Function at 0x401875
Capabilities:
Copy file
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3cc
push ebx
push esi
push edi
xor ebx, ebx
push 0x3f
xor esi, esi
lea eax, [esp + 0x3d]
push ebx
inc esi
push eax
mov dword [esp + 0x2c], esi
mov byte [esp + 0x44], bl
call fcn.00402d00
add esp, 0xc
push 0x103
lea eax, [esp + 0xc5]
push ebx
push eax
mov dword [esp + 0x20], esi
mov byte [esp + 0xcc], bl
call fcn.00402d00
add esp, 0xc
push 0x40
lea eax, [esp + 0x80]
push ebx
push eax
mov dword [esp + 0x84], ebx
call fcn.00402d00
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x30], ebx
xor eax, eax
lea edi, [esp + 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
push str._nodel
stosd dword es:[edi], eax
call fcn.0040176f
mov dword [esp + 0x1c], eax
mov dword [esp], str._ghost
call fcn.0040176f
mov dword [esp + 0x20], eax
mov dword [esp], str._stop
call fcn.0040176f
mov dword [esp + 0x38], eax
mov dword [esp], 0x404224
call fcn.0040176f
test eax, eax
pop ecx
je 0x40195c
push str._unattid
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x40
pop ecx
sub ecx, eax
push ecx
lea eax, [esp + eax + 0x3c]
push eax
mov ebx, esi
call fcn.004017cc
pop ecx
pop ecx
xor ebx, ebx
push 0x40423c
mov dword [esp + 0x10], ebx
call fcn.0040176f
test eax, eax
pop ecx
je 0x4019c1
push 6
push str.SET_RESCUEAPP_MAJOR_d_n
call fcn.00402a63
push 2
push str.SET_RESCUEAPP_MINOR_d_n
call fcn.00402a63
mov edi, 0x174
push edi
push str.SET_RESCUEAPP_BUILD_d_n
call fcn.00402a63
mov esi, 0x3ee
push esi
push str.SET_RESCUEAPP_REVISION_d_n
call fcn.00402a63
push esi
push edi
push 2
push 6
push str.SET_RESCUEAPP_VER_d._d._d._d_n
call fcn.00402a63
add esp, 0x34
xor eax, eax
jmp 0x401d40
mov edi, str._app
push edi
call fcn.0040176f
test eax, eax
pop ecx
je 0x401a17
push 0xa
push 0x7d00
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
mov dword [0x405384], eax
je 0x4019ef
call fcn.00401364
jmp 0x4019f1
xor eax, eax
cmp eax, ebx
je 0x401a17
push 0x405018
call fcn.0040279d
pop ecx
call fcn.004013a9
push ebx
push str.LMI_Rescue_srv.exe
push dword [0x405018]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str._params
call fcn.0040176f
test eax, eax
pop ecx
je 0x401ac8
push 1
push ebx
push str.eula.txt
push 0x2717
call fcn.004013d6
push 0x40420b
call fcn.004015ed
add esp, 0x14
cmp dword [esp + 0x18], ebx
je 0x401a5a
push str._nodel
call fcn.004015ed
pop ecx
cmp dword [esp + 0x1c], ebx
je 0x401a7c
push str._ghost
call fcn.004015ed
cmp byte [esp + 0x3c], bl
pop ecx
je 0x401a7c
lea eax, [esp + 0x38]
push eax
call fcn.004015ed
pop ecx
push ebx
push ebx
push str.params.txt
push 0x2710
call fcn.004013d6
call fcn.00401682
call fcn.0040171b
push 1
mov esi, str.script
push esi
push 0x2712
push 0x2713
call fcn.004013d6
push 1
push esi
push 0x2714
push 0x2715
call fcn.004013d6
add esp, 0x30
jmp 0x4019ba
push edi
call fcn.0040176f
test eax, eax
pop ecx
jne 0x4019ba
lea eax, [esp + 0x1c8]
push eax
lea edi, [esp + 0x2d4]
lea esi, [esp + 0x10]
mov dword [esp + 0x14], ebx
call fcn.0040121d
cmp eax, ebx
pop ecx
je 0x401b12
push dword [eax*4 + 0x405024]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004012e2
pop ecx
pop ecx
jmp 0x401cdc
push 0xa
xor edi, edi
push 0x7d00
inc edi
push ebx
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
mov dword [0x405384], eax
je 0x401b37
call fcn.00401364
jmp 0x401b39
xor eax, eax
cmp eax, ebx
jne 0x401b44
push str.Failed_to_locate_application_resource.
jmp 0x401aff
push 0x405018
call fcn.0040279d
test eax, eax
pop ecx
jne 0x401b64
cmp dword [esp + 0xc], edi
jle 0x401cdc
push str.Failed_to_decompress_application_files.
jmp 0x401aff
push ebx
push str.LMI_Rescue_srv.exe
push dword [0x405018]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x401b84
push str.Failed_to_copy_service_binary.
jmp 0x401aff
call fcn.004013a9
push edi
push ebx
push str.eula.txt
push 0x2717
call fcn.004013d6
push 0x40420b
call fcn.004015ed
add esp, 0x14
cmp dword [esp + 0x18], ebx
je 0x401bb8
push str._nodel
call fcn.004015ed
pop ecx
cmp dword [esp + 0x1c], ebx
je 0x401bda
push str._ghost
call fcn.004015ed
cmp byte [esp + 0x3c], bl
pop ecx
je 0x401bda
lea eax, [esp + 0x38]
push eax
call fcn.004015ed
pop ecx
push ebx
push ebx
push str.params.txt
push 0x2710
call fcn.004013d6
call fcn.00401682
call fcn.0040171b
push edi
mov esi, str.script
push esi
push 0x2712
push 0x2713
call fcn.004013d6
push edi
push esi
push 0x2714
push 0x2715
call fcn.004013d6
add esp, 0x30
cmp dword [esp + 0x34], ebx
jne 0x401ccc
push dword [0x405018]
lea eax, [esp + 0x1cc]
push eax
lea eax, [esp + 0xc8]
push str.__s_s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x1d0]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0xe0]
push eax
push ebx
mov dword [esp + 0xa0], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x401c92
cmp dword [esp + 0xc], edi
jle 0x401cdc
push str.Failed_to_start_client_application.
jmp 0x401aff
push 0xffffffffffffffff
push dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], 2
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x401cdc
xor eax, eax
cmp dword [esp + 0x20], ebx
sete al
mov dword [esp + 0x10], eax
jmp 0x401cdc
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], ebx
call fcn.004013a9
cmp dword [esp + 0x28], ebx
je 0x401cf5
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x24], ebx
je 0x401d09
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x10], ebx
je 0x401d31
cmp dword [esp + 0x18], ebx
jne 0x401d31
lea eax, [esp + 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [esp + 0x1c8]
push eax
call fcn.004011ce
pop ecx
cmp dword [esp + 0xc], 2
jl 0x401ad7
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10