Function at 0x401cda
Capabilities:
Copy file
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3cc
push ebx
push esi
push edi
xor ebx, ebx
push 0x3f
lea eax, [esp + 0x3d]
push ebx
push eax
mov byte [esp + 0x44], bl
call fcn.00403610
add esp, 0xc
push 0x103
lea eax, [esp + 0xc5]
push ebx
push eax
mov dword [esp + 0x1c], 1
mov byte [esp + 0xcc], bl
call fcn.00403610
add esp, 0xc
push 0x40
lea eax, [esp + 0x80]
push ebx
push eax
mov dword [esp + 0x84], ebx
call fcn.00403610
mov esi, dword [ebp + 8]
mov dword [esp + 0x2c], ebx
xor eax, eax
lea edi, [esp + 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
push str._nodel
stosd dword es:[edi], eax
call fcn.00401bdd
mov dword [esp + 0x18], eax
mov dword [esp], str._ghost
call fcn.00401bdd
mov dword [esp + 0x1c], eax
mov dword [esp], str._stop
call fcn.00401bdd
mov dword [esp + 0x34], eax
mov dword [esp], str._service
call fcn.00401bdd
mov dword [esp + 0x38], eax
mov dword [esp], str._norunonce
call fcn.00401bdd
pop ecx
mov edi, 0x405330
push edi
mov dword [esp + 0x20], eax
call fcn.00401bdd
test eax, eax
pop ecx
je 0x401dde
push str._unattid
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x40
pop ebx
sub ebx, eax
lea eax, [esp + eax + 0x38]
push eax
push edi
mov eax, esi
call fcn.00401c3a
pop ecx
pop ecx
xor ebx, ebx
mov edi, str._app
push edi
mov dword [esp + 0x10], ebx
call fcn.00401bdd
test eax, eax
pop ecx
je 0x401e38
push 0xa
push 0x7d00
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
mov dword [0x406394], eax
je 0x401e10
call fcn.0040179f
jmp 0x401e12
xor eax, eax
cmp eax, ebx
je 0x401e38
push 0x406030
call fcn.004030d6
pop ecx
call fcn.004017e4
push ebx
push str.LMI_Rescue_srv.exe
push dword [0x406030]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str._params
call fcn.00401bdd
test eax, eax
pop ecx
je 0x401f02
push 1
push ebx
push str.eula.txt
push 0x2717
call fcn.00401811
push 0x405135
call fcn.00401a28
add esp, 0x14
cmp dword [esp + 0x14], ebx
je 0x401e7b
push str._nodel
call fcn.00401a28
pop ecx
cmp dword [esp + 0x1c], ebx
je 0x401e8c
push str._norunonce
call fcn.00401a28
pop ecx
cmp dword [esp + 0x18], ebx
je 0x401eae
push str._ghost
call fcn.00401a28
cmp byte [esp + 0x3c], bl
pop ecx
je 0x401eae
lea eax, [esp + 0x38]
push eax
call fcn.00401a28
pop ecx
push ebx
push ebx
push str.params.txt
push 0x2710
call fcn.00401811
push ebx
call fcn.00401abd
add esp, 0x14
push ebx
call fcn.00401b71
pop ecx
push 1
mov edi, str.script
push edi
push 0x2712
push 0x2713
call fcn.00401811
push 1
push edi
push 0x2714
push 0x2715
call fcn.00401811
add esp, 0x20
xor eax, eax
jmp 0x40218f
push edi
call fcn.00401bdd
test eax, eax
pop ecx
jne 0x401efb
mov edi, str.script
mov esi, dword [ebp + 8]
mov ebx, 0x405378
push ebx
call fcn.00401bdd
test eax, eax
pop ecx
lea eax, [esp + 0x1c8]
push eax
je 0x401f6a
push ebx
mov ebx, 0x104
mov eax, esi
call fcn.00401c3a
pop ecx
pop ecx
lea eax, [esp + 0x1c8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
xor ebx, ebx
push 0xa
push 0x7d00
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
mov dword [0x406394], eax
je 0x401f9b
call fcn.0040179f
jmp 0x401f9d
lea ebx, [esp + 0x2d4]
lea esi, [esp + 0x10]
call fcn.0040162b
xor ebx, ebx
cmp eax, ebx
pop ecx
je 0x401f4c
push dword [eax*4 + 0x40603c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040171d
pop ecx
pop ecx
jmp 0x40212e
xor eax, eax
cmp eax, ebx
jne 0x401fa8
push str.Failed_to_locate_application_resource.
jmp 0x401f88
push 0x406030
call fcn.004030d6
test eax, eax
pop ecx
jne 0x401fc6
mov dword [esp + 0xc], 2
push str.Failed_to_decompress_application_files.
jmp 0x401f88
push ebx
push str.LMI_Rescue_srv.exe
push dword [0x406030]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x401fe3
push str.Failed_to_copy_service_binary.
jmp 0x401f88
call fcn.004017e4
push 1
push ebx
push str.eula.txt
push 0x2717
call fcn.00401811
mov esi, dword [esp + 0x44]
add esp, 0x10
cmp esi, ebx
jne 0x402068
push 0x405135
call fcn.00401a28
cmp dword [esp + 0x18], ebx
pop ecx
je 0x402021
push str._nodel
call fcn.00401a28
pop ecx
cmp dword [esp + 0x1c], ebx
je 0x402032
push str._norunonce
call fcn.00401a28
pop ecx
cmp dword [esp + 0x18], ebx
je 0x402054
push str._ghost
call fcn.00401a28
cmp byte [esp + 0x3c], bl
pop ecx
je 0x402054
lea eax, [esp + 0x38]
push eax
call fcn.00401a28
pop ecx
push ebx
push ebx
push str.params.txt
push 0x2710
call fcn.00401811
add esp, 0x10
push esi
call fcn.00401abd
pop ecx
push esi
call fcn.00401b71
cmp esi, ebx
pop ecx
jne 0x4020a1
push 1
push edi
push 0x2712
push 0x2713
call fcn.00401811
push 1
push edi
push 0x2714
push 0x2715
call fcn.00401811
add esp, 0x20
cmp dword [esp + 0x30], ebx
mov dword [esp + 0x10], ebx
jne 0x402126
push dword [0x406030]
lea eax, [esp + 0x1cc]
push eax
lea eax, [esp + 0xc8]
push str.__s_s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x1d0]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0xe0]
push eax
push ebx
mov dword [esp + 0xa0], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x402126
cmp dword [esp + 0xc], 1
jle 0x40211e
push str.Failed_to_start_client_application.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040171d
pop ecx
pop ecx
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 2
call fcn.004017e4
cmp dword [esp + 0x24], ebx
je 0x402147
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x40215b
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x20], ebx
cmp dword [esp + 0xc], 2
jl 0x401f12
push 0x104
lea eax, [esp + 0xc4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40218b
lea edi, [esp + 0xc0]
call fcn.004011ce
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret