Function at 0x9b598
Capabilities:
Copy file
Create process on windows
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd88
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x278], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x9bd3c
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [0xa6a2c]
sub al, 6
jb 0x9b5e2
add al, 0xfc
sub al, 4
jb 0x9b5e2
sub al, 4
jne 0x9bcff
xor eax, eax
mov al, byte [0xa6a2c]
cmp eax, 0x12
ja case.0x9b5f2.6
jmp dword [eax*4 + 0x9b5f9]
call fcn.0009b314
lea eax, [ebp - 4]
call fcn.0009beb0
lea eax, [ebp - 0x274]
mov ecx, dword [ebp - 4]
mov edx, 0x9bd54
call fcn.00013e40
mov eax, dword [ebp - 0x274]
call fcn.0009b164
mov dword [ebp - 0x68], 0x44
xor eax, eax
mov dword [ebp - 0x64], eax
xor eax, eax
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
mov word [ebp - 0x36], 0
xor eax, eax
mov dword [ebp - 0x34], eax
mov ebx, 1
lea eax, [ebp - 8]
call fcn.00013b78
jmp 0x9b6c6
lea eax, [ebp - 0x274]
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
call fcn.00013d1c
mov edx, dword [ebp - 0x274]
lea eax, [ebp - 8]
call fcn.00013dfc
inc ebx
mov eax, dword [ebp - 4]
call fcn.00013df4
cmp ebx, eax
jg 0x9b6dc
mov eax, dword [ebp - 4]
cmp byte [eax + ebx - 1], 0x2e
jne 0x9b6a5
mov eax, dword [ebp - 4]
cmp byte [eax + ebx - 1], 0x2e
jne 0x9b71c
lea esi, [ebx + 4]
jmp 0x9b70c
lea eax, [ebp - 0x274]
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
call fcn.00013d1c
mov edx, dword [ebp - 0x274]
lea eax, [ebp - 8]
call fcn.00013dfc
inc ebx
cmp esi, ebx
jle 0x9b71c
mov eax, dword [ebp - 4]
call fcn.00013df4
cmp ebx, eax
jle 0x9b6eb
lea edx, [ebp - 0x274]
mov eax, dword [ebp - 8]
call fcn.0001872c
mov edx, dword [ebp - 0x274]
lea eax, [ebp - 8]
call fcn.00013c10
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 8]
call fcn.00013fb8
push eax
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00013fb8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
push 0xffffffffffffffff
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp case.0x9b5f2.6
call fcn.0009b314
lea eax, [ebp - 4]
call fcn.0009beb0
lea eax, [ebp - 0x274]
mov ecx, dword [ebp - 4]
mov edx, 0x9bd68
call fcn.00013e40
mov eax, dword [ebp - 0x274]
call fcn.0009b164
lea edx, [ebp - 0x274]
mov eax, dword [ebp - 4]
call fcn.0001872c
mov eax, dword [ebp - 0x274]
call fcn.00018a3c
push 5
mov eax, dword [ebp - 4]
call fcn.00013fb8
push eax
call sub.kernel32.dll_WinExec
jmp case.0x9b5f2.6
call fcn.0009b314
lea eax, [ebp - 4]
call fcn.0009beb0
lea eax, [ebp - 0x274]
mov ecx, dword [ebp - 4]
mov edx, 0x9bd80
call fcn.00013e40
mov eax, dword [ebp - 0x274]
call fcn.0009b164
mov dword [ebp - 0xa4], 0x3c
mov dword [ebp - 0xa0], 0x40
mov eax, dword [0xa4fa4]
mov eax, dword [eax]
call fcn.00042a7c
mov dword [ebp - 0x9c], eax
mov eax, 0x9bd8c
mov dword [ebp - 0x98], eax
xor eax, eax
mov dword [ebp - 0x90], eax
xor eax, eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], 5
