Function at 0x433be0
Capabilities:
Copy file
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a57cc
mov eax, dword fs:[0]
push eax
mov eax, 0x1b5c
call fcn.00470cd0
mov eax, dword [0x4c8678]
xor eax, esp
mov dword [esp + 0x1b58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c8678]
xor eax, esp
push eax
lea eax, [esp + 0x1b70]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1b80]
xor edi, edi
lea ecx, [esp + 0x130]
push edi
push ecx
mov dword [esp + 0x20], eax
call fcn.0043ab90
add esp, 8
cmp dword [esp + 0x144], edi
mov dword [esp + 0x1b78], edi
jne 0x433c70
cmp dword [esp + 0x148], 8
jb 0x43454a
mov edx, dword [esp + 0x134]
push edx
call fcn.0046fbc9
add esp, 4
jmp 0x43454a
lea eax, [esp + 0xdc]
push edi
push eax
call fcn.0043aae0
add esp, 8
cmp dword [esp + 0xf0], edi
mov byte [esp + 0x1b78], 1
jne 0x433cd3
mov esi, 8
cmp dword [esp + 0xf4], esi
jb 0x433cb0
mov ecx, dword [esp + 0xe0]
push ecx
call fcn.0046fbc9
add esp, 4
cmp dword [esp + 0x148], esi
mov dword [esp + 0xf4], 7
mov dword [esp + 0xf0], edi
mov word [esp + 0xe0], di
jmp 0x433c55
push str.dlcore.dll
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x154]
push ecx
call fcn.0040a2a0
push str._tnproxy.dll
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x198]
push eax
mov byte [esp + 0x1b90], 2
call fcn.0040a2a0
push str.extract.dll
lea ecx, [esp + 0x14c]
push ecx
lea edx, [esp + 0x188]
push edx
mov byte [esp + 0x1b9c], 3
call fcn.0040a2a0
push str.DownloadProxyPS.dll
lea eax, [esp + 0x158]
push eax
lea ecx, [esp + 0x1cc]
push ecx
mov byte [esp + 0x1ba8], 4
call fcn.0040a2a0
add esp, 0x30
mov eax, dword [esp + 0xe0]
mov ebp, 8
cmp dword [esp + 0xf4], ebp
mov byte [esp + 0x1b78], 5
jae 0x433d7a
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x268]
call fcn.004361a0
xor eax, eax
lea edx, [esp + 0x1b54]
push edx
lea ecx, [esp + 0x268]
mov byte [esp + 0x1b7c], 6
mov word [esp + 0x1b58], di
mov dword [esp + 0x1b5a], eax
mov word [esp + 0x1b5e], ax
call fcn.00435db0
movzx esi, word [esp + 0x1b58]
push 0x4b0828
lea ecx, [esp + 0x20]
call fcn.0040a260
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0xfc]
mov ebx, 7
push ecx
mov byte [esp + 0x1b80], bl
call fcn.0043a3e0
add esp, 8
cmp dword [esp + 0x34], ebp
mov byte [esp + 0x1b78], 9
jb 0x433e0e
mov edx, dword [esp + 0x20]
push edx
call fcn.0046fbc9
add esp, 4
cmp dword [esp + 0x10c], edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], edi
mov word [esp + 0x20], di
jne 0x433f78
cmp dword [esp + 0x110], ebp
jb 0x433e41
mov eax, dword [esp + 0xfc]
push eax
call fcn.0046fbc9
add esp, 4
lea ecx, [esp + 0x264]
mov dword [esp + 0x110], ebx
mov dword [esp + 0x10c], edi
mov word [esp + 0xfc], di
mov byte [esp + 0x1b78], 5
call fcn.00435e20
cmp dword [esp + 0x1b8], ebp
jb 0x433e84
mov ecx, dword [esp + 0x1a4]
push ecx
call fcn.0046fbc9
add esp, 4
cmp dword [esp + 0x180], ebp
mov dword [esp + 0x1b8], ebx
mov dword [esp + 0x1b4], edi
mov word [esp + 0x1a4], di
jb 0x433eb3
mov edx, dword [esp + 0x16c]
push edx
call fcn.0046fbc9
add esp, 4
cmp dword [esp + 0x19c], ebp
mov dword [esp + 0x180], ebx
mov dword [esp + 0x17c], edi
mov word [esp + 0x16c], di
jb 0x433ee2
mov eax, dword [esp + 0x188]
push eax
call fcn.0046fbc9
add esp, 4
cmp dword [esp + 0x164], ebp
mov dword [esp + 0x19c], ebx
mov dword [esp + 0x198], edi
mov word [esp + 0x188], di
jb 0x433f11
mov ecx, dword [esp + 0x150]
push ecx
call fcn.0046fbc9
add esp, 4
cmp dword [esp + 0xf4], ebp
mov dword [esp + 0x164], ebx
mov dword [esp + 0x160], edi
mov word [esp + 0x150], di
jb 0x433f40
mov edx, dword [esp + 0xe0]
push edx
call fcn.0046fbc9
add esp, 4
cmp dword [esp + 0x148], ebp
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf0], edi
mov word [esp + 0xe0], di
jb 0x43454a
mov eax, dword [esp + 0x134]
push eax
call fcn.0046fbc9
add esp, 4
jmp 0x43454a
lea ecx, [esp + 0xf8]
push esi
push ecx
call fcn.004337c0
add esp, 8
test al, al
je 0x4344e2
push 1
push 3
lea ecx, [esp + 0x5c]
call fcn.00433540
push esi
push 0x4af774
lea edx, [esp + 0x100]
push edx
lea eax, [esp + 0x68]
mov bl, 0xa
push eax
mov byte [esp + 0x1b88], bl
call fcn.00432770
add esp, 8
push eax
call fcn.00432a00
add esp, 8
mov ecx, eax
call fcn.00432c20
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x58]
call fcn.00430bd0
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x104]
mov byte [esp + 0x1b84], 0xb
call fcn.00409ac0
lea ecx, [esp + 0x38]
mov byte [esp + 0x1b78], bl
call fcn.0041f9a0
lea edx, [esp + 0xf8]
push edx
call fcn.00439dc0
add esp, 4
test al, al
jne 0x43402c
lea eax, [esp + 0xf8]
push eax
call fcn.00439f20
add esp, 4
push 0x4b0adc
lea ecx, [esp + 0xfc]
push ecx
lea edx, [esp + 0x11c]
push edx
call fcn.0040a2a0
push str.dlcore.dll
lea eax, [esp + 0x108]
push eax
lea ecx, [esp + 0x1d0]
push ecx
mov byte [esp + 0x1b90], 0xc
call fcn.0040a2a0
push str._tnproxy.dll
lea edx, [esp + 0x114]
push edx
lea eax, [esp + 0x24c]
push eax
mov byte [esp + 0x1b9c], 0xd
call fcn.0040a2a0
push str.extract.dll
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x220]
push edx
mov byte [esp + 0x1ba8], 0xe
call fcn.0040a2a0
push str.DownloadProxyPS.dll
lea eax, [esp + 0x12c]
push eax
lea ecx, [esp + 0x248]
push ecx
mov byte [esp + 0x1bb4], 0xf
call fcn.0040a2a0
add esp, 0x3c
cmp dword [esp + 0x12c], ebp
mov ecx, dword [esp + 0x118]
mov byte [esp + 0x1b78], 0x10
jae 0x4340f0
lea ecx, [esp + 0x118]
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, 8
cmp dword [esp + 0xf4], esi
jb 0x434572
mov eax, dword [esp + 0xe0]
cmp eax, edi
je 0x43411c
cmp ecx, edi
je 0x43411c
push edi
push ecx
push eax
call ebp
cmp dword [esp + 0x1d4], esi
mov eax, dword [esp + 0x1c0]
mov byte [esp + 0x17], 1
jae 0x434138
lea eax, [esp + 0x1c0]
push eax
call fcn.00413b20
add esp, 4
test al, al
je 0x434249
cmp dword [esp + 0x164], esi
mov eax, dword [esp + 0x150]
jae 0x434160
lea eax, [esp + 0x150]
push eax
lea ecx, [esp + 0xab8]
call fcn.004361a0
xor eax, eax
lea edx, [esp + 0x1b5c]
mov bl, 0x11
push edx
lea ecx, [esp + 0xab8]
mov byte [esp + 0x1b7c], bl
mov word [esp + 0x1b60], di
mov dword [esp + 0x1b62], eax
mov word [esp + 0x1b66], ax
call fcn.00435db0
cmp dword [esp + 0x1d4], 8
movzx esi, word [esp + 0x1b60]
mov eax, dword [esp + 0x1c0]
jae 0x4341c3
lea eax, [esp + 0x1c0]
push eax
lea ecx, [esp + 0x1308]
call fcn.004361a0
xor eax, eax
mov dword [esp + 0x1b66], eax
mov word [esp + 0x1b6a], ax
lea eax, [esp + 0x1b64]
push eax
lea ecx, [esp + 0x1308]
mov byte [esp + 0x1b7c], 0x12
mov word [esp + 0x1b68], di
call fcn.00435db0
movzx eax, word [esp + 0x1b68]
cmp esi, eax
jae 0x434216
mov byte [esp + 0x17], 0
lea ecx, [esp + 0x1304]
mov byte [esp + 0x1b78], bl
call fcn.00435e20
lea ecx, [esp + 0xab4]
mov byte [esp + 0x1b78], 0x10
call fcn.00435e20
cmp byte [esp + 0x17], 0
mov esi, 8
je 0x434281
cmp dword [esp + 0x1d4], esi
mov ecx, dword [esp + 0x1c0]
jae 0x434260
lea ecx, [esp + 0x1c0]
cmp dword [esp + 0x164], esi
jb 0x43457e
mov eax, dword [esp + 0x150]
cmp eax, edi
je 0x434281
cmp ecx, edi
je 0x434281
push edi
push ecx
push eax
call ebp
cmp dword [esp + 0x244], esi
mov ecx, dword [esp + 0x230]
jae 0x434298
lea ecx, [esp + 0x230]
cmp dword [esp + 0x19c], esi
jb 0x43458a
mov eax, dword [esp + 0x188]
cmp eax, edi
je 0x4342b9
cmp ecx, edi
je 0x4342b9
push edi
push ecx
push eax
call ebp
cmp dword [esp + 0x20c], esi
mov ecx, dword [esp + 0x1f8]
jae 0x4342d0
lea ecx, [esp + 0x1f8]
cmp dword [esp + 0x180], esi
jb 0x434596
mov eax, dword [esp + 0x16c]
cmp eax, edi
je 0x4342f1
cmp ecx, edi
je 0x4342f1
push edi
push ecx
push eax
call ebp
cmp dword [esp + 0x228], esi
mov ecx, dword [esp + 0x214]
jae 0x434308
lea ecx, [esp + 0x214]
cmp dword [esp + 0x1b8], esi
jb 0x4345a2
mov eax, dword [esp + 0x1a4]
cmp eax, edi
je 0x434329
cmp ecx, edi
je 0x434329
push edi
push ecx
push eax
call ebp
mov ecx, dword [esp + 0x18]
cmp ecx, edi
je 0x434336
call fcn.0044e500
lea ecx, [esp + 0x1d8]
push ecx
call fcn.004309d0
lea edx, [esp + 0x118]
push edx
lea eax, [esp + 0x40]
mov bl, 0x13
push eax
mov byte [esp + 0x1b84], bl
call fcn.004399a0
add esp, 0xc
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x120]
mov byte [esp + 0x1b84], 0x14
call fcn.00409ac0
lea ecx, [esp + 0x38]
mov byte [esp + 0x1b78], bl
call fcn.0041f9a0
cmp dword [esp + 0x1ec], edi
je 0x4343f7
cmp dword [esp + 0x1f0], esi
mov eax, dword [esp + 0x1dc]
jae 0x4343a9
lea eax, [esp + 0x1dc]
push eax
call fcn.00413b20
add esp, 4
test al, al
je 0x4343f7
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x1dc]
push edx
call fcn.004141c0
add esp, 8
test al, al
je 0x4343f7
cmp dword [esp + 0x1f0], esi
mov eax, dword [esp + 0x1dc]
jae 0x4343e9
lea eax, [esp + 0x1dc]
push 0x4b0b34
push eax
call fcn.004364d0
add esp, 8
cmp dword [esp + 0x12c], esi
mov eax, dword [esp + 0x118]
jae 0x43440e
lea eax, [esp + 0x118]
push eax
call fcn.00413b20
add esp, 4
test al, al
je 0x434442
cmp dword [esp + 0x12c], esi
mov eax, dword [esp + 0x118]
jae 0x434432
lea eax, [esp + 0x118]
push edi
push edi
push str.__RegServer
push eax
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.Installlog.txt
lea eax, [esp + 0xfc]
push eax
lea ecx, [esp + 0x250]
push ecx
call fcn.0040a2a0
add esp, 0xc
lea ecx, [esp + 0x248]
call fcn.0041f9a0
lea ecx, [esp + 0x1d8]
call fcn.0041f9a0
lea ecx, [esp + 0x210]
call fcn.0041f9a0
lea ecx, [esp + 0x1f4]
call fcn.0041f9a0
lea ecx, [esp + 0x22c]
call fcn.0041f9a0
lea ecx, [esp + 0x1bc]
call fcn.0041f9a0
lea ecx, [esp + 0x114]
call fcn.0041f9a0
lea ecx, [esp + 0xa8]
mov byte [esp + 0x1b78], 9
call fcn.0042f650
lea edx, [esp + 0xa8]
push edx
mov dword [esp + 0xac], 0x4af4f8
call fcn.0048e467
add esp, 4
lea ecx, [esp + 0xf8]
call fcn.0041f9a0
lea ecx, [esp + 0x264]
mov byte [esp + 0x1b78], 5
call fcn.00435e20
lea ecx, [esp + 0x1a0]
call fcn.0041f9a0
lea ecx, [esp + 0x168]
call fcn.0041f9a0
lea ecx, [esp + 0x184]
call fcn.0041f9a0
lea ecx, [esp + 0x14c]
call fcn.0041f9a0
lea ecx, [esp + 0xdc]
call fcn.0041f9a0
lea ecx, [esp + 0x130]
call fcn.0041f9a0
mov ecx, dword [esp + 0x1b70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1b58]
xor ecx, esp
call fcn.0046fb90
add esp, 0x1b68
ret
lea eax, [esp + 0xe0]
jmp 0x434113
lea eax, [esp + 0x150]
jmp 0x434278
lea eax, [esp + 0x188]
jmp 0x4342b0
lea eax, [esp + 0x16c]
jmp 0x4342e8
lea eax, [esp + 0x1a4]
jmp 0x434320