Function at 0x401865
Capabilities:
Copy file
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3cc
push ebx
push esi
push edi
xor ebx, ebx
push 0x3f
xor esi, esi
lea eax, [esp + 0x3d]
push ebx
inc esi
push eax
mov dword [esp + 0x2c], esi
mov byte [esp + 0x44], bl
call fcn.00402cf0
add esp, 0xc
push 0x103
lea eax, [esp + 0xc5]
push ebx
push eax
mov dword [esp + 0x20], esi
mov byte [esp + 0xcc], bl
call fcn.00402cf0
add esp, 0xc
push 0x40
lea eax, [esp + 0x80]
push ebx
push eax
mov dword [esp + 0x84], ebx
call fcn.00402cf0
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x30], ebx
xor eax, eax
lea edi, [esp + 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
push str._nodel
stosd dword es:[edi], eax
call fcn.0040175f
mov dword [esp + 0x1c], eax
mov dword [esp], str._ghost
call fcn.0040175f
mov dword [esp + 0x20], eax
mov dword [esp], str._stop
call fcn.0040175f
mov dword [esp + 0x38], eax
mov dword [esp], 0x40422c
call fcn.0040175f
test eax, eax
pop ecx
je 0x40194c
push str._unattid
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x40
pop ecx
sub ecx, eax
push ecx
lea eax, [esp + eax + 0x3c]
push eax
mov ebx, esi
call fcn.004017bc
pop ecx
pop ecx
xor ebx, ebx
push 0x404244
mov dword [esp + 0x10], ebx
call fcn.0040175f
test eax, eax
pop ecx
je 0x4019ad
push 6
pop edi
push edi
push str.SET_RESCUEAPP_MAJOR_d_n
call fcn.00402a4f
push 2
push str.SET_RESCUEAPP_MINOR_d_n
call fcn.00402a4f
mov esi, 0x175
push esi
push str.SET_RESCUEAPP_BUILD_d_n
call fcn.00402a4f
push edi
push str.SET_RESCUEAPP_REVISION_d_n
call fcn.00402a4f
push edi
push esi
push 2
push edi
push str.SET_RESCUEAPP_VER_d._d._d._d_n
call fcn.00402a4f
add esp, 0x34
xor eax, eax
jmp 0x401d2c
mov edi, str._app
push edi
call fcn.0040175f
test eax, eax
pop ecx
je 0x401a03
push 0xa
push 0x7d00
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
mov dword [0x405384], eax
je 0x4019db
call fcn.00401354
jmp 0x4019dd
xor eax, eax
cmp eax, ebx
je 0x401a03
push 0x405018
call fcn.00402789
pop ecx
call fcn.00401399
push ebx
push str.LMI_InstantChat_srv.exe
push dword [0x405018]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str._params
call fcn.0040175f
test eax, eax
pop ecx
je 0x401ab4
push 1
push ebx
push str.eula.txt
push 0x2717
call fcn.004013c6
push 0x404213
call fcn.004015dd
add esp, 0x14
cmp dword [esp + 0x18], ebx
je 0x401a46
push str._nodel
call fcn.004015dd
pop ecx
cmp dword [esp + 0x1c], ebx
je 0x401a68
push str._ghost
call fcn.004015dd
cmp byte [esp + 0x3c], bl
pop ecx
je 0x401a68
lea eax, [esp + 0x38]
push eax
call fcn.004015dd
pop ecx
push ebx
push ebx
push str.params.txt
push 0x2710
call fcn.004013c6
call fcn.00401672
call fcn.0040170b
push 1
mov esi, str.script
push esi
push 0x2712
push 0x2713
call fcn.004013c6
push 1
push esi
push 0x2714
push 0x2715
call fcn.004013c6
add esp, 0x30
jmp 0x4019a6
push edi
call fcn.0040175f
test eax, eax
pop ecx
jne 0x4019a6
lea eax, [esp + 0x1c8]
push eax
lea edi, [esp + 0x2d4]
lea esi, [esp + 0x10]
mov dword [esp + 0x14], ebx
call fcn.0040120d
cmp eax, ebx
pop ecx
je 0x401afe
push dword [eax*4 + 0x405024]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004012d2
pop ecx
pop ecx
jmp 0x401cc8
push 0xa
xor edi, edi
push 0x7d00
inc edi
push ebx
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
mov dword [0x405384], eax
je 0x401b23
call fcn.00401354
jmp 0x401b25
xor eax, eax
cmp eax, ebx
jne 0x401b30
push str.Failed_to_locate_application_resource.
jmp 0x401aeb
push 0x405018
call fcn.00402789
test eax, eax
pop ecx
jne 0x401b50
cmp dword [esp + 0xc], edi
jle 0x401cc8
push str.Failed_to_decompress_application_files.
jmp 0x401aeb
push ebx
push str.LMI_InstantChat_srv.exe
push dword [0x405018]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x401b70
push str.Failed_to_copy_service_binary.
jmp 0x401aeb
call fcn.00401399
push edi
push ebx
push str.eula.txt
push 0x2717
call fcn.004013c6
push 0x404213
call fcn.004015dd
add esp, 0x14
cmp dword [esp + 0x18], ebx
je 0x401ba4
push str._nodel
call fcn.004015dd
pop ecx
cmp dword [esp + 0x1c], ebx
je 0x401bc6
push str._ghost
call fcn.004015dd
cmp byte [esp + 0x3c], bl
pop ecx
je 0x401bc6
lea eax, [esp + 0x38]
push eax
call fcn.004015dd
pop ecx
push ebx
push ebx
push str.params.txt
push 0x2710
call fcn.004013c6
call fcn.00401672
call fcn.0040170b
push edi
mov esi, str.script
push esi
push 0x2712
push 0x2713
call fcn.004013c6
push edi
push esi
push 0x2714
push 0x2715
call fcn.004013c6
add esp, 0x30
cmp dword [esp + 0x34], ebx
jne 0x401cb8
push dword [0x405018]
lea eax, [esp + 0x1cc]
push eax
lea eax, [esp + 0xc8]
push str.__s_s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x1d0]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0xe0]
push eax
push ebx
mov dword [esp + 0xa0], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x401c7e
cmp dword [esp + 0xc], edi
jle 0x401cc8
push str.Failed_to_start_client_application.
jmp 0x401aeb
push 0xffffffffffffffff
push dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], 2
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x401cc8
xor eax, eax
cmp dword [esp + 0x20], ebx
sete al
mov dword [esp + 0x10], eax
jmp 0x401cc8
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], ebx
call fcn.00401399
cmp dword [esp + 0x28], ebx
je 0x401ce1
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x24], ebx
je 0x401cf5
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x10], ebx
je 0x401d1d
cmp dword [esp + 0x18], ebx
jne 0x401d1d
lea eax, [esp + 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [esp + 0x1c8]
push eax
call fcn.004011c0
pop ecx
cmp dword [esp + 0xc], 2
jl 0x401ac3
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10