Function at 0x4d5cf0
Capabilities:
Copy file
Create process on windows

Disassembly:
sub esp, 0xa50
mov eax, dword [0x554e0c]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x50], eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x54]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x54]
push ecx
push 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, dword [0x547570]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ecx
lea eax, [esp + 0x54]
mov edi, esp
test eax, eax
mov dword [edi], edx
je 0x4d5d89
lea ecx, [esp + 0x54]
shr ecx, 0x10
jne 0x4d5d59
xor edx, edx
lea eax, [esp + 0x54]
mov dx, ax
mov ecx, edi
push edx
call fcn.00413ae0
jmp 0x4d5d89
lea ecx, [esp + 0x54]
push ecx
call ebx
mov esi, eax
test esi, esi
je 0x4d5d89
push esi
mov ecx, edi
call fcn.00405530
test eax, eax
je 0x4d5d89
mov edi, dword [edi]
lea ecx, [esi + esi]
mov edx, ecx
lea esi, [esp + 0x54]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x38]
push eax
call fcn.00453330
add esp, 8
lea ecx, [esp + 0x34]
call fcn.004055c0
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.USER32.dll_CharLowerW]
mov edx, dword [0x547570]
lea eax, [esp + 0x50]
test eax, eax
mov dword [esp + 0x30], edx
je 0x4d5e0e
lea ecx, [esp + 0x50]
shr ecx, 0x10
jne 0x4d5dda
xor edx, edx
lea eax, [esp + 0x50]
mov dx, ax
lea ecx, [esp + 0x30]
push edx
call fcn.00413ae0
jmp 0x4d5e0e
lea ecx, [esp + 0x50]
push ecx
call ebx
mov esi, eax
test esi, esi
je 0x4d5e0e
push esi
lea ecx, [esp + 0x34]
call fcn.00405530
test eax, eax
je 0x4d5e0e
mov edi, dword [esp + 0x30]
lea ecx, [esi + esi]
mov edx, ecx
lea esi, [esp + 0x50]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x547570]
lea ecx, [esp + 0x50]
test ecx, ecx
mov dword [esp + 0x38], eax
je 0x4d5e71
lea edx, [esp + 0x50]
shr edx, 0x10
jne 0x4d5e3d
xor eax, eax
lea ecx, [esp + 0x50]
mov ax, cx
lea ecx, [esp + 0x38]
push eax
call fcn.00413ae0
jmp 0x4d5e71
lea edx, [esp + 0x50]
push edx
call ebx
mov esi, eax
test esi, esi
je 0x4d5e71
push esi
lea ecx, [esp + 0x3c]
call fcn.00405530
test eax, eax
je 0x4d5e71
mov edi, dword [esp + 0x38]
lea ecx, [esi + esi]
mov eax, ecx
lea esi, [esp + 0x50]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x547570]
mov edx, str._autoupdate
test edx, edx
mov dword [esp + 0x10], ecx
je 0x4d5ebe
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test esi, esi
je 0x4d5ebe
push esi
lea ecx, [esp + 0x14]
call fcn.00405530
test eax, eax
je 0x4d5ebe
mov eax, dword [esp + 0x10]
inc esi
push esi
push str._autoupdate
push eax
call fcn.00405400
add esp, 0xc
lea ecx, [esp + 0x10]
push 0xffffffffffffffff
call fcn.00405bb0
mov ecx, dword [esp + 0x10]
push 0
push ecx
lea ecx, [esp + 0x3c]
call fcn.00405c70
mov ecx, dword [0x547574]
test eax, eax
mov eax, dword [esp + 0x10]
setge bl
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x4d5f02
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4d5f02
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.00532222
add esp, 4
test bl, bl
je 0x4d65db
mov eax, dword [0x55f398]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jl 0x4d5f26
mov dword [esp + 0x10], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4d5f3a
mov ecx, dword [0x547570]
push eax
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x14]
call fcn.00405920
push 0x40f700
push 0x100
lea edx, [esp + 0x268]
push 8
push edx
call fcn.004018a0
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov edx, dword [eax - 0xc]
lea ebp, [eax - 0xc]
cmp edx, 1
jg 0x4d5f6b
mov edx, dword [eax - 4]
test edx, edx
jge 0x4d5fb0
mov ebx, dword [eax - 8]
test ebx, ebx
jle 0x4d5f74
mov ecx, ebx
push ecx
lea ecx, [esp + 0x14]
call fcn.00405530
test eax, eax
jne 0x4d5f86
xor ebp, ebp
jmp 0x4d5fb2
mov edi, dword [esp + 0x10]
lea ecx, [ebx + ebx + 2]
mov eax, ecx
lea esi, [ebp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
mov dword [ecx - 8], ebx
call fcn.00405590
mov eax, dword [esp + 0x10]
mov ebp, eax
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebp
mov dword [esp + 0x260], 0
call ebx
lea eax, [eax + eax + 0xc]
push eax
call fcn.00533086
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 4
mov esi, eax
push 0x5482f0
push esi
mov dword [esi], 0
mov word [esi], 0
call edi
push ebp
push esi
call edi
push 0x5482f0
push esi
call edi
push 0x5482f0
push esi
call edi
push 0x5482f0
push esi
call edi
push 0x5482f0
push esi
call edi
push esi
call ebx
push esi
call ebx
mov edi, eax
lea edx, [edi + edi*2]
push edx
call fcn.00533086
lea edi, [esi + edi*2]
add esp, 4
xor ebp, ebp
cmp esi, edi
mov dword [eax], 0
mov ebx, eax
mov ecx, esi
jae 0x4d605e
cmp word [ecx], 0x22
jne 0x4d6048
xor edx, edx
test ebp, ebp
sete dl
mov ebp, edx
test ebp, ebp
je 0x4d6057
cmp word [ecx], 0x20
jne 0x4d6057
mov word [ecx], 9
add ecx, 2
cmp ecx, edi
jb 0x4d6039
cmp esi, edi
mov ecx, esi
jae 0x4d607a
mov dx, word [ecx]
cmp dx, 0x22
je 0x4d6073
mov word [eax], dx
add eax, 2
add ecx, 2
cmp ecx, edi
jb 0x4d6064
push ebx
mov word [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebp, [ebx + eax*2 - 2]
mov edi, ebx
cmp ebx, ebp
mov esi, ebx
jae 0x4d6110
cmp word [edi], 0x20
jne 0x4d6109
push esi
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x4d6106
mov eax, dword [esp + 0x25c]
push 0x547824
push esi
mov dword [esp + eax*8 + 0x268], esi
mov ecx, dword [esp + 0x264]
mov dword [esp + ecx*8 + 0x26c], 0
call fcn.0053225f
add esp, 8
test eax, eax
je 0x4d60f0
mov ecx, dword [esp + 0x25c]
lea edx, [eax + 2]
mov dword [esp + ecx*8 + 0x264], edx
mov word [eax], 0
mov eax, dword [esp + 0x25c]
inc eax
cmp eax, 0x100
mov dword [esp + 0x25c], eax
jge 0x4d6110
lea esi, [edi + 2]
add edi, 2
cmp edi, ebp
jb 0x4d6092
cmp ebx, ebp
mov eax, ebx
jae 0x4d6133
cmp word [eax], 0xa
jne 0x4d6121
mov word [eax], 0x20
cmp word [eax], 9
jne 0x4d612c
mov word [eax], 0x20
add eax, 2
cmp eax, ebp
jb 0x4d6116
mov eax, dword [esp + 0x25c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
xor esi, esi
test eax, eax
jle 0x4d616a
lea edi, [esp + 0x260]
mov edx, dword [edi]
push edx
push str.Path
call ebx
test eax, eax
je 0x4d6192
mov eax, dword [esp + 0x25c]
inc esi
add edi, 8
cmp esi, eax
jl 0x4d614d
xor esi, esi
mov eax, dword [0x547570]
test esi, esi
mov dword [esp + 0x14], eax
je 0x4d61cb
mov ecx, esi
shr ecx, 0x10
jne 0x4d619b
and esi, 0xffff
lea ecx, [esp + 0x14]
push esi
call fcn.00413ae0
jmp 0x4d61cb
mov esi, dword [esp + esi*8 + 0x264]
jmp 0x4d616c
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test edi, edi
je 0x4d61cb
push edi
lea ecx, [esp + 0x18]
call fcn.00405530
test eax, eax
je 0x4d61cb
lea ecx, [edi + edi]
mov edi, dword [esp + 0x14]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x25c]
xor esi, esi
test eax, eax
jle 0x4d61fc
lea edi, [esp + 0x260]
mov eax, dword [edi]
push eax
push 0x54a9bc
call ebx
test eax, eax
je 0x4d6225
mov eax, dword [esp + 0x25c]
inc esi
add edi, 8
cmp esi, eax
jl 0x4d61df
xor esi, esi
mov ecx, dword [0x547570]
test esi, esi
mov dword [esp + 0x1c], ecx
je 0x4d625e
mov edx, esi
shr edx, 0x10
jne 0x4d622e
and esi, 0xffff
lea ecx, [esp + 0x1c]
push esi
call fcn.00413ae0
jmp 0x4d625e
mov esi, dword [esp + esi*8 + 0x264]
jmp 0x4d61fe
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test edi, edi
je 0x4d625e
push edi
lea ecx, [esp + 0x20]
call fcn.00405530
test eax, eax
je 0x4d625e
lea ecx, [edi + edi]
mov edi, dword [esp + 0x1c]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x14]
push ecx
mov ecx, esp
mov edx, dword [eax - 0xc]
test edx, edx
jl 0x4d627e
mov dword [ecx], eax
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4d6290
mov edx, dword [0x547570]
mov dword [ecx], edx
mov eax, dword [esp + 0x18]
push eax
call fcn.00405920
lea ecx, [esp + 0x40]
push ecx
call fcn.004534f0
add esp, 8
lea ecx, [esp + 0x18]
push str..exe
call fcn.00405730
push 0x547f08
lea ecx, [esp + 0x24]
call fcn.00405730
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x30]
push ecx
push edx
call fcn.00412c10
push eax
lea eax, [esp + 0x34]
push eax
call fcn.00412c10
mov eax, dword [eax]
push eax
mov ecx, dword [eax - 8]
push ecx
lea ecx, [esp + 0x44]
call fcn.00405a90
lea ecx, [esp + 0x2c]
call fcn.00405700
lea ecx, [esp + 0x28]
call fcn.00405700
lea ecx, [esp + 0x20]
call fcn.00405700
lea ecx, [esp + 0x18]
call fcn.00405700
lea edx, [esp + 0x40]
push edx
call fcn.005010c0
add esp, 4
lea ecx, [esp + 0x18]
push 0x54a9b0
call fcn.00405730
lea eax, [esp + 0x40]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
call fcn.00412c10
lea ecx, [esp + 0x50]
push eax
push ecx
call fcn.00412c10
lea ecx, [esp + 0x28]
call fcn.00405700
lea ecx, [esp + 0x18]
call fcn.00405700
push 0x5482f4
lea ecx, [esp + 0x30]
call fcn.00405730
push 0x54a9b0
lea ecx, [esp + 0x24]
call fcn.00405730
push str.Autoupdate:
lea ecx, [esp + 0x1c]
call fcn.00405730
lea edx, [esp + 0x2c]
lea eax, [esp + 0x40]
push edx
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x24]
push ecx
lea eax, [esp + 0x24]
push edx
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.00412c10
lea edx, [esp + 0x50]
push eax
push edx
call fcn.00412c10
push eax
lea eax, [esp + 0x34]
push eax
call fcn.00412c10
lea ecx, [esp + 0x4c]
push eax
push ecx
call fcn.00412c10
lea ecx, [esp + 0x28]
call fcn.00405700
lea ecx, [esp + 0x44]
call fcn.00405700
lea ecx, [esp + 0x24]
call fcn.00405700
lea ecx, [esp + 0x18]
call fcn.00405700
lea ecx, [esp + 0x20]
call fcn.00405700
lea ecx, [esp + 0x2c]
call fcn.00405700
call fcn.004d5b70
push str._nBackup:_n
lea ecx, [esp + 0x1c]
call fcn.00405730
push 0x5485c8
lea ecx, [esp + 0x30]
call fcn.00405730
lea edx, [esp + 0x3c]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x34]
push ecx
lea eax, [esp + 0x54]
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.00412c10
lea edx, [esp + 0x34]
push eax
push edx
call fcn.00412c10
push eax
lea eax, [esp + 0x50]
push eax
call fcn.00412c10
lea ecx, [esp + 0x28]
push eax
push ecx
call fcn.00412c10
mov edx, dword [esp + 0x4c]
mov eax, dword [eax]
mov esi, dword [sym.imp.USER32.dll_GetActiveWindow]
push 0x40003
push edx
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
push eax
call edi
lea ecx, [esp + 0x24]
mov ebx, eax
call fcn.00405700
lea ecx, [esp + 0x44]
call fcn.00405700
lea ecx, [esp + 0x28]
call fcn.00405700
lea ecx, [esp + 0x20]
call fcn.00405700
lea ecx, [esp + 0x2c]
call fcn.00405700
lea ecx, [esp + 0x18]
call fcn.00405700
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4d64ef
push str.Bad_Autoupdate_1
lea ecx, [esp + 0x28]
call fcn.00405730
mov eax, dword [eax]
push 0
push 0
push eax
call esi
push eax
call edi
lea ecx, [esp + 0x24]
call fcn.00405700
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4d651d
push str.Bad_Autoupdate_2
lea ecx, [esp + 0x28]
call fcn.00405730
mov eax, dword [eax]
push 0
push 0
push eax
call esi
push eax
call edi
lea ecx, [esp + 0x24]
call fcn.00405700
cmp ebx, 6
jne 0x4d6549
call fcn.00501360
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push edx
push eax
call esi
mov ecx, dword [esp + 0x14]
push 0
lea edx, [esp + 0x54]
push ecx
push edx
call esi
mov eax, dword [esp + 0x14]
push 5
push 0
push eax
push str.explorer.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.004d5700
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea ecx, [esp + 0x48]
call fcn.00405700
lea ecx, [esp + 0x4c]
call fcn.00405700
lea ecx, [esp + 0x40]
call fcn.00405700
lea ecx, [esp + 0x3c]
call fcn.00405700
lea ecx, [esp + 0x1c]
call fcn.00405700
lea ecx, [esp + 0x14]
call fcn.00405700
lea ecx, [esp + 0x10]
call fcn.00405700
lea ecx, [esp + 0x38]
call fcn.00405700
lea ecx, [esp + 0x30]
call fcn.00405700
lea ecx, [esp + 0x34]
call fcn.00405700
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa50
ret
lea ecx, [esp + 0x38]
call fcn.00405700
lea ecx, [esp + 0x30]
call fcn.00405700
lea ecx, [esp + 0x34]
call fcn.00405700
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa50
ret