Function at 0x4021a0
Capabilities:
Copy file
Create process on windows
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x43761e
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x4495ec]
xor eax, esp
mov dword [esp + 0x254], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4495ec]
xor eax, esp
push eax
lea eax, [esp + 0x26c]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00406b37
xor ecx, ecx
xor ebx, ebx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4021f9
push 0x80004005
call fcn.00404330
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x274], ebx
call fcn.00406b37
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40222a
push 0x80004005
call fcn.00404330
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x274], 1
call fcn.00406b37
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40225c
push 0x80004005
call fcn.00404330
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push 0x206
lea ecx, [esp + 0x66]
push ebx
mov byte [esp + 0x27c], 2
push ecx
mov word [esp + 0x6c], bx
call fcn.00424130
add esp, 0xc
call fcn.00406a09
mov eax, dword [eax + 8]
push 0x104
lea edx, [esp + 0x64]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x60]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4022b7
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x64]
push ecx
lea ecx, [esp + 0x24]
call fcn.00404950
cmp dword [esi + 4], ebx
je 0x4024a8
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1c]
call fcn.004048d0
push 0xe
push str.gdm_uix64.dll
lea ecx, [esp + 0x20]
call fcn.004041d0
lea edi, [esi + 0xc]
cmp edi, ebx
jne 0x402307
xor eax, eax
jmp 0x40231f
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x402310
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.00404950
push 0xe
push str.gdm_uix64.dll
lea ecx, [esp + 0x1c]
call fcn.004041d0
mov ebp, dword [esp + 0x14]
push ebx
push 0x80
push 3
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 1
push 0x80000000
push ebp
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x40236c
mov eax, dword [esp + 0x18]
push 1
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1c]
call fcn.004048d0
push 0xf
push str.gdm_drvx64.dll
lea ecx, [esp + 0x20]
call fcn.004041d0
test edi, edi
jne 0x402399
xor eax, eax
jmp 0x4023af
mov eax, edi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4023a0
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.00404950
push 0xf
push str.gdm_drvx64.dll
lea ecx, [esp + 0x1c]
call fcn.004041d0
mov ebp, dword [esp + 0x14]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ebp
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x4023fc
mov edx, dword [esp + 0x18]
push 1
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileW]
push edx
call ebp
jmp 0x402402
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
call fcn.004048d0
push 0xd
push 0x43ebf4
lea ecx, [esp + 0x20]
call fcn.004041d0
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
call fcn.004048d0
push 0xe
push str.X64_Setup.exe
lea ecx, [esp + 0x1c]
call fcn.004041d0
push 0x38
xor esi, esi
lea edx, [esp + 0x2c]
push esi
push edx
call fcn.00424130
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
add esp, 0xc
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x28], 0x3c
mov dword [esp + 0x2c], 0x40
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [esp + 0x5c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x40264e
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1c]
call fcn.004048d0
push 0xc
push str.gdm_drv.dll
lea ecx, [esp + 0x20]
call fcn.004041d0
lea edi, [esi + 0xc]
cmp edi, ebx
jne 0x4024d1
xor eax, eax
jmp 0x4024e5
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4024d6
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.00404950
push 0xc
push str.gdm_drv.dll
lea ecx, [esp + 0x1c]
call fcn.004041d0
mov ebp, dword [esp + 0x14]
push ebx
push 0x80
push 3
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 1
push 0x80000000
push ebp
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x402532
mov edx, dword [esp + 0x18]
push 1
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
call fcn.004048d0
push 0xb
push str.gdm_ui.dll
lea ecx, [esp + 0x20]
call fcn.004041d0
test edi, edi
jne 0x40255f
xor eax, eax
jmp 0x402573
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402564
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.00404950
push 0xb
push str.gdm_ui.dll
lea ecx, [esp + 0x1c]
call fcn.004041d0
mov ebp, dword [esp + 0x14]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ebp
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x4025bc
mov ecx, dword [esp + 0x18]
push 1
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1c]
call fcn.004048d0
push 0xb
push 0x43ec34
lea ecx, [esp + 0x20]
call fcn.004041d0
lea esi, [esp + 0x20]
call fcn.00402bb0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x278], 3
call fcn.004048d0
mov byte [esp + 0x274], 2
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402624
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xb
push 0x43ec34
lea ecx, [esp + 0x1c]
call fcn.004041d0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push 1
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileW]
