Function at 0x401c12
Capabilities:
Copy file
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3cc
push ebx
push esi
push edi
push 0x3f
lea eax, [esp + 0x3d]
push 0
push eax
mov byte [esp + 0x44], 0
call fcn.00403aa0
add esp, 0xc
lea eax, [esp + 0xc1]
push 0x103
push 0
xor ebx, ebx
push eax
inc ebx
mov byte [esp + 0xcc], 0
call fcn.00403aa0
and dword [esp + 0x84], 0
add esp, 0xc
lea eax, [esp + 0x7c]
push 0x40
pop esi
push esi
push 0
push eax
call fcn.00403aa0
and dword [esp + 0x24], 0
xor eax, eax
lea edi, [esp + 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
mov ecx, str._nodel
stosd dword es:[edi], eax
call fcn.00401b82
mov ecx, str._ghost
mov dword [esp + 0x10], eax
call fcn.00401b82
mov edi, eax
mov ecx, str._stop
mov dword [esp + 0x30], edi
call fcn.00401b82
mov ecx, str._service
mov dword [esp + 0x2c], eax
call fcn.00401b82
mov ecx, str._norunonce
mov dword [esp + 0x28], eax
call fcn.00401b82
mov ecx, 0x40f030
mov dword [esp + 0x14], eax
call fcn.00401b82
test eax, eax
je 0x401d07
push str._unattid
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub esi, eax
lea edx, [esp + 0x38]
push esi
add edx, eax
mov ecx, 0x40f030
call fcn.00401bb7
pop ecx
xor esi, esi
mov ecx, str._app
mov dword [esp + 0xc], esi
call fcn.00401b82
test eax, eax
je 0x401d60
push 0xa
push 0x7d00
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [0x412b3c], eax
test eax, eax
je 0x401d39
call fcn.0040173f
jmp 0x401d3b
xor eax, eax
test eax, eax
je 0x401d60
push ecx
push ecx
call fcn.00403095
pop ecx
pop ecx
call fcn.00401783
push 0
push str.LMI_Rescue_srv.exe
push dword [0x411da0]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, str._params
call fcn.00401b82
test eax, eax
je 0x401e1d
push 1
xor ebx, ebx
push ebx
mov edx, str.eula.txt
mov ecx, 0x2717
call fcn.004017b0
pop ecx
pop ecx
mov edx, 0x40ee01
call fcn.004019ce
cmp dword [esp + 0x10], ebx
je 0x401da2
mov edx, str._nodel
call fcn.004019ce
cmp dword [esp + 0x14], ebx
je 0x401db2
mov edx, str._norunonce
call fcn.004019ce
test edi, edi
je 0x401dcf
mov edx, str._ghost
call fcn.004019ce
cmp byte [esp + 0x38], bl
je 0x401dcf
lea edx, [esp + 0x38]
call fcn.004019ce
push ebx
push ebx
mov edx, str.params.txt
mov ecx, 0x2710
call fcn.004017b0
xor ecx, ecx
call fcn.00401a66
xor ecx, ecx
call fcn.00401b17
mov edx, 0x2712
push 1
mov edi, str.script
push edi
lea ecx, [edx + 1]
call fcn.004017b0
mov edx, 0x2714
push 1
push edi
lea ecx, [edx + 1]
call fcn.004017b0
add esp, 0x18
xor eax, eax
jmp 0x4020e2
mov ecx, str._app
call fcn.00401b82
test eax, eax
jne 0x401e16
mov edi, str.script
mov ecx, 0x40f078
call fcn.00401b82
test eax, eax
je 0x401e65
push 0x104
lea edx, [esp + 0x1cc]
mov ecx, 0x40f078
call fcn.00401bb7
pop ecx
lea eax, [esp + 0x1c8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x401ea8
push ecx
push ecx
lea eax, [esp + 0x1d0]
push eax
lea edx, [esp + 0x2dc]
lea ecx, [esp + 0x18]
call fcn.00401563
add esp, 0xc
test eax, eax
je 0x401ea4
push dword [eax*4 + 0x411db0]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004016bb
mov esi, dword [esp + 0x14]
pop ecx
pop ecx
jmp 0x402081
mov esi, dword [esp + 0xc]
push 0xa
push 0x7d00
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [0x412b3c], eax
test eax, eax
je 0x401ec7
call fcn.0040173f
jmp 0x401ec9
xor eax, eax
test eax, eax
jne 0x401ee5
push str.Failed_to_locate_application_resource.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004016bb
pop ecx
pop ecx
jmp 0x402081
push ecx
push ecx
call fcn.00403095
pop ecx
pop ecx
test eax, eax
jne 0x401f00
push 2
pop esi
mov dword [esp + 0xc], esi
push str.Failed_to_decompress_application_files.
jmp 0x401ed2
push 0
push str.LMI_Rescue_srv.exe
push dword [0x411da0]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x401f1e
push str.Failed_to_copy_service_binary.
jmp 0x401ed2
mov eax, dword [str.lmi_rescue.exe.manifest]
test eax, eax
je 0x401f44
push 0
push str.LMI_Rescue_srv.exe.manifest
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
neg eax
sbb eax, eax
neg eax
jne 0x401f44
push str.Failed_to_copy_service_manifest.
jmp 0x401ed2
call fcn.00401783
push 1
push 0
mov edx, str.eula.txt
mov ecx, 0x2717
call fcn.004017b0
mov ebx, dword [esp + 0x30]
pop ecx
pop ecx
test ebx, ebx
jne 0x401fc7
mov edx, 0x40ee01
call fcn.004019ce
cmp dword [esp + 0x10], ebx
je 0x401f80
mov edx, str._nodel
call fcn.004019ce
cmp dword [esp + 0x14], 0
je 0x401f91
mov edx, str._norunonce
call fcn.004019ce
cmp dword [esp + 0x30], 0
je 0x401fb2
mov edx, str._ghost
call fcn.004019ce
cmp byte [esp + 0x38], 0
je 0x401fb2
lea edx, [esp + 0x38]
call fcn.004019ce
push 0
push 0
mov edx, str.params.txt
mov ecx, 0x2710
call fcn.004017b0
pop ecx
pop ecx
mov ecx, ebx
call fcn.00401a66
mov ecx, ebx
call fcn.00401b17
test ebx, ebx
jne 0x401ffc
mov edx, 0x2712
push 1
push edi
lea ecx, [edx + 1]
call fcn.004017b0
mov edx, 0x2714
push 1
push edi
lea ecx, [edx + 1]
call fcn.004017b0
add esp, 0x10
xor ebx, ebx
cmp dword [esp + 0x2c], ebx
jne 0x40207a
push dword [0x411da0]
lea eax, [esp + 0x1cc]
push eax
lea eax, [esp + 0xc8]
push str.__s_s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x7c]
push eax
xor ecx, ecx
lea eax, [esp + 0x1d0]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [esp + 0xe0]
push eax
push ecx
mov dword [esp + 0xa0], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40207a
cmp esi, 1
jle 0x402077
push str.Failed_to_start_client_application.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004016bb
pop ecx
pop ecx
push 2
pop ebx
push 2
pop esi
mov dword [esp + 0xc], esi
call fcn.00401783
cmp dword [esp + 0x1c], 0
je 0x40209c
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esp + 0x1c], 0
cmp dword [esp + 0x18], 0
je 0x4020b2
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esp + 0x18], 0
cmp esi, 2
jl 0x401e30
push 0x104
lea eax, [esp + 0xc4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4020e0
lea ecx, [esp + 0xc0]
call fcn.00401193
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret