Function at 0x4355a0
Capabilities:
Copy file
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a5368
mov eax, dword fs:[0]
push eax
mov eax, 0x1bcc
call fcn.004720d0
mov eax, dword [0x4c66b8]
xor eax, esp
mov dword [esp + 0x1bc8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c66b8]
xor eax, esp
push eax
lea eax, [esp + 0x1be0]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1bf0]
xor ebp, ebp
lea ecx, [esp + 0x114]
push ebp
push ecx
mov dword [esp + 0x20], eax
call fcn.0043c6b0
add esp, 8
cmp dword [esp + 0x128], ebp
mov dword [esp + 0x1be8], ebp
jne 0x435630
cmp dword [esp + 0x12c], 8
jb 0x436096
mov edx, dword [esp + 0x118]
push edx
call fcn.00470fc9
add esp, 4
jmp 0x436096
lea eax, [esp + 0xf8]
push ebp
push eax
call fcn.0043c600
add esp, 8
cmp dword [esp + 0x10c], ebp
mov byte [esp + 0x1be8], 1
jne 0x435693
mov esi, 8
cmp dword [esp + 0x110], esi
jb 0x435670
mov ecx, dword [esp + 0xfc]
push ecx
call fcn.00470fc9
add esp, 4
cmp dword [esp + 0x12c], esi
mov dword [esp + 0x110], 7
mov dword [esp + 0x10c], ebp
mov word [esp + 0xfc], bp
jmp 0x435615
push str.dlcore.dll
lea eax, [esp + 0x118]
push eax
lea ecx, [esp + 0x138]
push ecx
call fcn.0040a3f0
push str._tnproxy.dll
lea edx, [esp + 0x124]
push edx
lea eax, [esp + 0x1b4]
push eax
mov byte [esp + 0x1c00], 2
call fcn.0040a3f0
push str.extract.dll
lea ecx, [esp + 0x130]
push ecx
lea edx, [esp + 0x188]
push edx
mov byte [esp + 0x1c0c], 3
call fcn.0040a3f0
push str.DownloadProxyPS.dll
lea eax, [esp + 0x13c]
push eax
lea ecx, [esp + 0x1b0]
push ecx
mov byte [esp + 0x1c18], 4
call fcn.0040a3f0
push str._bugreport.exe
lea edx, [esp + 0x148]
push edx
lea eax, [esp + 0x1f4]
push eax
mov byte [esp + 0x1c24], 5
call fcn.0040a3f0
push str._tinyxml.dll
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x21c]
push edx
mov byte [esp + 0x1c30], 6
call fcn.0040a3f0
add esp, 0x48
mov eax, dword [esp + 0xfc]
mov ebx, 8
cmp dword [esp + 0x110], ebx
mov edi, 7
mov byte [esp + 0x1be8], 7
jae 0x435783
lea eax, [esp + 0xfc]
push eax
lea ecx, [esp + 0x2d8]
call fcn.00437cd0
xor eax, eax
mov dword [esp + 0x1bce], eax
mov word [esp + 0x1bd2], ax
lea eax, [esp + 0x1bcc]
push eax
lea ecx, [esp + 0x2d8]
mov byte [esp + 0x1bec], 8
mov word [esp + 0x1bd0], bp
call fcn.004378e0
movzx esi, word [esp + 0x1bd0]
push 0x4af938
lea ecx, [esp + 0x20]
call fcn.0040a3b0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0xe0]
push edx
mov byte [esp + 0x1bf0], 9
call fcn.0043bf00
add esp, 8
cmp dword [esp + 0x34], ebx
mov byte [esp + 0x1be8], 0xb
jb 0x435813
mov eax, dword [esp + 0x20]
push eax
call fcn.00470fc9
add esp, 4
cmp dword [esp + 0xf0], ebp
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebp
mov word [esp + 0x20], bp
jne 0x4359db
cmp dword [esp + 0xf4], ebx
jb 0x435846
mov ecx, dword [esp + 0xe0]
push ecx
call fcn.00470fc9
add esp, 4
lea ecx, [esp + 0x2d4]
mov dword [esp + 0xf4], edi
mov dword [esp + 0xf0], ebp
mov word [esp + 0xe0], bp
mov byte [esp + 0x1be8], 7
call fcn.00437950
