Function at 0x4184d0
Capabilities:
Create process on windows
Delete file
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 0x6c], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x13c], 0
cmp dword [0x485388], 0
je 0x41852a
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [0x485384], ecx
mov dword [0x48bb6c], 0
mov edx, dword [ebp + 0x10]
and edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
and eax, 2
mov dword [ebp - 0x140], eax
mov ecx, dword [ebp + 8]
mov edx, dword [0x485384]
cmp edx, dword [ecx]
je 0x418553
xor eax, eax
jmp 0x418bd6
cmp dword [ebp - 0x140], 0
je 0x41858e
cmp dword [0x48bb68], 0
je 0x418573
mov eax, dword [0x48bb68]
push eax
call fcn.004484c1
add esp, 4
mov dword [0x48bb6c], 0
mov dword [0x485388], 0xffffffff
xor eax, eax
jmp 0x418bd6
cmp dword [ebp - 4], 0
je 0x41859e
mov dword [0x485388], 0xffffffff
cmp dword [0x48bb6c], 0
je 0x4185be
cmp dword [ebp - 4], 0
je 0x4185b7
mov dword [0x48bb6c], 0
xor eax, eax
jmp 0x418bd6
cmp dword [ebp - 4], 0
je 0x4188a7
mov dword [ebp - 0x144], 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0043cb70
add esp, 4
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
jle 0x418692
push 2
push 0
mov edx, dword [0x48bb68]
push edx
call fcn.00448b56
add esp, 0xc
mov eax, dword [0x48bb68]
push eax
call fcn.00448ecd
add esp, 4
mov dword [ebp - 8], eax
push 0
push 0
mov ecx, dword [0x48bb68]
push ecx
call fcn.00448b56
add esp, 0xc
push 0x48baa0
push 0x467574
call fcn.0042aa10
add esp, 8
mov edx, dword [ebp - 0x144]
cmp edx, dword [ebp - 8]
je 0x418680
mov dword [0x485388], 0xffffffff
cmp dword [0x48bb68], 0
je 0x418666
mov eax, dword [0x48bb68]
push eax
call fcn.004484c1
add esp, 4
push 0x48baa0
push 0x467580
call fcn.0042aa10
add esp, 8
or eax, 0xffffffff
jmp 0x418bd6
push 0x48baa0
push 0x46759c
call fcn.0042aa10
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
call fcn.00418c70
add esp, 4
cmp dword [0x48bb68], 0
je 0x4186b6
mov edx, dword [0x48bb68]
push edx
call fcn.004484c1
add esp, 4
push 0x44
push 0
lea eax, [ebp - 0x68]
push eax
call fcn.004456b0
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x20]
push ecx
call fcn.004456b0
add esp, 0xc
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x3c], 1
mov edx, 1
mov word [ebp - 0x38], dx
mov eax, dword [0x48d740]
push eax
call fcn.0043cae0
add esp, 4
mov dword [0x48d740], 0xffffffff
mov ecx, dword [0x48fefc]
push ecx
call fcn.0043cae0
add esp, 4
mov dword [0x48fefc], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x418730
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0x14
jge 0x418759
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax*4 + 0x48dbf0]
push ecx
call fcn.0043cae0
add esp, 4
mov edx, dword [ebp - 0xc]
mov dword [edx*4 + 0x48dbf0], 0xffffffff
jmp 0x418727
call fcn.0043cb00
push 0x4675ac
lea eax, [ebp - 0x138]
push eax
call fcn.00445510
add esp, 8
lea ecx, [ebp - 0x138]
push ecx
push 0x48baa0
push 0x4675cc
call fcn.0042aa10
add esp, 0xc
push 3
lea edx, [ebp - 0x138]
push edx
push 0x48baa0
call fcn.0041a8c0
add esp, 0xc
test eax, eax
jne 0x4187c0
lea eax, [ebp - 0x138]
push eax
push 0x48baa0
push 0x4675e4
call fcn.0042aa10
add esp, 0xc
jmp 0x4187d9
lea ecx, [ebp - 0x138]
push ecx
push 0x48baa0
push 0x467600
call fcn.0042aa10
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
push 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x418804
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReceiveServiceUpdate_OpenProcessToken___FAILED_ERROR:_d
call fcn.0042aa10
add esp, 8
lea eax, [ebp - 0x13c]
push eax
push 1
push 2
push 0
push 0x2000000
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x418838
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReceiveServiceUpdate_DuplicateTokenEx___FAILED_ERROR:_d
call fcn.0042aa10
add esp, 8
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x467690
lea ecx, [ebp - 0x138]
push ecx
mov edx, dword [ebp - 0x13c]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x41887f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReceiveServiceUpdate_CreateProcessAsUser___FAILED_ERROR:_d
call fcn.0042aa10
add esp, 8
jmp 0x41888c
push str.CreateProcessAsUser__ServiceFax.exe___SUCCESS
call fcn.0042aa10
add esp, 4
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x418bd6
cmp dword [0x485388], 0
je 0x418ba9
mov dword [0x48bb6c], 0
push str.ServiceFax.exe
push 0x48ba38
call fcn.00445510
add esp, 8
push str.c:ccs_transferServiceFax.exe
push 0x48b970
call fcn.00445510
add esp, 8
push 0x467730
push 0x48baa0
call fcn.00445510
add esp, 8
push 0x48baa0
push str.ReceiveServiceUpdate_BEGIN_Pre_Transfer_Cleanup:__s
call fcn.0042aa10
add esp, 8
cmp dword [0x48bb68], 0
je 0x418965
mov edx, dword [0x48bb68]
push edx
call fcn.004484c1
add esp, 4
push str.c:ccs_transferServiceFax.exe.FAX_TMP
push 0x48baa0
call fcn.00445510
add esp, 8
push 0x48baa0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x418953
push 0x48baa0
push 0x4677b4
call fcn.0042aa10
add esp, 8
jmp 0x418965
push 0x48baa0
push 0x4677e4
call fcn.0042aa10
add esp, 8
push str.c:ccs_transferServiceFaxMoved.exe
push 0x48b8a8
call fcn.00445510
add esp, 8
push 0x80
push 0x48b8a8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push 0x48b970
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x48b8a8
push 0x467838
call fcn.0042aa10
add esp, 8
push 0x48b8a8
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4189cc
push 0x48b8a8
push 0x467860
call fcn.0042aa10
add esp, 8
jmp 0x4189de
push 0x48b8a8
push 0x467890
call fcn.0042aa10
add esp, 8
push 0x48b970
push 0x4678c0
call fcn.0042aa10
add esp, 8
push 0x48b970
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x418aab
push 0x48b8a8
push 0x48b970
push str.ReceiveServiceUpdate_CCSMoveFileEx__s__s_
call fcn.0042aa10
add esp, 0xc
push 1
push 0x48b8a8
push 0x48b970
call fcn.0041a8c0
add esp, 0xc
test eax, eax
jne 0x418a4b
push 0x48b8a8
push 0x48b970
push str.ReceiveServiceUpdate_CCSMoveFileEx__s__s__FAILED
call fcn.0042aa10
add esp, 0xc
jmp 0x418a62
push 0x48b8a8
push 0x48b970
push str.ReceiveServiceUpdate_CCSMoveFileEx__s__s__SUCCESS
call fcn.0042aa10
add esp, 0xc
push 0x48b8a8
push 0x46797c
call fcn.0042aa10
add esp, 8
push 0x48b8a8
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x418a97
push 0x48b8a8
push 0x4679a4
call fcn.0042aa10
add esp, 8
jmp 0x418aa9
push 0x48b8a8
push 0x4679d4
call fcn.0042aa10
add esp, 8
jmp 0x418abd
push 0x48b970
push 0x467a04
call fcn.0042aa10
add esp, 8
push 0x48baa0
push str.ReceiveServiceUpdate_DeleteFile___s__
call fcn.0042aa10
add esp, 8
push 0x48baa0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x418af2
push 0x48baa0
push str.ReceiveServiceUpdate_DeleteFile___s___FAILED
call fcn.0042aa10
add esp, 8
jmp 0x418b04
push 0x48baa0
push str.ReceiveServiceUpdate_DeleteFile___s___SUCCESS
call fcn.0042aa10
add esp, 8
push 0x48baa0
push str.ReceiveServiceUpdate_END_Pre_Transfer_Cleanup:__s
call fcn.0042aa10
add esp, 8
push 0x467af0
push 0x48baa0
call fcn.00448c8e
add esp, 8
mov dword [0x48bb68], eax
cmp dword [0x48bb68], 0
jne 0x418b60
push 0x48baa0
push str.ReceiveServiceUpdate_Starting_Transfer:__s_ERROR_fopen__FAILED__
call fcn.0042aa10
add esp, 8
mov dword [0x48bb6c], 1
mov eax, dword [ebp + 8]
push eax
call fcn.00418cf0
add esp, 4
jmp 0x418b9d
push 0x48baa0
push str.ReceiveServiceUpdate_Starting_Transfer:__s
call fcn.0042aa10
add esp, 8
mov ecx, dword [0x48bb68]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 4]
push eax
push 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 8]
push edx
call fcn.004463bd
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
call fcn.00418c70
add esp, 4
mov dword [0x485388], 0
jmp 0x418bd4
mov ecx, dword [0x48bb68]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 4]
push eax
push 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 8]
push edx
call fcn.004463bd
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
call fcn.00418c70
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0x6c]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret