Function at 0x4101a0
Capabilities:
Copy file
Read file on windows
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x43f186
mov eax, dword fs:[0]
push eax
mov eax, 0x7e1ac
call fcn.004277f0
mov eax, dword [0x44fb64]
xor eax, esp
mov dword [esp + 0x7e1a8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44fb64]
xor eax, esp
push eax
lea eax, [esp + 0x7e1c0]
mov dword fs:[0], eax
mov eax, dword [esp + 0x7e1d4]
xor ebx, ebx
push 0x207
mov esi, ecx
lea ecx, [esp + 0x3a1]
push ebx
xor ebp, ebp
push ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x3a8], bl
call fcn.00425400
add esp, 0xc
push 0x7cfff
lea edx, [esp + 0x11c1]
push ebx
push edx
mov byte [esp + 0x11c8], bl
call fcn.00425400
xor eax, eax
add esp, 0xc
push 0x208
mov dword [esp + 0x179], eax
mov dword [esp + 0x17d], eax
mov dword [esp + 0x181], eax
mov dword [esp + 0x185], eax
mov dword [esp + 0x189], eax
mov dword [esp + 0x18d], eax
mov dword [esp + 0x191], eax
mov word [esp + 0x195], ax
mov byte [esp + 0x197], al
lea eax, [esp + 0x5a8]
push ebx
push eax
mov byte [esp + 0x180], bl
call fcn.00425400
add esp, 0xc
lea ebx, [esp + 0x174]
call fcn.00408080
push 0x447a48
push esi
call fcn.0042292f
mov esi, eax
add esp, 8
mov dword [esp + 0x1c], esi
test esi, esi
je 0x4108ce
push esi
call fcn.0042309e
add esp, 4
test eax, eax
jne 0x4104ef
jmp 0x4102d0
push 0x7d000
lea ecx, [esp + 0x11c0]
push 0
push ecx
call fcn.00425400
add esp, 0xc
push esi
call fcn.00422e70
add esp, 4
push esi
push 0x7d000
mov dword [esp + 0x30], edx
lea edx, [esp + 0x11c4]
push 1
push edx
mov dword [esp + 0x34], eax
call fcn.004233a6
mov edi, eax
add esp, 0x10
xor ebx, ebx
mov dword [esp + 0x2c], edi
test edi, edi
jbe 0x4104de
lea ebp, [esp + 0x11bc]
jmp 0x410330
lea ecx, [esp + 0x174]
mov eax, ebp
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410360
test dl, dl
je 0x41035c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410360
add eax, 2
add ecx, 2
test dl, dl
jne 0x410340
xor eax, eax
jmp 0x410365
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41037e
add ebx, 0x200
add ebp, 0x200
cmp ebx, edi
jb 0x410330
jmp 0x4104de
mov eax, dword [esp + 0x7e1d0]
lea edx, [esp + 0x39c]
mov dword [esp + 0x18], ebx
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x410392
lea edi, [esp + 0x39c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4103a4
mov bx, word [0x4478c8]
lea eax, [ebp + 0x90]
mov word [edi], bx
mov ecx, eax
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4103c0
lea edi, [esp + 0x39c]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4103d3
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebp + 0x2c]
mov edx, 0x448410
mov ecx, esi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x410413
test al, al
je 0x41040f
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x410413
add ecx, 2
add edx, 2
test al, al
jne 0x4103f3
xor eax, eax
jmp 0x410418
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41047a
mov ecx, dword [esp + 0x7e1d0]
lea eax, [esp + 0x5a4]
sub eax, ecx
lea esp, [esp]
mov dl, byte [ecx]
mov byte [ecx + eax], dl
inc ecx
test dl, dl
jne 0x410430
lea edi, [esp + 0x5a4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410442
mov eax, esi
mov word [edi], bx
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x410451
lea edi, [esp + 0x5a4]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x410464
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
push 0
push 0
push 0
push esi
call fcn.00422ad5
mov eax, dword [ebp + 0x20]
push 0
push 0
push eax
lea edx, [esp + 0x3b8]
push edx
lea ecx, [ebp + 0x24]
mov edx, esi
call fcn.00412870
add esp, 0x20
cmp eax, 1
jne 0x410580
mov edi, dword [esp + 0x18]
mov ecx, dword [ebp + 0xf4]
mov eax, edi
cdq
xor ebx, ebx
add ecx, eax
adc ebx, edx
add ecx, dword [esp + 0x24]
push 0
adc ebx, dword [esp + 0x2c]
push ebx
push ecx
push esi
call fcn.00422ad5
add esp, 0x10
cmp edi, dword [esp + 0x2c]
jb 0x4104ef
push esi
call fcn.0042309e
add esp, 4
test eax, eax
je 0x4102d0
push 0x400
lea edx, [esp + 0xab8]
push 0
push edx
call fcn.00425400
add esp, 0xc
push esi
call fcn.0042309e
add esp, 4
test eax, eax
jne 0x41086e
mov edi, dword [esp + 0x1c]
push edi
push 0x400
lea eax, [esp + 0xabc]
push 1
push eax
call fcn.004233a6
push edi
mov esi, eax
call fcn.00422e70
add esp, 0x14
mov ebp, eax
mov dword [esp + 0x28], edx
cmp esi, 0x400
jne 0x410859
mov ecx, str.LeaderCab
lea eax, [esp + 0xab4]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410591
test dl, dl
je 0x41057c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410591
add eax, 2
add ecx, 2
test dl, dl
jne 0x410560
xor eax, eax
jmp 0x410596
push esi
call fcn.004229bd
add esp, 4
or eax, 0xffffffff
jmp 0x410d3f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410859
push 0x208
push eax
lea ecx, [esp + 0x3a4]
push ecx
call fcn.00425400
mov eax, dword [esp + 0x7e1dc]
lea edx, [esp + 0x3a8]
add esp, 0xc
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4105c4
lea edi, [esp + 0x39c]
or ebx, 0xffffffff
add edi, ebx
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4105e0
mov dx, word [0x4478c8]
lea eax, [esp + 0xad8]
push eax
lea ecx, [esp + 0x1c]
mov word [edi], dx
call fcn.00409b60
mov dword [esp + 0x7e1c8], 0
mov edx, dword [esp + 0x18]
mov esi, dword [edx - 0xc]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x410634
push esi
lea ecx, [esp + 0x1c]
call fcn.00409e60
mov edx, dword [esp + 0x18]
lea ecx, [esi + 1]
push ecx
push edx
call fcn.00423b01
add esp, 8
cmp eax, 0x50
ja case.0x410651.1
movzx edx, byte [eax + 0x410d78]
jmp dword [edx*4 + 0x410d68]
test esi, esi
jl 0x4108c4
mov eax, dword [esp + 0x18]
cmp esi, dword [eax - 8]
jg 0x4108c4
mov dword [eax - 0xc], esi
mov eax, dword [esp + 0x18]
mov byte [esi + eax], 0
call fcn.0040ac20
cmp eax, 1
je 0x4106fd
cmp eax, 2
je 0x4106fd
mov ecx, dword [esp + 0x18]
push str.LDX64.EXE
push ecx
call fcn.0042357d
add esp, 8
test eax, eax
sete al
test al, al
je 0x4106ce
lea eax, [esp + 0x39c]
add eax, ebx
jmp 0x4106b0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4106b0
mov edx, dword [str.Ldx.exe]
mov ecx, dword [0x448c80]
mov dword [eax], edx
mov dword [eax + 4], ecx
jmp 0x4107ca
lea eax, [esp + 0xad8]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4106d7
lea edi, [esp + 0x39c]
sub eax, edx
add edi, ebx
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4106f0
jmp 0x4107ba
mov edx, dword [esp + 0x18]
push str.LDX32.EXE
push edx
call fcn.0042357d
add esp, 8
test eax, eax
sete al
test al, al
je 0x41073f
lea eax, [esp + 0x39c]
add eax, ebx
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x410721
mov ecx, dword [str.Ldx.exe]
mov edx, dword [0x448c80]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0x4107ca
mov eax, dword [esp + 0x18]
push str.LDDISK32.SYS
push eax
call fcn.0042357d
add esp, 8
test eax, eax
sete al
test al, al
je 0x410792
lea eax, [esp + 0x39c]
add eax, ebx
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x410763
mov ecx, dword [str.Lddisk.sys]
mov edx, dword [0x448ca4]
mov dword [eax], ecx
mov cx, word [0x448ca8]
mov dword [eax + 4], edx
mov dl, byte [0x448caa]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
jmp 0x4107ca
lea eax, [esp + 0xad8]
mov edx, eax
jmp 0x4107a0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4107a0
lea edi, [esp + 0x39c]
sub eax, edx
add edi, ebx
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4107b2
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x1c]
push 0
push edi
push ebp
push esi
call fcn.00422ad5
mov eax, dword [esp + 0xae4]
mov ecx, dword [esp + 0xb58]
mov edx, dword [esp + 0xb54]
push eax
push ecx
push edx
lea eax, [esp + 0x3b8]
push eax
lea ecx, [esp + 0xb5c]
mov edx, esi
call fcn.00412870
add esp, 0x20
cmp eax, 1
jne 0x410896
mov ecx, dword [esp + 0xb44]
mov edx, dword [esp + 0xb48]
add ecx, ebp
push 0
adc edx, edi
push edx
push ecx
push esi
call fcn.00422ad5
mov dword [esp + 0x7e1d8], ebx
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x410859
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0042309e
add esp, 4
test eax, eax
je 0x410517
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004229bd
mov ebp, dword [esp + 0x24]
add esp, 4
cmp ebp, 0xfffffffe
jne 0x4108ce
push 6
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00414237
call fcn.0041426f
mov dword [esp + 0x7e1c8], ebx
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x20], 0xfffffffe
lea edx, [eax + 0xc]
lock xadd dword [edx], ebx
dec ebx
test ebx, ebx
jg 0x41086e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41086e
push 0x80070057
call fcn.0040a000
mov edx, dword [0x453d29]
push 0x448410
push edx
call fcn.0042357d
add esp, 8
test eax, eax
setne al
test al, al
je 0x4108fe
test ebp, ebp
jne 0x4108f7
lea eax, [ebp + 3]
jmp 0x410d3f
mov eax, ebp
jmp 0x410d3f
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x5a8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x410d3b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x207
lea edx, [esp + 0x199]
push 0
push edx
mov byte [esp + 0x1a0], 0
call fcn.00425400
add esp, 0xc
call fcn.00413c41
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41095a
push 0x80004005
call fcn.0040a000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x10bc]
push ecx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x9bc]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x5b4]
push edx
mov dword [esp + 0x7e1dc], 1
call fcn.0042281f
add esp, 0x14
push 0x448cac
push 0x448cb0
lea eax, [esp + 0x9bc]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x7bc]
push edx
call fcn.004244b9
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add esp, 0x14
push 0x208
lea eax, [esp + 0x198]
push eax
push 0
call ebp
lea eax, [esp + 0x194]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4109e7
sub eax, edx
add eax, 0xffffffff
mov bl, 0x5c
js 0x410a05
cmp byte [esp + eax + 0x194], bl
je 0x410a05
sub eax, 1
jns 0x4109f7
mov byte [esp + eax + 0x194], 0
lea eax, [esp + 0x194]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x410a15
mov ecx, dword [str.Ldx.EN]
mov edx, dword [0x448cb8]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [eax], ecx
mov dword [eax + 4], edx
push 0
lea eax, [esp + 0x7b0]
push eax
lea ecx, [esp + 0x19c]
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
lea edx, [esp + 0x7b0]
push edx
lea eax, [esp + 0x20]
push str.Replace_CopyFile__s___d_
push eax