cmp dword [esp + 0x1f0], ebx
jb 0x435889
mov edx, dword [esp + 0x1dc]
push edx
call fcn.00470fc9
add esp, 4
cmp dword [esp + 0x1d4], ebx
mov dword [esp + 0x1f0], edi
mov dword [esp + 0x1ec], ebp
mov word [esp + 0x1dc], bp
jb 0x4358b8
mov eax, dword [esp + 0x1c0]
push eax
call fcn.00470fc9
add esp, 4
cmp dword [esp + 0x19c], ebx
mov dword [esp + 0x1d4], edi
mov dword [esp + 0x1d0], ebp
mov word [esp + 0x1c0], bp
jb 0x4358e7
mov ecx, dword [esp + 0x188]
push ecx
call fcn.00470fc9
add esp, 4
cmp dword [esp + 0x180], ebx
mov dword [esp + 0x19c], edi
mov dword [esp + 0x198], ebp
mov word [esp + 0x188], bp
jb 0x435916
mov edx, dword [esp + 0x16c]
push edx
call fcn.00470fc9
add esp, 4
cmp dword [esp + 0x1b8], ebx
mov dword [esp + 0x180], edi
mov dword [esp + 0x17c], ebp
mov word [esp + 0x16c], bp
jb 0x435945
mov eax, dword [esp + 0x1a4]
push eax
call fcn.00470fc9
add esp, 4
cmp dword [esp + 0x148], ebx
mov dword [esp + 0x1b8], edi
mov dword [esp + 0x1b4], ebp
mov word [esp + 0x1a4], bp
jb 0x435974
mov ecx, dword [esp + 0x134]
push ecx
call fcn.00470fc9
add esp, 4
cmp dword [esp + 0x110], ebx
mov dword [esp + 0x148], edi
mov dword [esp + 0x144], ebp
mov word [esp + 0x134], bp
jb 0x4359a3
mov edx, dword [esp + 0xfc]
push edx
call fcn.00470fc9
add esp, 4
cmp dword [esp + 0x12c], ebx
mov dword [esp + 0x110], edi
mov dword [esp + 0x10c], ebp
mov word [esp + 0xfc], bp
jb 0x436096
mov eax, dword [esp + 0x118]
push eax
call fcn.00470fc9
add esp, 4
jmp 0x436096
lea ecx, [esp + 0xdc]
push esi
push ecx
call fcn.00435180
add esp, 8
test al, al
je 0x436016
push 1
push 3
lea ecx, [esp + 0x5c]
call fcn.00434f00
push esi
push 0x4ae764
lea edx, [esp + 0xe4]
push edx
lea eax, [esp + 0x68]
mov bl, 0xc
push eax
mov byte [esp + 0x1bf8], bl
call fcn.00434130
add esp, 8
push eax
call fcn.004343c0
add esp, 8
mov ecx, eax
call fcn.004345e0
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x58]
call fcn.00432650
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0xe8]
mov byte [esp + 0x1bf4], 0xd
call fcn.00409c10
lea ecx, [esp + 0x38]
mov byte [esp + 0x1be8], bl
call fcn.00421300
lea edx, [esp + 0xdc]
push edx
call fcn.0043b8e0
add esp, 4
test al, al
jne 0x435a8f
lea eax, [esp + 0xdc]
push eax
call fcn.0043ba40
add esp, 4
push 0x4afc2c
lea ecx, [esp + 0xe0]
push ecx
lea edx, [esp + 0x154]
push edx
call fcn.0040a3f0
push str.dlcore.dll
lea eax, [esp + 0xec]
push eax
lea ecx, [esp + 0x208]
push ecx
mov byte [esp + 0x1c00], 0xe
call fcn.0040a3f0
push str._tnproxy.dll
lea edx, [esp + 0xf8]
push edx
lea eax, [esp + 0x268]
push eax
mov byte [esp + 0x1c0c], 0xf
call fcn.0040a3f0
push str.extract.dll
lea ecx, [esp + 0x104]
push ecx
lea edx, [esp + 0x2c8]
push edx
mov byte [esp + 0x1c18], 0x10
call fcn.0040a3f0
push str.DownloadProxyPS.dll
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0x2b8]
push ecx
mov byte [esp + 0x1c24], 0x11
call fcn.0040a3f0
push str._bugreport.exe
lea edx, [esp + 0x11c]
push edx
lea eax, [esp + 0x270]
push eax
mov byte [esp + 0x1c30], 0x12
call fcn.0040a3f0
add esp, 0x48
push str._tinyxml.dll
lea ecx, [esp + 0xe0]
push ecx
lea edx, [esp + 0x26c]
push edx
mov byte [esp + 0x1bf4], 0x13
call fcn.0040a3f0
add esp, 0xc
mov ecx, dword [esp + 0x150]
mov esi, 8
cmp dword [esp + 0x164], esi
mov byte [esp + 0x1be8], 0x14
jae 0x435b9f
lea ecx, [esp + 0x150]
cmp dword [esp + 0x110], esi
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
jb 0x4360be
mov eax, dword [esp + 0xfc]
cmp eax, ebp
je 0x435bc6
cmp ecx, ebp
je 0x435bc6
push ebp
push ecx
push eax
call edi
cmp dword [esp + 0x20c], esi
mov eax, dword [esp + 0x1f8]
mov byte [esp + 0x17], 1
jae 0x435be2
lea eax, [esp + 0x1f8]
push eax
call fcn.00413f90
add esp, 4
test al, al
je 0x435cf3
cmp dword [esp + 0x148], esi
mov eax, dword [esp + 0x134]
jae 0x435c0a
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0xb28]
call fcn.00437cd0
xor eax, eax
mov dword [esp + 0x1bc6], eax
mov word [esp + 0x1bca], ax
lea eax, [esp + 0x1bc4]
mov bl, 0x15
push eax
lea ecx, [esp + 0xb28]
mov byte [esp + 0x1bec], bl
mov word [esp + 0x1bc8], bp
call fcn.004378e0
cmp dword [esp + 0x20c], 8
movzx esi, word [esp + 0x1bc8]
mov eax, dword [esp + 0x1f8]
jae 0x435c6d
lea eax, [esp + 0x1f8]
push eax
lea ecx, [esp + 0x1378]
call fcn.00437cd0
lea ecx, [esp + 0x1bd4]
xor eax, eax
push ecx
lea ecx, [esp + 0x1378]
mov byte [esp + 0x1bec], 0x16
mov word [esp + 0x1bd8], bp
mov dword [esp + 0x1bda], eax
mov word [esp + 0x1bde], ax
call fcn.004378e0
movzx eax, word [esp + 0x1bd8]
cmp esi, eax
jae 0x435cc0
mov byte [esp + 0x17], 0
lea ecx, [esp + 0x1374]
mov byte [esp + 0x1be8], bl
call fcn.00437950
lea ecx, [esp + 0xb24]
mov byte [esp + 0x1be8], 0x14
call fcn.00437950
cmp byte [esp + 0x17], 0
mov esi, 8
je 0x435d2b
cmp dword [esp + 0x20c], esi
mov ecx, dword [esp + 0x1f8]
jae 0x435d0a
lea ecx, [esp + 0x1f8]
cmp dword [esp + 0x148], esi
jb 0x4360ca
mov eax, dword [esp + 0x134]
cmp eax, ebp
je 0x435d2b
cmp ecx, ebp
je 0x435d2b
push ebp
push ecx
push eax
call edi
cmp dword [esp + 0x260], esi
mov ecx, dword [esp + 0x24c]
jae 0x435d42
lea ecx, [esp + 0x24c]
cmp dword [esp + 0x1b8], esi
jb 0x4360d6
mov eax, dword [esp + 0x1a4]
cmp eax, ebp
je 0x435d63
cmp ecx, ebp
je 0x435d63
push ebp
push ecx
push eax
call edi
cmp dword [esp + 0x2b4], esi
mov ecx, dword [esp + 0x2a0]
jae 0x435d7a
lea ecx, [esp + 0x2a0]
cmp dword [esp + 0x180], esi
jb 0x4360e2
mov eax, dword [esp + 0x16c]
cmp eax, ebp
je 0x435d9b
cmp ecx, ebp
je 0x435d9b
push ebp
push ecx
push eax
call edi
cmp dword [esp + 0x298], esi
mov ecx, dword [esp + 0x284]
jae 0x435db2
lea ecx, [esp + 0x284]
cmp dword [esp + 0x19c], esi
jb 0x4360ee
mov eax, dword [esp + 0x188]
cmp eax, ebp
je 0x435dd3
cmp ecx, ebp
je 0x435dd3
push ebp
push ecx
push eax
call edi
cmp dword [esp + 0x244], esi
mov ecx, dword [esp + 0x230]
jae 0x435dea
lea ecx, [esp + 0x230]
cmp dword [esp + 0x1d4], esi
jb 0x4360fa
mov eax, dword [esp + 0x1c0]
cmp eax, ebp
je 0x435e0b
cmp ecx, ebp
je 0x435e0b
push ebp
push ecx
push eax
call edi
