Function at 0x47ddb8
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x15
push 0
push 0
dec ecx
jne 0x47ddc0
push ebx
push esi
push edi
mov eax, 0x47db50
call fcn.0040631c
xor eax, eax
push ebp
push 0x47e79a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, dword [0x4807ec]
mov eax, dword [eax]
call fcn.0045e7b8
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00408dac
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408310
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x20]
mov eax, 0x47e7b4
call fcn.00408310
mov edx, dword [ebp - 0x20]
pop eax
call fcn.00404810
je 0x47de3d
push 0
mov cx, word [0x47e7c8]
mov dl, 1
mov eax, 0x47e7d4
call fcn.0042a030
jmp 0x47e77c
lea edx, [ebp - 0x2c]
mov eax, dword [0x4807ec]
mov eax, dword [eax]
call fcn.0045e7b8
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00408d78
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00408310
mov eax, dword [ebp - 0x24]
mov edx, 0x47e7fc
call fcn.00404810
je 0x47df2c
push 0
mov cx, word [0x47e7c8]
mov dl, 1
mov eax, 0x47e808
call fcn.0042a030
push 0xffffffffffffffff
lea edx, [ebp - 0x38]
mov eax, dword [0x4807ec]
mov eax, dword [eax]
call fcn.0045e7b8
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.00408dac
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
mov edx, 0x47e7fc
call fcn.00404710
mov eax, dword [ebp - 0x30]
call fcn.004048c4
push eax
lea edx, [ebp - 0x3c]
mov eax, dword [0x4807ec]
mov eax, dword [eax]
call fcn.0045e7b8
mov eax, dword [ebp - 0x3c]
call fcn.004048c4
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [0x4807ec]
mov eax, dword [eax]
call fcn.0045e1e4
push 5
lea edx, [ebp - 0x48]
mov eax, dword [0x4807ec]
mov eax, dword [eax]
call fcn.0045e7b8
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
call fcn.00408dac
mov ecx, dword [ebp - 0x44]
lea eax, [ebp - 0x40]
mov edx, 0x47e7fc
call fcn.00404710
mov eax, dword [ebp - 0x40]
call fcn.004048c4
push eax
call sub.kernel32.dll_WinExec
call fcn.0047d98c
jmp 0x47e77c
push 0x47e848
push 0xffffffffffffffff
push 0
call fcn.004065bc
mov dword [0x481cec], eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x47e77c
call fcn.0047da58
mov eax, dword [0x4806c8]
cmp dword [eax], 0x14
jle 0x47e0ce
push 0
mov ecx, 0x47e858
mov edx, 0x47e860
mov eax, dword [0x4807ec]
mov eax, dword [eax]
call fcn.0045e288
mov dl, 1
mov eax, dword [0x42f97c]
call fcn.0042fa7c
mov dword [0x481cf0], eax
xor eax, eax
push ebp
push 0x47e006
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [0x481cf0]
call fcn.0042fb1c
mov edx, 0x47e8a4
mov eax, dword [0x481cf0]
call fcn.0042fca4
test al, al
jne 0x47dfc6
mov eax, dword [0x4806c8]
xor edx, edx
mov dword [eax], edx
jmp 0x47dfee
mov edx, 0x47e8a4
xor ecx, ecx
mov eax, dword [0x481cf0]
call fcn.0042fb80
mov edx, 0x47e904
mov eax, dword [0x481cf0]
call fcn.0042fe90
mov edx, dword [0x4806c8]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e00d
mov eax, dword [0x481cf0]
call fcn.0042faec
ret
mov eax, dword [0x4806c8]
cmp dword [eax], 0x14
jne 0x47e0fd
push 0
mov cx, word [0x47e7c8]
mov dl, 1
mov eax, 0x47e950
call fcn.0042a030
mov eax, dword [0x481cec]
push eax
call sub.kernel32.dll_ReleaseMutex
jmp 0x47e77c
mov dl, 1
mov eax, dword [0x42f97c]
call fcn.0042fa7c
mov dword [0x481cf4], eax
xor eax, eax
push ebp
push 0x47e432
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x47e410
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [0x481cf4]
call fcn.0042fb1c
mov eax, dword [0x4806c8]
cmp dword [eax], 0
jne 0x47e325
mov edx, 0x47e8a4
mov eax, dword [0x481cf4]
call fcn.0042fca4
test al, al
jne 0x47e207
mov edx, 0x47e8a4
mov cl, 1
mov eax, dword [0x481cf4]
call fcn.0042fb80
mov ecx, dword [0x4807ec]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x47c2cc]
call fcn.004567a4
mov edx, dword [0x4806f0]
mov dword [edx], eax
mov eax, dword [0x4806f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x308]
mov dl, 1
call fcn.0043dfd4
mov eax, dword [0x4806f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30c]
mov dl, 1
call fcn.0043dfd4
mov eax, dword [0x4806f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x304]
mov dl, 1
call fcn.0042b978
mov eax, dword [0x4806f0]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xec]
mov eax, dword [0x4806f0]
mov eax, dword [eax]
call fcn.00403658
mov eax, dword [0x4806f0]
xor edx, edx
mov dword [eax], edx
mov ecx, dword [0x4806c8]
mov ecx, dword [ecx]
mov edx, 0x47e904
mov eax, dword [0x481cf4]
call fcn.0042fe7c
jmp 0x47e406
mov edx, 0x47e8a4
xor ecx, ecx
mov eax, dword [0x481cf4]
call fcn.0042fb80
mov edx, 0x47e904
mov eax, dword [0x481cf4]
call fcn.0042fe90
mov edx, dword [0x4806c8]
cmp eax, dword [edx]
je 0x47e280
push 0
lea edx, [ebp - 0x6c]
mov eax, dword [0x4806c8]
mov eax, dword [eax]
call fcn.004087e0
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
mov edx, 0x47e980
call fcn.00404710
mov eax, dword [ebp - 0x68]
mov cx, word [0x47e7c8]
mov dl, 1
call fcn.0042a030
mov eax, dword [0x481cec]
push eax
call sub.kernel32.dll_ReleaseMutex
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00403ea4
jmp 0x47e77c
mov edx, 0x47e9a8
mov eax, dword [0x481cf4]
call fcn.0042fecc
test al, al
je 0x47e2b9
mov edx, 0x47e9a8
mov eax, dword [0x481cf4]
call fcn.0042fe5c
mov ecx, dword [0x4806c8]
mov ecx, dword [ecx]
mov edx, 0x47e904
mov eax, dword [0x481cf4]
call fcn.0042fe7c
mov edx, 0x47e904
mov eax, dword [0x481cf4]
call fcn.0042fe90
mov edx, dword [0x4806c8]
cmp eax, dword [edx]
je 0x47e406
push 0
lea edx, [ebp - 0x74]
mov eax, dword [0x4806c8]
mov eax, dword [eax]
call fcn.004087e0
mov ecx, dword [ebp - 0x74]
lea eax, [ebp - 0x70]
mov edx, 0x47e9b8
call fcn.00404710
mov eax, dword [ebp - 0x70]
mov cx, word [0x47e7c8]
mov dl, 1
call fcn.0042a030
mov eax, dword [0x481cec]
push eax
call sub.kernel32.dll_ReleaseMutex
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00403ea4
jmp 0x47e77c
mov edx, 0x47e8a4
mov eax, dword [0x481cf4]
call fcn.0042fca4
test al, al
jne 0x47e387
push 0
lea edx, [ebp - 0x7c]
mov eax, dword [0x4806c8]
mov eax, dword [eax]
call fcn.004087e0
mov ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
mov edx, 0x47e9e0
call fcn.00404710
mov eax, dword [ebp - 0x78]
mov cx, word [0x47e7c8]
mov dl, 1
call fcn.0042a030
mov eax, dword [0x481cec]
push eax
call sub.kernel32.dll_ReleaseMutex
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00403ea4
jmp 0x47e77c
mov edx, 0x47e8a4
xor ecx, ecx
mov eax, dword [0x481cf4]
call fcn.0042fb80
mov edx, 0x47e904
mov eax, dword [0x481cf4]
call fcn.0042fe90
mov edx, dword [0x4806c8]
cmp eax, dword [edx]
je 0x47e406
push 0
lea edx, [ebp - 0x84]
mov eax, dword [0x4806c8]
mov eax, dword [eax]
call fcn.004087e0
mov ecx, dword [ebp - 0x84]
lea eax, [ebp - 0x80]
mov edx, 0x47ea08
call fcn.00404710
mov eax, dword [ebp - 0x80]
mov cx, word [0x47e7c8]
mov dl, 1
call fcn.0042a030
mov eax, dword [0x481cec]
push eax
call sub.kernel32.dll_ReleaseMutex
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00403ea4
jmp 0x47e77c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47e41a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e439
mov eax, dword [0x481cf4]
call fcn.00403658
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e7a1
lea eax, [ebp - 0xa8]
mov edx, 0x26
call fcn.00404428
ret