mov eax, dword [ebp - 4]
call fcn.00013fb8
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0xa4]
push eax
call sub.shell32.dll_ShellExecuteExA
push 0xffffffffffffffff
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp case.0x9b5f2.6
call fcn.0009b314
lea eax, [ebp - 4]
call fcn.0009beb0
lea eax, [ebp - 8]
call fcn.0009beb0
push 0x9bd9c
push dword [ebp - 4]
push 0x9bdac
push dword [ebp - 8]
lea eax, [ebp - 0x274]
mov edx, 4
call fcn.00013eb4
mov eax, dword [ebp - 0x274]
call fcn.0009b164
mov eax, dword [ebp - 8]
call fcn.00013df4
mov edx, dword [ebp - 8]
cmp byte [edx + eax - 1], 0x5c
jne 0x9b8ec
lea edx, [ebp - 0x274]
mov eax, dword [ebp - 4]
call fcn.00018850
mov edx, dword [ebp - 0x274]
lea eax, [ebp - 8]
call fcn.00013dfc
mov eax, dword [ebp - 8]
call fcn.00018508
test al, al
je 0x9b915
mov eax, dword [ebp - 8]
call fcn.00018570
and eax, 0xfffffff8
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00018584
mov eax, dword [ebp - 8]
call fcn.00018694
push 0
mov eax, dword [ebp - 8]
call fcn.00013fb8
push eax
mov eax, dword [ebp - 4]
call fcn.00013fb8
push eax
call sub.kernel32.dll_CopyFileA
jmp case.0x9b5f2.6
call fcn.0009b314
lea eax, [ebp - 4]
call fcn.0009beb0
lea eax, [ebp - 8]
call fcn.0009beb0
push 0x9bdbc
push dword [ebp - 4]
push 0x9bdac
push dword [ebp - 8]
lea eax, [ebp - 0x274]
mov edx, 4
call fcn.00013eb4
mov eax, dword [ebp - 0x274]
call fcn.0009b164
mov eax, dword [ebp - 8]
call fcn.00013fb8
push eax
mov eax, dword [ebp - 4]
call fcn.00013fb8
push eax
call sub.kernel32.dll_MoveFileA
jmp case.0x9b5f2.6
call fcn.0009b314
mov al, 0x13
call fcn.0009c3dc
mov eax, dword [0xa5118]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
mov eax, dword [eax + 0x204]
mov edx, dword [eax]
call dword [edx + 0x40]
cmp byte [0xa6a2c], 0x14
je 0x9b9e8
lea eax, [ebp - 4]
call fcn.0009beb0
mov eax, dword [0xa5118]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
mov eax, dword [eax + 0x204]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
cmp byte [0xa6a2c], 0x14
jne 0x9b9bc
mov al, 0x14
call fcn.0009c3dc
mov eax, 0x9bdcc
call fcn.0009b164
mov eax, dword [0xa5118]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xcc]
cmp eax, 2
jne case.0x9b5f2.6
mov byte [0xa6a2c], 0x15
jmp case.0x9b5f2.6
call fcn.0009b314
lea eax, [ebp - 4]
call fcn.0009beb0
lea eax, [ebp - 0x274]
mov ecx, dword [ebp - 4]
mov edx, 0x9bde4
call fcn.00013e40
mov eax, dword [ebp - 0x274]
call fcn.0009b164
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x270]
call fcn.00015606
lea eax, [ebp - 0x270]
call fcn.00015872
mov al, 0x13
call fcn.0009c3dc
cmp byte [0xa6a2c], 0x14
je 0x9ba95
lea eax, [ebp - 4]
call fcn.0009beb0
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x270]
call fcn.00014188
call fcn.00015ab7
cmp byte [0xa6a2c], 0x14
jne 0x9ba71
mov al, 0x14
call fcn.0009c3dc
lea eax, [ebp - 0x270]
call fcn.00015770
mov eax, 0x9be00
call fcn.0009b164
jmp case.0x9b5f2.6