cmp dword [esp + 0x27c], esi
mov ecx, dword [esp + 0x268]
jae 0x435e22
lea ecx, [esp + 0x268]
cmp dword [esp + 0x1f0], esi
jb 0x436106
mov eax, dword [esp + 0x1dc]
cmp eax, ebp
je 0x435e43
cmp ecx, ebp
je 0x435e43
push ebp
push ecx
push eax
call edi
mov ecx, dword [esp + 0x18]
cmp ecx, ebp
je 0x435e50
call fcn.0044f8b0
lea edx, [esp + 0x210]
push edx
call fcn.00432440
lea eax, [esp + 0x150]
push eax
lea ecx, [esp + 0x40]
mov bl, 0x17
push ecx
mov byte [esp + 0x1bf4], bl
call fcn.0043b4c0
add esp, 0xc
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x158]
mov byte [esp + 0x1bf4], 0x18
call fcn.00409c10
lea ecx, [esp + 0x38]
mov byte [esp + 0x1be8], bl
call fcn.00421300
cmp dword [esp + 0x224], ebp
je 0x435f13
cmp dword [esp + 0x228], esi
mov eax, dword [esp + 0x214]
jae 0x435ec3
lea eax, [esp + 0x214]
push eax
call fcn.00413f90
add esp, 4
test al, al
je 0x435f13
lea edx, [esp + 0x14c]
push edx
lea eax, [esp + 0x214]
push eax
call fcn.004146d0
add esp, 8
test al, al
je 0x435f13
cmp dword [esp + 0x228], esi
mov eax, dword [esp + 0x214]
jae 0x435f03
lea eax, [esp + 0x214]
mov ecx, dword [0x4c60a8]
push ecx
push eax
call fcn.00438000
add esp, 8
cmp dword [esp + 0x164], esi
mov eax, dword [esp + 0x150]
jae 0x435f2a
lea eax, [esp + 0x150]
push eax
call fcn.00413f90
add esp, 4
test al, al
je 0x435f5e
cmp dword [esp + 0x164], esi
mov eax, dword [esp + 0x150]
jae 0x435f4e
lea eax, [esp + 0x150]
push ebp
push ebp
push str.__RegServer
push eax
push ebp
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.Installlog.txt
lea edx, [esp + 0xe0]
push edx
lea eax, [esp + 0x2c0]
push eax
call fcn.0040a3f0
add esp, 0xc
lea ecx, [esp + 0x2b8]
call fcn.00421300
lea ecx, [esp + 0x210]
call fcn.00421300
lea ecx, [esp + 0x264]
call fcn.00421300
lea ecx, [esp + 0x22c]
call fcn.00421300
lea ecx, [esp + 0x280]
call fcn.00421300
lea ecx, [esp + 0x29c]
call fcn.00421300
lea ecx, [esp + 0x248]
call fcn.00421300
lea ecx, [esp + 0x1f4]
call fcn.00421300
lea ecx, [esp + 0x14c]
call fcn.00421300
lea ecx, [esp + 0xa8]
mov byte [esp + 0x1be8], 0xb
call fcn.004310c0
lea ecx, [esp + 0xa8]
push ecx
mov dword [esp + 0xac], 0x4afa98
call fcn.0048e633
add esp, 4
lea ecx, [esp + 0xdc]
call fcn.00421300
lea ecx, [esp + 0x2d4]
mov byte [esp + 0x1be8], 7
call fcn.00437950
lea ecx, [esp + 0x1d8]
call fcn.00421300
lea ecx, [esp + 0x1bc]
call fcn.00421300
lea ecx, [esp + 0x184]
call fcn.00421300
lea ecx, [esp + 0x168]
call fcn.00421300
lea ecx, [esp + 0x1a0]
call fcn.00421300
lea ecx, [esp + 0x130]
call fcn.00421300
lea ecx, [esp + 0xf8]
call fcn.00421300
lea ecx, [esp + 0x114]
call fcn.00421300
mov ecx, dword [esp + 0x1be0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1bc8]
xor ecx, esp
call fcn.00470f90
add esp, 0x1bd8
ret
lea eax, [esp + 0xfc]
jmp 0x435bbd
lea eax, [esp + 0x134]
jmp 0x435d22
lea eax, [esp + 0x1a4]
jmp 0x435d5a
lea eax, [esp + 0x16c]
jmp 0x435d92
lea eax, [esp + 0x188]
jmp 0x435dca
lea eax, [esp + 0x1c0]
jmp 0x435e02
lea eax, [esp + 0x1dc]
jmp 0x435e3a