call fcn.00409910
mov ecx, dword [esp + 0x28]
add esp, 0x10
push 0
push ecx
push 0x453d11
call fcn.0040d890
push 0x208
lea edx, [esp + 0x7b0]
push 0
push edx
call fcn.00425400
add esp, 0xc
push 0x208
lea eax, [esp + 0x198]
push 0
push eax
call fcn.00425400
add esp, 0xc
push 0x448cd8
push str.LdxShareData32
lea ecx, [esp + 0x9bc]
push ecx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x7bc]
push eax
call fcn.004244b9
add esp, 0x14
push 0x208
lea ecx, [esp + 0x198]
push ecx
push 0
call ebp
lea eax, [esp + 0x194]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410af0
sub eax, edx
add eax, 0xffffffff
js 0x410b0e
mov edi, edi
cmp byte [esp + eax + 0x194], bl
je 0x410b0e
sub eax, 1
jns 0x410b00
mov byte [esp + eax + 0x194], 0
lea eax, [esp + 0x194]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x410b20
mov edx, dword [str.LdxShareData32.dll]
mov ecx, dword [0x448cf0]
mov dword [eax], edx
mov edx, dword [0x448cf4]
mov dword [eax + 4], ecx
mov ecx, dword [0x448cf8]
mov dword [eax + 8], edx
mov edx, dword [0x448cfc]
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edx
push 0
lea eax, [esp + 0x7b0]
push eax
lea ecx, [esp + 0x19c]
push ecx
call esi
call edi
push eax
lea edx, [esp + 0x7b0]
push edx
lea eax, [esp + 0x20]
push str.Replace_CopyFile___s____d_
push eax
call fcn.00409910
mov ecx, dword [esp + 0x28]
add esp, 0x10
push 0
push ecx
push 0x453d11
call fcn.0040d890
push 0x208
lea edx, [esp + 0x198]
push 0
push edx
call fcn.00425400
add esp, 0xc
push 0x208
lea eax, [esp + 0x198]
push eax
push 0
call ebp
lea eax, [esp + 0x194]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410bc8
sub eax, edx
add eax, 0xffffffff
js 0x410be4
cmp byte [esp + eax + 0x194], bl
je 0x410be4
sub eax, 1
jns 0x410bd6
mov byte [esp + eax + 0x194], 0
lea eax, [esp + 0x194]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x410bf4
mov ecx, dword [0x448bf8]
mov edx, dword [0x448bfc]
mov dword [eax], ecx
mov cl, byte [0x448c00]
mov dword [eax + 4], edx
push 0
lea edx, [esp + 0x5a8]
mov byte [eax + 8], cl
push edx
lea eax, [esp + 0x19c]
push eax
call esi
call edi
push eax
lea ecx, [esp + 0x5a8]
push ecx
lea edx, [esp + 0x20]
push str.Replace_CopyFile__s___d_
push edx
call fcn.00409910
mov ebx, dword [esp + 0x28]
add esp, 0x10
push 0
push ebx
push 0x453d11
call fcn.0040d890
push 0x207
lea eax, [esp + 0xeb9]
push 0
push eax
mov byte [esp + 0xec0], 0
call fcn.00425400
lea eax, [esp + 0xec0]
add esp, 0xc
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x410c80
mov ecx, dword [str.__Back__]
mov edx, dword [0x448d20]
mov dword [eax], ecx
mov cl, byte [0x448d24]
mov dword [eax + 4], edx
mov byte [eax + 8], cl
mov eax, dword [esp + 0x30]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x410ca8
lea edi, [esp + 0xeb4]
sub eax, ecx
mov esi, ecx
dec edi
jmp 0x410cc0
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x410cc0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xeb4]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x410ce0
mov dx, word [0x448510]
push 1
lea eax, [esp + 0xeb8]
push eax
lea ecx, [esp + 0x5ac]
push ecx
mov word [edi], dx
call fcn.0040a410
lea eax, [ebx - 0x10]
add esp, 0xc
mov dword [esp + 0x20], 3
mov dword [esp + 0x7e1c8], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x410d3b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x7e1c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e1a8]
xor ecx, esp
call fcn.00421f65
add esp, 0x7e1b8
ret