xor esi, esi
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
call fcn.004048d0
push 0x12
push str.DocumentMaker.ppd
lea ecx, [esp + 0x20]
call fcn.004041d0
cmp edi, esi
jne 0x402674
xor eax, eax
jmp 0x40268f
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x402680
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.00404950
push 0x12
push str.DocumentMaker.ppd
lea ecx, [esp + 0x1c]
call fcn.004041d0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push 1
push ecx
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
call fcn.004048d0
push 0xe
push str.gdmscript.ntf
lea ecx, [esp + 0x20]
call fcn.004041d0
cmp edi, esi
jne 0x4026de
xor eax, eax
jmp 0x4026f2
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4026e3
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.00404950
push 0xe
push str.gdmscript.ntf
lea ecx, [esp + 0x1c]
call fcn.004041d0
mov edi, dword [esp + 0x14]
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x402735
mov ecx, dword [esp + 0x18]
push 1
push edi
push ecx
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1c]
call fcn.004048d0
push 0xc
push str.gsdll32.dll
lea ecx, [esp + 0x20]
call fcn.004041d0
lea esi, [esp + 0x20]
call fcn.00401850
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x278], 4
call fcn.004048d0
mov byte [esp + 0x274], 2
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40279d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xc
push str.gsdll32.dll
lea ecx, [esp + 0x1c]
call fcn.004041d0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push 1
push ecx
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
call fcn.004048d0
push 0x12
push 0x43ec6c
lea ecx, [esp + 0x20]
call fcn.004041d0
lea esi, [esp + 0x20]
call fcn.00401850
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x278], 5
call fcn.004048d0
mov byte [esp + 0x274], 2
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40281c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x12
push 0x43ec6c
lea ecx, [esp + 0x1c]
call fcn.004041d0
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push 1
push edi
push ecx
call ebp
call fcn.004039e0
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1c]
call fcn.004048d0
push 0xd
push str.DocToPdf.dll
lea ecx, [esp + 0x20]
call fcn.004041d0
lea esi, [esp + 0x20]
call fcn.00402bb0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x278], 6
call fcn.004048d0
mov byte [esp + 0x274], 2
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4028a0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xd
push str.DocToPdf.dll
lea ecx, [esp + 0x1c]
call fcn.004041d0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push 1
push ecx
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
call fcn.004048d0
push 0x10
push str.PDFDocMaker.dll
lea ecx, [esp + 0x20]
call fcn.004041d0
lea esi, [esp + 0x20]
call fcn.00401850
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x278], 7
call fcn.004048d0
mov byte [esp + 0x274], 2
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40291f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x10
push str.PDFDocMaker.dll
lea ecx, [esp + 0x1c]
call fcn.004041d0
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push 1
push esi
push ecx
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x402967
push str.DllRegisterServer
push esi
call ebx
test eax, eax
je 0x402960
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1c]
call fcn.004048d0
push 0x13
push str.PdfOfficeAddin.dll
lea ecx, [esp + 0x20]
call fcn.004041d0
lea esi, [esp + 0x20]
call fcn.00401850
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x278], 8
call fcn.004048d0
mov byte [esp + 0x274], 2
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4029c8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x13
push str.PdfOfficeAddin.dll
lea ecx, [esp + 0x1c]
call fcn.004041d0
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push 1
push esi
push ecx
call ebp
push esi
call edi
mov esi, eax
test esi, esi
je 0x402a04
push str.DllRegisterServer
push esi
call ebx
test eax, eax
je 0x4029fd
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1c]
call fcn.004048d0
push 0x13
push str.KG_PDFMake_JNI.dll
lea ecx, [esp + 0x20]
call fcn.004041d0
lea esi, [esp + 0x20]
call fcn.00402bb0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x278], 9
call fcn.004048d0
mov byte [esp + 0x274], 2
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402a65
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x13
push str.KG_PDFMake_JNI.dll
lea ecx, [esp + 0x1c]
call fcn.004041d0
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
push 1
push esi
push edi
call ebp
lea eax, [esi - 0x10]
mov byte [esp + 0x274], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402aa7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [esp + 0x274], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402acb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x274], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402af6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x26c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x254]
xor ecx, esp
call fcn.00421bf6
add esp, 0x264
ret