Function at 0x4e3c24
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x18
push 0
push 0
dec ecx
jne 0x4e3c2c
push ebx
push esi
push edi
mov eax, 0x4dfba0
call fcn.0040e4e8
mov edi, 0x4ee444
xor eax, eax
push ebp
push 0x4e4436
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4ee404
mov edx, 0x4e4454
call fcn.00409f48
lea edx, [ebp - 0x14]
mov eax, dword [0x4ee404]
call fcn.004df93c
mov edx, dword [ebp - 0x14]
mov eax, 0x4ee404
call fcn.00409f48
lea edx, [ebp - 0x18]
mov eax, dword [0x4ee404]
call fcn.004df8c8
mov edx, dword [ebp - 0x18]
mov eax, 0x4ee404
call fcn.00409f48
mov eax, 0x4ee40c
mov edx, 0x4e4498
call fcn.00409f48
lea edx, [ebp - 0x1c]
mov eax, dword [0x4ee40c]
call fcn.004df93c
mov edx, dword [ebp - 0x1c]
mov eax, 0x4ee40c
call fcn.00409f48
lea edx, [ebp - 0x20]
mov eax, dword [0x4ee40c]
call fcn.004df8c8
mov edx, dword [ebp - 0x20]
mov eax, 0x4ee40c
call fcn.00409f48
mov eax, 0x4ee410
mov edx, 0x4e4514
call fcn.00409f48
lea edx, [ebp - 0x24]
mov eax, dword [0x4ee410]
call fcn.004df93c
mov edx, dword [ebp - 0x24]
mov eax, 0x4ee410
call fcn.00409f48
lea edx, [ebp - 0x28]
mov eax, dword [0x4ee410]
call fcn.004df8c8
mov edx, dword [ebp - 0x28]
mov eax, 0x4ee410
call fcn.00409f48
mov eax, 0x4ee414
mov edx, 0x4e4558
call fcn.00409f48
lea edx, [ebp - 0x2c]
mov eax, dword [0x4ee414]
call fcn.004df93c
mov edx, dword [ebp - 0x2c]
mov eax, 0x4ee414
call fcn.00409f48
mov eax, 0x4ee418
mov edx, 0x4e4570
call fcn.00409f48
lea edx, [ebp - 0x30]
mov eax, dword [0x4ee418]
call fcn.004df93c
mov edx, dword [ebp - 0x30]
mov eax, 0x4ee418
call fcn.00409f48
mov eax, 0x4ee43c
mov edx, 0x4e45a4
call fcn.00409f48
lea edx, [ebp - 0x34]
mov eax, dword [0x4ee43c]
call fcn.004df93c
mov edx, dword [ebp - 0x34]
mov eax, 0x4ee43c
call fcn.00409f48
mov eax, 0x4ee408
mov edx, 0x4e45cc
call fcn.00409f48
lea edx, [ebp - 0x38]
mov eax, dword [0x4ee408]
call fcn.004df93c
mov edx, dword [ebp - 0x38]
mov eax, 0x4ee408
call fcn.00409f48
lea edx, [ebp - 0x3c]
mov eax, dword [0x4ee408]
call fcn.004df8c8
mov edx, dword [ebp - 0x3c]
mov eax, 0x4ee408
call fcn.00409f48
mov eax, 0x4ee41c
mov edx, 0x4e4600
call fcn.00409f48
lea edx, [ebp - 0x40]
mov eax, dword [0x4ee41c]
call fcn.004df93c
mov edx, dword [ebp - 0x40]
mov eax, 0x4ee41c
call fcn.00409f48
mov eax, 0x4ee420
mov edx, 0x4e462c
call fcn.00409f48
lea edx, [ebp - 0x44]
mov eax, dword [0x4ee420]
call fcn.004df93c
mov edx, dword [ebp - 0x44]
mov eax, 0x4ee420
call fcn.00409f48
mov eax, 0x4ee434
mov edx, 0x4e464c
call fcn.00409f48
lea edx, [ebp - 0x48]
mov eax, dword [0x4ee434]
call fcn.004df93c
mov edx, dword [ebp - 0x48]
mov eax, 0x4ee434
call fcn.00409f48
mov eax, 0x4ee438
mov edx, 0x4e466c
call fcn.00409f48
lea edx, [ebp - 0x4c]
mov eax, dword [0x4ee438]
call fcn.004df93c
mov edx, dword [ebp - 0x4c]
mov eax, 0x4ee438
call fcn.00409f48
mov eax, 0x4ee424
mov edx, 0x4e4690
call fcn.00409f48
lea edx, [ebp - 0x50]
mov eax, dword [0x4ee424]
call fcn.004df93c
mov edx, dword [ebp - 0x50]
mov eax, 0x4ee424
call fcn.00409f48
mov eax, 0x4ee428
mov edx, 0x4e46ac
call fcn.00409f48
lea edx, [ebp - 0x54]
mov eax, dword [0x4ee428]
call fcn.004df93c
mov edx, dword [ebp - 0x54]
mov eax, 0x4ee428
call fcn.00409f48
mov eax, 0x4ee42c
mov edx, 0x4e46cc
call fcn.00409f48
lea edx, [ebp - 0x58]
mov eax, dword [0x4ee42c]
call fcn.004df93c
mov edx, dword [ebp - 0x58]
mov eax, 0x4ee42c
call fcn.00409f48
mov eax, 0x4ee430
mov edx, 0x4e4718
call fcn.00409f48
lea edx, [ebp - 0x5c]
mov eax, dword [0x4ee430]
call fcn.004df93c
mov edx, dword [ebp - 0x5c]
mov eax, 0x4ee430
call fcn.00409f48
mov dl, 1
mov eax, dword [0x4ee404]
call fcn.0041e558
test al, al
jne 0x4e3f3c
mov eax, dword [0x4ee404]
call fcn.0041e638
mov dl, 1
mov eax, dword [0x4ee410]
call fcn.0041e558
test al, al
jne 0x4e3f56
mov eax, dword [0x4ee410]
call fcn.0041e638
push 0xffffffffffffffff
push dword [0x4ee404]
push 0x4e4768
push dword [0x4ee418]
push dword [0x4ee414]
lea eax, [ebp - 0x60]
mov edx, 4
call fcn.0040a97c
mov eax, dword [ebp - 0x60]
call fcn.0040a6a0
push eax
lea edx, [ebp - 0x64]
xor eax, eax
call fcn.00406b24
mov eax, dword [ebp - 0x64]
call fcn.0040a6a0
push eax
call sub.kernel32.dll_CopyFileW
push dword [0x4ee404]
push 0x4e4778
push dword [0x4ee418]
push dword [0x4ee414]
lea eax, [ebp - 0x68]
mov edx, 4
call fcn.0040a97c
mov edx, dword [ebp - 0x68]
mov eax, dword [0x4ee418]
call fcn.004df73c
push 0xffffffffffffffff
push dword [0x4ee410]
push 0x4e4788
push 0x4e4798
push dword [0x4ee414]
lea eax, [ebp - 0x6c]
mov edx, 4
call fcn.0040a97c
mov eax, dword [ebp - 0x6c]
call fcn.0040a6a0
push eax
lea edx, [ebp - 0x70]
xor eax, eax
call fcn.00406b24
mov eax, dword [ebp - 0x70]
call fcn.0040a6a0
push eax
call sub.kernel32.dll_CopyFileW
push dword [0x4ee410]
push 0x4e47c0
push 0x4e47d0
push dword [0x4ee414]
lea eax, [ebp - 0x74]
mov edx, 4
call fcn.0040a97c
mov edx, dword [ebp - 0x74]
mov eax, 0x4e47f8
call fcn.004df73c
push 0xffffffffffffffff
push dword [0x4ee40c]
push 0x4e4820
push dword [0x4ee43c]
push dword [0x4ee414]
lea eax, [ebp - 0x78]
mov edx, 4
call fcn.0040a97c
mov eax, dword [ebp - 0x78]
call fcn.0040a6a0
push eax
lea edx, [ebp - 0x7c]
xor eax, eax
call fcn.00406b24
mov eax, dword [ebp - 0x7c]
call fcn.0040a6a0
push eax
call sub.kernel32.dll_CopyFileW
mov dl, 1
mov eax, dword [0x4ee408]
call fcn.0041e558
test al, al
jne 0x4e4219
mov eax, dword [0x4ee408]
call fcn.0041e638
lea eax, [ebp - 0x80]
mov ecx, dword [0x4ee41c]
mov edx, dword [0x4ee408]
call fcn.0040a8f4
mov ecx, dword [ebp - 0x80]
mov edx, dword [0x4ee420]
mov eax, dword [0x4ee424]
call fcn.004df838
lea eax, [ebp - 0x84]
mov ecx, dword [0x4ee428]
mov edx, dword [0x4ee408]
call fcn.0040a8f4
mov edx, dword [ebp - 0x84]
xor ecx, ecx
mov eax, edi
call fcn.00407360
call fcn.00406918
mov eax, edi
call fcn.00407020
call fcn.00406918
mov edx, dword [0x4ee42c]
mov eax, edi
call fcn.00407a1c
call fcn.00407b1c
call fcn.00406918
mov edx, dword [0x4ee430]
mov eax, edi
call fcn.00407a1c
call fcn.00407b1c
call fcn.00406918
mov eax, edi
call fcn.00407468
call fcn.00406918
push 0x4ee440
call sub.Kernel32.dll_Wow64DisableWow64FsRedirection
test eax, eax
je 0x4e41b5
push 0
lea eax, [ebp - 0x8c]
mov ecx, dword [0x4ee428]
mov edx, dword [0x4ee408]
call fcn.0040a8f4
mov eax, dword [ebp - 0x8c]
lea edx, [ebp - 0x88]
call fcn.0041e73c
mov eax, dword [ebp - 0x88]
call fcn.0040a6a0
push eax
push 0
lea eax, [ebp - 0x90]
mov ecx, dword [0x4ee428]
mov edx, dword [0x4ee408]
call fcn.0040a8f4
mov eax, dword [ebp - 0x90]
call fcn.0040a6a0
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x4e4219
push 0
lea eax, [ebp - 0x98]
mov ecx, dword [0x4ee428]
mov edx, dword [0x4ee408]
call fcn.0040a8f4
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0x94]
call fcn.0041e73c
mov eax, dword [ebp - 0x94]
call fcn.0040a6a0
push eax
push 0
lea eax, [ebp - 0x9c]
mov ecx, dword [0x4ee428]
mov edx, dword [0x4ee408]
call fcn.0040a8f4
mov eax, dword [ebp - 0x9c]
call fcn.0040a6a0
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
push 0x2710
call sub.kernel32.dll_Sleep_1
xor ebx, ebx
test bl, bl
jne 0x4e423d
mov esi, 8
mov dl, 1
mov eax, dword [0x4df5b4]
call fcn.004df6b8
dec esi
jne 0x4e422e
push 0x2710
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0xa0]
mov ecx, dword [0x4ee41c]
mov edx, dword [0x4ee408]
call fcn.0040a8f4
mov eax, dword [ebp - 0xa0]
mov dl, 1
call fcn.0041e4c0
test al, al
je 0x4e427f
mov dl, 1
mov eax, dword [0x4ee408]
call fcn.0041e558
test al, al
jne 0x4e4219
push 0x3e8
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4ee408]
call fcn.0041e638
lea eax, [ebp - 0xa4]
mov ecx, dword [0x4ee41c]
mov edx, dword [0x4ee408]
call fcn.0040a8f4
mov ecx, dword [ebp - 0xa4]
mov edx, dword [0x4ee420]
mov eax, dword [0x4ee424]
call fcn.004df838
lea eax, [ebp - 0xa8]
mov ecx, dword [0x4ee428]
mov edx, dword [0x4ee408]
call fcn.0040a8f4
mov edx, dword [ebp - 0xa8]
xor ecx, ecx
mov eax, edi
call fcn.00407360
call fcn.00406918
mov eax, edi
call fcn.00407020
call fcn.00406918
mov edx, dword [0x4ee42c]
mov eax, edi
call fcn.00407a1c
call fcn.00407b1c
call fcn.00406918
mov edx, dword [0x4ee430]
mov eax, edi
call fcn.00407a1c
call fcn.00407b1c
call fcn.00406918
mov eax, edi
call fcn.00407468
call fcn.00406918
push 0x4ee440
call sub.Kernel32.dll_Wow64DisableWow64FsRedirection
test eax, eax
je 0x4e43a5
push 0
lea eax, [ebp - 0xb0]
mov ecx, dword [0x4ee428]
mov edx, dword [0x4ee408]
call fcn.0040a8f4
mov eax, dword [ebp - 0xb0]
lea edx, [ebp - 0xac]
call fcn.0041e73c
mov eax, dword [ebp - 0xac]
call fcn.0040a6a0
push eax
push 0
lea eax, [ebp - 0xb4]
mov ecx, dword [0x4ee428]
mov edx, dword [0x4ee408]
call fcn.0040a8f4
mov eax, dword [ebp - 0xb4]
call fcn.0040a6a0
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x4e4409
push 0
lea eax, [ebp - 0xbc]
mov ecx, dword [0x4ee428]
mov edx, dword [0x4ee408]
call fcn.0040a8f4
mov eax, dword [ebp - 0xbc]
lea edx, [ebp - 0xb8]
call fcn.0041e73c
mov eax, dword [ebp - 0xb8]
call fcn.0040a6a0
push eax
push 0
lea eax, [ebp - 0xc0]
mov ecx, dword [0x4ee428]
mov edx, dword [0x4ee408]
call fcn.0040a8f4
mov eax, dword [ebp - 0xc0]
call fcn.0040a6a0
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
push 0x1388
call sub.kernel32.dll_Sleep_1
jmp 0x4e4219