call fcn.0009b314
lea eax, [ebp - 4]
call fcn.0009beb0
lea eax, [ebp - 8]
call fcn.0009beb0
lea eax, [ebp - 0xc]
call fcn.0009beb0
push 0x9be1c
push dword [ebp - 8]
push 0x9bdac
push dword [ebp - 0xc]
lea eax, [ebp - 0x274]
mov edx, 4
call fcn.00013eb4
mov eax, dword [ebp - 0x274]
call fcn.0009b164
lea edx, [ebp - 0x14]
mov al, 0x6d
call fcn.0009b1c8
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.000a1cd4
test al, al
jne case.0x9b5f2.6
mov byte [0xa6a2c], 0x15
jmp case.0x9b5f2.6
call fcn.0009b314
lea eax, [ebp - 4]
call fcn.0009beb0
lea eax, [ebp - 8]
call fcn.0009beb0
push 0x9be2c
push dword [ebp - 4]
push 0x9bdac
push dword [ebp - 8]
lea eax, [ebp - 0x274]
mov edx, 4
call fcn.00013eb4
mov eax, dword [ebp - 0x274]
call fcn.0009b164
mov eax, dword [0xa4fa4]
mov eax, dword [eax]
mov eax, dword [eax + 0x384]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0xa4fa4]
mov eax, dword [eax]
mov eax, dword [eax + 0x384]
mov edx, dword [ebp - 8]
call fcn.0007a474
mov eax, dword [0xa4fa4]
mov eax, dword [eax]
mov eax, dword [eax + 0x344]
xor edx, edx
call fcn.0003cc08
mov eax, dword [0xa4fa4]
mov eax, dword [eax]
mov eax, dword [eax + 0x340]
mov dl, 1
call fcn.0003cc08
lea eax, [ebp - 0x274]
mov ecx, dword [ebp - 4]
mov edx, 0x9be40
call fcn.00013e40
mov edx, dword [ebp - 0x274]
mov eax, dword [0xa4fa4]
mov eax, dword [eax]
mov eax, dword [eax + 0x348]
call fcn.0003cd48
mov eax, dword [0xa4fa4]
mov eax, dword [eax]
mov eax, dword [eax + 0x384]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [0xa4fa4]
mov eax, dword [eax]
mov eax, dword [eax + 0x340]
xor edx, edx
call fcn.0003cc08
mov eax, dword [0xa4fa4]
mov eax, dword [eax]
mov eax, dword [eax + 0x344]
mov dl, 1
call fcn.0003cc08
jmp case.0x9b5f2.6
call fcn.0009b314
lea eax, [ebp - 4]
call fcn.0009beb0
lea eax, [ebp - 8]
call fcn.0009beb0
push 0x9be54
push dword [ebp - 4]
push 0x9be70
push dword [ebp - 8]
lea eax, [ebp - 0x274]
mov edx, 4
call fcn.00013eb4
mov eax, dword [ebp - 0x274]
call fcn.0009b164
lea edx, [ebp - 0x274]
mov al, 0x6d
call fcn.0009b1c8
lea eax, [ebp - 0x274]
mov edx, 0x9be80
call fcn.00013dfc
mov ecx, dword [ebp - 0x274]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.000a1960
jmp case.0x9b5f2.6
lea eax, [ebp - 0xd]
call fcn.0009c3c8
mov al, 0xf
call fcn.0009c3dc
lea eax, [ebp - 4]
call fcn.0009beb0
push 0x9be90
push dword [ebp - 4]
push 0x9be9c
lea eax, [ebp - 0x278]
mov dl, byte [ebp - 0xd]
call fcn.00013d1c
push dword [ebp - 0x278]
push 0x9beac
lea eax, [ebp - 0x274]
mov edx, 5
call fcn.00013eb4
mov eax, dword [ebp - 0x274]
call fcn.0009b164
mov edx, dword [ebp - 4]
mov al, byte [ebp - 0xd]
call fcn.0009b1f8
jmp case.0x9b5f2.6
mov eax, 1
call fcn.0009b57c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x9bd43
lea eax, [ebp - 0x278]
mov edx, 2
call fcn.00013b9c
lea eax, [ebp - 0x14]
call fcn.00013b78
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00013b9c
ret