
xor ebx, ebx
cmp eax, ebx
pop ecx
je 0x401f47
push dword [eax*4 + 0x40603c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040171d
pop ecx
pop ecx
jmp 0x40211c
xor eax, eax
cmp eax, ebx
jne 0x401fa3
push str.Failed_to_locate_application_resource.
jmp 0x401f83
push 0x406030
call fcn.004030cb
test eax, eax
pop ecx
jne 0x401fc1
mov dword [esp + 0xc], 2
push str.Failed_to_decompress_application_files.
jmp 0x401f83
push ebx
push str.LMI_Rescue_srv.exe
push dword [0x406030]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x401fde
push str.Failed_to_copy_service_binary.
jmp 0x401f83
call fcn.004017e4
xor edi, edi
inc edi
push edi
push ebx
push str.eula.txt
push 0x2717
call fcn.00401811
mov esi, dword [esp + 0x44]
add esp, 0x10
cmp esi, ebx
jne 0x402065
push 0x405135
call fcn.00401a28
cmp dword [esp + 0x18], ebx
pop ecx
je 0x40201e
push str._nodel
call fcn.00401a28
pop ecx
cmp dword [esp + 0x1c], ebx
je 0x40202f
push str._norunonce
call fcn.00401a28
pop ecx
cmp dword [esp + 0x18], ebx
je 0x402051
push str._ghost
call fcn.00401a28
cmp byte [esp + 0x3c], bl
pop ecx
je 0x402051
lea eax, [esp + 0x38]
push eax
call fcn.00401a28
pop ecx
push ebx
push ebx
push str.params.txt
push 0x2710
call fcn.00401811
add esp, 0x10
push esi
call fcn.00401abd
pop ecx
push esi
call fcn.00401b71
cmp esi, ebx
pop ecx
jne 0x4020a1
push edi
mov esi, str.script
push esi
push 0x2712
push 0x2713
call fcn.00401811
push edi
push esi
push 0x2714
push 0x2715
call fcn.00401811
add esp, 0x20
cmp dword [esp + 0x30], ebx
jne 0x402110
push dword [0x406030]
lea eax, [esp + 0x1cc]
push eax
lea eax, [esp + 0xc8]
push str.__s_s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x1d0]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0xe0]
push eax
push ebx
mov dword [esp + 0xa0], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x402110
cmp dword [esp + 0xc], edi
jle 0x40211c
push str.Failed_to_start_client_application.
jmp 0x401f83
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], ebx
call fcn.004017e4
cmp dword [esp + 0x24], ebx
je 0x402135
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x402149
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x20], ebx
cmp dword [esp + 0xc], 2
jl 0x401f0d
push 0x104
lea eax, [esp + 0xc4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x402179
lea edi, [esp + 0xc0]
call fcn.004011ce
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret