Function at 0x434160
Capabilities:
Copy file
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a5d6c
mov eax, dword fs:[0]
push eax
mov eax, 0x1b5c
call fcn.00471360
mov eax, dword [0x4c8698]
xor eax, esp
mov dword [esp + 0x1b58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c8698]
xor eax, esp
push eax
lea eax, [esp + 0x1b70]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1b80]
xor edi, edi
lea ecx, [esp + 0x130]
push edi
push ecx
mov dword [esp + 0x20], eax
call fcn.0043b0e0
add esp, 8
cmp dword [esp + 0x144], edi
mov dword [esp + 0x1b78], edi
jne 0x4341f0
cmp dword [esp + 0x148], 8
jb 0x434aca
mov edx, dword [esp + 0x134]
push edx
call fcn.00470259
add esp, 4
jmp 0x434aca
lea eax, [esp + 0xdc]
push edi
push eax
call fcn.0043b030
add esp, 8
cmp dword [esp + 0xf0], edi
mov byte [esp + 0x1b78], 1
jne 0x434253
mov esi, 8
cmp dword [esp + 0xf4], esi
jb 0x434230
mov ecx, dword [esp + 0xe0]
push ecx
call fcn.00470259
add esp, 4
cmp dword [esp + 0x148], esi
mov dword [esp + 0xf4], 7
mov dword [esp + 0xf0], edi
mov word [esp + 0xe0], di
jmp 0x4341d5
push str.dlcore.dll
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x154]
push ecx
call fcn.0040a230
push str._tnproxy.dll
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x198]
push eax
mov byte [esp + 0x1b90], 2
call fcn.0040a230
push str.extract.dll
lea ecx, [esp + 0x14c]
push ecx
lea edx, [esp + 0x188]
push edx
mov byte [esp + 0x1b9c], 3
call fcn.0040a230
push str.DownloadProxyPS.dll
lea eax, [esp + 0x158]
push eax
lea ecx, [esp + 0x1cc]
push ecx
mov byte [esp + 0x1ba8], 4
call fcn.0040a230
add esp, 0x30
mov eax, dword [esp + 0xe0]
mov ebp, 8
cmp dword [esp + 0xf4], ebp
mov byte [esp + 0x1b78], 5
jae 0x4342fa
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x268]
call fcn.00436720
xor eax, eax
lea edx, [esp + 0x1b54]
push edx
lea ecx, [esp + 0x268]
mov byte [esp + 0x1b7c], 6
mov word [esp + 0x1b58], di
mov dword [esp + 0x1b5a], eax
mov word [esp + 0x1b5e], ax
call fcn.00436330
movzx esi, word [esp + 0x1b58]
push 0x4b0878
lea ecx, [esp + 0x20]
call fcn.0040a1f0
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0xfc]
mov ebx, 7
push ecx
mov byte [esp + 0x1b80], bl
call fcn.0043a930
add esp, 8
cmp dword [esp + 0x34], ebp
mov byte [esp + 0x1b78], 9
jb 0x43438e
mov edx, dword [esp + 0x20]
push edx
call fcn.00470259
add esp, 4
cmp dword [esp + 0x10c], edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], edi
mov word [esp + 0x20], di
jne 0x4344f8
cmp dword [esp + 0x110], ebp
jb 0x4343c1
mov eax, dword [esp + 0xfc]
push eax
call fcn.00470259
add esp, 4
lea ecx, [esp + 0x264]
mov dword [esp + 0x110], ebx
mov dword [esp + 0x10c], edi
mov word [esp + 0xfc], di
mov byte [esp + 0x1b78], 5
call fcn.004363a0
cmp dword [esp + 0x1b8], ebp
jb 0x434404
mov ecx, dword [esp + 0x1a4]
push ecx
call fcn.00470259
add esp, 4
cmp dword [esp + 0x180], ebp
mov dword [esp + 0x1b8], ebx
mov dword [esp + 0x1b4], edi
mov word [esp + 0x1a4], di
jb 0x434433
mov edx, dword [esp + 0x16c]
push edx
call fcn.00470259
add esp, 4
cmp dword [esp + 0x19c], ebp
mov dword [esp + 0x180], ebx
mov dword [esp + 0x17c], edi
mov word [esp + 0x16c], di
jb 0x434462
mov eax, dword [esp + 0x188]
push eax
call fcn.00470259
add esp, 4
cmp dword [esp + 0x164], ebp
mov dword [esp + 0x19c], ebx
mov dword [esp + 0x198], edi
mov word [esp + 0x188], di
jb 0x434491
mov ecx, dword [esp + 0x150]
push ecx
call fcn.00470259
add esp, 4
cmp dword [esp + 0xf4], ebp
mov dword [esp + 0x164], ebx
mov dword [esp + 0x160], edi
mov word [esp + 0x150], di
jb 0x4344c0
mov edx, dword [esp + 0xe0]
push edx
call fcn.00470259
add esp, 4
cmp dword [esp + 0x148], ebp
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf0], edi
mov word [esp + 0xe0], di
jb 0x434aca
mov eax, dword [esp + 0x134]
push eax
call fcn.00470259
add esp, 4
jmp 0x434aca
lea ecx, [esp + 0xf8]
push esi
push ecx
call fcn.00433d40
add esp, 8
test al, al
je 0x434a62
push 1
push 3
lea ecx, [esp + 0x5c]
call fcn.00433ac0
push esi
push 0x4af76c
lea edx, [esp + 0x100]
push edx
lea eax, [esp + 0x68]
mov bl, 0xa
push eax
mov byte [esp + 0x1b88], bl
call fcn.00432cf0
add esp, 8
push eax
call fcn.00432f80
add esp, 8
mov ecx, eax
call fcn.004331a0
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x58]
call fcn.004311c0
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x104]
mov byte [esp + 0x1b84], 0xb
call fcn.00409a50
lea ecx, [esp + 0x38]
mov byte [esp + 0x1b78], bl
call fcn.00420370
lea edx, [esp + 0xf8]
push edx
call fcn.0043a310
add esp, 4
test al, al
jne 0x4345ac
lea eax, [esp + 0xf8]
push eax
call fcn.0043a470
add esp, 4
push 0x4b0b34
lea ecx, [esp + 0xfc]
push ecx
lea edx, [esp + 0x11c]
push edx
call fcn.0040a230
push str.dlcore.dll
lea eax, [esp + 0x108]
push eax
lea ecx, [esp + 0x1d0]
push ecx
mov byte [esp + 0x1b90], 0xc
call fcn.0040a230
push str._tnproxy.dll
lea edx, [esp + 0x114]
push edx
lea eax, [esp + 0x24c]
push eax
mov byte [esp + 0x1b9c], 0xd
call fcn.0040a230
push str.extract.dll
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x220]
push edx
mov byte [esp + 0x1ba8], 0xe
call fcn.0040a230
push str.DownloadProxyPS.dll
lea eax, [esp + 0x12c]
push eax
lea ecx, [esp + 0x248]
push ecx
mov byte [esp + 0x1bb4], 0xf
call fcn.0040a230
add esp, 0x3c
cmp dword [esp + 0x12c], ebp
mov ecx, dword [esp + 0x118]
mov byte [esp + 0x1b78], 0x10
jae 0x434670
lea ecx, [esp + 0x118]
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, 8
cmp dword [esp + 0xf4], esi
jb 0x434af2
mov eax, dword [esp + 0xe0]
cmp eax, edi
je 0x43469c
cmp ecx, edi
je 0x43469c
push edi
push ecx
push eax
call ebp
cmp dword [esp + 0x1d4], esi
mov eax, dword [esp + 0x1c0]
mov byte [esp + 0x17], 1
jae 0x4346b8
lea eax, [esp + 0x1c0]
push eax
call fcn.00413a30
add esp, 4
test al, al
je 0x4347c9
cmp dword [esp + 0x164], esi
mov eax, dword [esp + 0x150]
jae 0x4346e0
lea eax, [esp + 0x150]
push eax
lea ecx, [esp + 0xab8]
call fcn.00436720
xor eax, eax
lea edx, [esp + 0x1b5c]
mov bl, 0x11
push edx
lea ecx, [esp + 0xab8]
mov byte [esp + 0x1b7c], bl
mov word [esp + 0x1b60], di
mov dword [esp + 0x1b62], eax
mov word [esp + 0x1b66], ax
call fcn.00436330
cmp dword [esp + 0x1d4], 8
movzx esi, word [esp + 0x1b60]
mov eax, dword [esp + 0x1c0]
jae 0x434743
lea eax, [esp + 0x1c0]
push eax
lea ecx, [esp + 0x1308]
call fcn.00436720
xor eax, eax
mov dword [esp + 0x1b66], eax
mov word [esp + 0x1b6a], ax
lea eax, [esp + 0x1b64]
push eax
lea ecx, [esp + 0x1308]
mov byte [esp + 0x1b7c], 0x12
mov word [esp + 0x1b68], di
call fcn.00436330
movzx eax, word [esp + 0x1b68]
cmp esi, eax
jae 0x434796
mov byte [esp + 0x17], 0
lea ecx, [esp + 0x1304]
mov byte [esp + 0x1b78], bl
call fcn.004363a0
lea ecx, [esp + 0xab4]
mov byte [esp + 0x1b78], 0x10
call fcn.004363a0
cmp byte [esp + 0x17], 0
mov esi, 8
je 0x434801
cmp dword [esp + 0x1d4], esi
mov ecx, dword [esp + 0x1c0]
jae 0x4347e0
lea ecx, [esp + 0x1c0]
cmp dword [esp + 0x164], esi
jb 0x434afe
mov eax, dword [esp + 0x150]
cmp eax, edi
je 0x434801
cmp ecx, edi
je 0x434801
push edi
push ecx
push eax
call ebp
cmp dword [esp + 0x244], esi
mov ecx, dword [esp + 0x230]
jae 0x434818
lea ecx, [esp + 0x230]
cmp dword [esp + 0x19c], esi
jb 0x434b0a
mov eax, dword [esp + 0x188]
cmp eax, edi
je 0x434839
cmp ecx, edi
je 0x434839
push edi
push ecx
push eax
call ebp
cmp dword [esp + 0x20c], esi
mov ecx, dword [esp + 0x1f8]
jae 0x434850
lea ecx, [esp + 0x1f8]
cmp dword [esp + 0x180], esi
jb 0x434b16
mov eax, dword [esp + 0x16c]
cmp eax, edi
je 0x434871
cmp ecx, edi
je 0x434871
push edi
push ecx
push eax
call ebp
cmp dword [esp + 0x228], esi
mov ecx, dword [esp + 0x214]
jae 0x434888
lea ecx, [esp + 0x214]
cmp dword [esp + 0x1b8], esi
jb 0x434b22
mov eax, dword [esp + 0x1a4]
cmp eax, edi
je 0x4348a9
cmp ecx, edi
je 0x4348a9
push edi
push ecx
push eax
call ebp
mov ecx, dword [esp + 0x18]
cmp ecx, edi
je 0x4348b6
call fcn.0044edf0
lea ecx, [esp + 0x1d8]
push ecx
call fcn.00430fc0
lea edx, [esp + 0x118]
push edx
lea eax, [esp + 0x40]
mov bl, 0x13
push eax
mov byte [esp + 0x1b84], bl
call fcn.00439ef0
add esp, 0xc
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x120]
mov byte [esp + 0x1b84], 0x14
call fcn.00409a50
lea ecx, [esp + 0x38]
mov byte [esp + 0x1b78], bl
call fcn.00420370
cmp dword [esp + 0x1ec], edi
je 0x434977
cmp dword [esp + 0x1f0], esi
mov eax, dword [esp + 0x1dc]
jae 0x434929
lea eax, [esp + 0x1dc]
push eax
call fcn.00413a30
add esp, 4
test al, al
je 0x434977
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x1dc]
push edx
call fcn.00414160
add esp, 8
test al, al
je 0x434977
cmp dword [esp + 0x1f0], esi
mov eax, dword [esp + 0x1dc]
jae 0x434969
lea eax, [esp + 0x1dc]
push 0x4b0b8c
push eax
call fcn.00436a50
add esp, 8
cmp dword [esp + 0x12c], esi
mov eax, dword [esp + 0x118]
jae 0x43498e
lea eax, [esp + 0x118]
push eax
call fcn.00413a30
add esp, 4
test al, al
je 0x4349c2
cmp dword [esp + 0x12c], esi
mov eax, dword [esp + 0x118]
jae 0x4349b2
lea eax, [esp + 0x118]
push edi
push edi
push str.__RegServer
push eax
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.Installlog.txt
lea eax, [esp + 0xfc]
push eax
lea ecx, [esp + 0x250]
push ecx
call fcn.0040a230
add esp, 0xc
lea ecx, [esp + 0x248]
call fcn.00420370
lea ecx, [esp + 0x1d8]
call fcn.00420370
lea ecx, [esp + 0x210]
call fcn.00420370
lea ecx, [esp + 0x1f4]
call fcn.00420370
lea ecx, [esp + 0x22c]
call fcn.00420370
lea ecx, [esp + 0x1bc]
call fcn.00420370
lea ecx, [esp + 0x114]
call fcn.00420370
lea ecx, [esp + 0xa8]
mov byte [esp + 0x1b78], 9
call fcn.0042fc40
lea edx, [esp + 0xa8]
push edx
mov dword [esp + 0xac], 0x4af4f8
call fcn.0048ea57
add esp, 4
lea ecx, [esp + 0xf8]
call fcn.00420370
lea ecx, [esp + 0x264]
mov byte [esp + 0x1b78], 5
call fcn.004363a0
lea ecx, [esp + 0x1a0]
call fcn.00420370
lea ecx, [esp + 0x168]
call fcn.00420370
lea ecx, [esp + 0x184]
call fcn.00420370
lea ecx, [esp + 0x14c]
call fcn.00420370
lea ecx, [esp + 0xdc]
call fcn.00420370
lea ecx, [esp + 0x130]
call fcn.00420370
mov ecx, dword [esp + 0x1b70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1b58]
xor ecx, esp
call fcn.00470220
add esp, 0x1b68
ret
lea eax, [esp + 0xe0]
jmp 0x434693
lea eax, [esp + 0x150]
jmp 0x4347f8
lea eax, [esp + 0x188]
jmp 0x434830
lea eax, [esp + 0x16c]
jmp 0x434868
lea eax, [esp + 0x1a4]
jmp 0x4348a0