Function at 0x406385
Capabilities:
Copy file

Disassembly:
push 0x494
mov eax, 0x42863c
call fcn.0041789c
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x488], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp + 0x1c]
push str.Compiling_script...
mov dword [ebp - 0x48c], ebx
mov dword [ebp - 0x480], eax
call fcn.00405e3a
push dword [ebp - 0x47c]
mov ecx, esi
push dword [ebp - 0x484]
call fcn.004071c8
test al, al
je 0x4068d8
push dword [ebp - 0x488]
mov ecx, esi
push ebx
call fcn.004068e5
cmp byte [esi + 0x16c0], 0
je 0x406437
mov ecx, esi
call fcn.00407d9e
push ebx
mov ebx, dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0x403
push dword [esi]
call ebx
cmp byte [esi + 0x16c3], 0
jne 0x406431
push dword [ebp - 0x488]
push 0x404
push dword [esi]
call ebx
mov ebx, dword [ebp - 0x48c]
cmp byte [esi + 0x16c3], 0
mov eax, ebx
jne 0x406444
mov eax, edi
xor ecx, ecx
push ecx
push 0x80
push 2
push ecx
push ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x406472
push ebx
mov edi, 0xa02e
push edi
mov ecx, esi
call fcn.00404101
mov eax, edi
jmp 0x4068dd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esi + 0x16c3], 0
jne 0x406488
mov ebx, dword [ebp - 0x480]
push ebx
push dword [ebp - 0x47c]
mov ecx, esi
push dword [ebp - 0x484]
call fcn.004075d5
test al, al
je 0x4068d8
cmp byte [esi + 0x16c3], 0
je 0x4064b4
xor eax, eax
jmp 0x4068dd
cmp byte [esi + 0x16c4], 0
jne 0x4064ef
lea eax, [esi + 0x868]
push eax
lea ebx, [esi + 0xa70]
push ebx
call fcn.00413fdb
cmp dword [esi + 0x860], 0
pop ecx
pop ecx
je 0x4064e2
push str.AutoItSC_x64.bin
jmp 0x4064e7
push str.AutoItSC.bin
push ebx
call fcn.00413fac
pop ecx
pop ecx
xor ebx, ebx
inc ebx
cmp byte [esi + 0x16c4], 0
je 0x40651e
push 0
push edi
lea eax, [esi + 0xa70]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4065c3
push edi
mov edi, 0xa02f
jmp 0x406463
cmp dword [esi + 0x860], 0
mov eax, str.BIN64
jne 0x406531
mov eax, str.BIN32
push ecx
lea ecx, [ebp - 0x484]
push ecx
push eax
push 0xa
call fcn.00408559
mov dword [ebp - 0x484], eax
test eax, eax
jne 0x40655c
push str.Error:_Unable_to_extract_interpreter.
mov ecx, esi
call fcn.0040403e
jmp 0x4068d8
lea ecx, [ebp - 0x478]
call fcn.00401972
call fcn.00401972
mov eax, dword [ebp - 0x484]
and dword [ebp - 0x460], 0
push 0x104
mov dword [ebp - 0x474], eax
lea eax, [ebp - 0x24c]
push edi
push eax
mov dword [ebp - 0x464], ebx
call fcn.00413cef
add esp, 0xc
lea ecx, [ebp - 0x478]
xor eax, eax
mov word [ebp - 0x44], ax
call fcn.004019a2
test eax, eax
jne 0x40688f
mov ecx, edi
call fcn.0040e9b9
cmp eax, 0xffffffff
je 0x40688f
push ebx
push edi
lea ecx, [ebp - 0x4a0]
call fcn.00402953
lea ecx, [ebp - 0x4a0]
call fcn.00402d01
push eax
call fcn.00402c93
mov ecx, dword [esi + 0x860]
neg ecx
sbb ecx, ecx
and ecx, 0x12ee0
add ecx, 0xe242e
cmp eax, ecx
lea ecx, [ebp - 0x4a0]
setne bl
dec bl
call fcn.00402a48
mov ecx, esi
and bl, 1
jne 0x40661a
push str.Error:_Binary_integrity_cant_be_verified.
jmp 0x406552
push str.Updating_resources...
call fcn.00405e3a
lea ebx, [esi + 0x1750]
cmp dword [ebx], 0
je 0x406638
push 1
mov ecx, ebx
call fcn.0040a1eb
push 0
push edi
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov dword [ebx], eax
mov ecx, esi
test eax, eax
jne 0x406659
push edi
push 0xa041
call fcn.00404101
jmp 0x4068d8
push dword [ebp - 0x480]
xor eax, eax
mov dword [ebp - 0x47c], eax
inc eax
mov word [esi + 0x176a], ax
call fcn.00408420
mov ecx, esi
test al, al
je 0x406649
call fcn.00407b16
mov ecx, esi
call fcn.004084b1
test al, al
je 0x4067e9
cmp byte [esi + 0x174c], 1
je 0x4066a0
cmp byte [esi + 0x16c8], 0
jne 0x406718
push ecx
lea eax, [ebp - 0x480]
push eax
push 0xa6
push 4
call fcn.00408559
test eax, eax
je 0x4066d4
push 0x809
push 0xa6
push 4
push dword [ebp - 0x480]
mov ecx, ebx
push eax
call fcn.0040a21b
jmp 0x4066d6
xor al, al
test al, al
jne 0x4066e3
push 2
pop eax
mov dword [ebp - 0x47c], eax
push 0xa4
mov ecx, esi
call fcn.004085b2
push 0xa2
mov ecx, esi
mov bl, al
call fcn.004085b2
test al, bl
mov eax, dword [ebp - 0x47c]
jne 0x40670a
or eax, 4
test eax, eax
jne 0x4067e9
lea ebx, [esi + 0x1750]
push 0xa9
mov ecx, esi
call fcn.004085b2
test al, al
je 0x4067e9
push 0x63
mov ecx, esi
call fcn.004085b2
test al, al
je 0x4067e9
cmp byte [esi + 0x174c], 1
je 0x40674f
cmp byte [esi + 0x1740], 0
je 0x406793
push ecx
lea eax, [ebp - 0x480]
push eax
push 0x3e8
push 5
call fcn.00408559
test eax, eax
je 0x406785
push 0x809
push 0x3e8
push 5
push dword [ebp - 0x480]
mov ecx, ebx
push eax
call fcn.0040a21b
xor ecx, ecx
jmp 0x406789
xor ecx, ecx
mov al, cl
test al, al
je 0x4067e9
mov byte [esi + 0x1740], cl
mov ecx, esi
call fcn.00407df7
mov ecx, dword [esi + 0x1764]
test ecx, ecx
je 0x4067bf
movzx eax, word [esi + 0x1768]
push 0x809
push 1
push 0x10
push eax
push ecx
mov ecx, ebx
call fcn.0040a21b
jmp 0x4067c2
xor eax, eax
inc eax
test al, al
je 0x4067e9
push 0
mov ecx, ebx
call fcn.0040a1eb
mov eax, dword [ebp - 0x488]
xor ebx, ebx
cmp word [eax], bx
je 0x4067f0
push edi
mov edx, eax
call fcn.004098a1
pop ecx
test al, al
jne 0x4067f0
mov ecx, esi
jmp 0x406649
push str.Updating_.exe_headers...
mov ecx, esi
call fcn.00405e3a
push ebx
push edi
lea ecx, [ebp - 0x4a0]
call fcn.00402953
lea ecx, [ebp - 0x4a0]
call fcn.00402b2a
cmp dword [esi + 0x864], ebx
je 0x406828
push ecx
lea ecx, [ebp - 0x4a0]
call fcn.00402aaa
lea ecx, [ebp - 0x4a0]
call fcn.00402b95
lea ecx, [ebp - 0x4a0]
call fcn.00402a48
cmp dword [esi + 0x85c], ebx
je 0x406866
cmp dword [esi + 0x860], ebx
jne 0x406866
push str.Compressing_stub_executable_with_upx.exe...
mov ecx, esi
call fcn.00405e3a
push edi
mov ecx, esi
call fcn.004087f7
test eax, eax
jne 0x4068dd
push str.Writing_destination_.exe...
mov ecx, esi
call fcn.00405e3a
push ebx
mov ebx, dword [ebp - 0x48c]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4064ad
push ebx
jmp 0x406514
push str.Error:_Unable_to_create_temporary_executable:_n_n
lea ecx, [ebp - 0x49c]
call fcn.00403a9f
xor eax, eax
lea ecx, [ebp - 0x49c]
push edi
mov dword [ebp - 4], eax
call fcn.00408c4d
push str._n_nCheck_your_AV_definitions_are_up_to_date__or_create_an_exclusion_for_the_above_folder.
lea ecx, [ebp - 0x49c]
call fcn.00408c4d
push dword [ebp - 0x49c]
mov ecx, esi
call fcn.0040403e
lea ecx, [ebp - 0x49c]
call fcn.004015bf
mov eax, 0xffff
call fcn.0041785a
ret 0x18