Function at 0x44db70
Capabilities:
Copy file
Create directory
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x574506
mov eax, dword fs:[0]
push eax
sub esp, 0x394
mov eax, dword [0x5bda40]
xor eax, ebp
mov dword [ebp - 0x30], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x320], 0
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x1c]
call fcn.00410610
mov byte [ebp - 4], 9
cmp dword [ebp + 0x44], 1
jne 0x44dda9
mov eax, dword [ebp + 0x4c]
push eax
mov ecx, dword [ebp + 0x48]
push ecx
call fcn.0044c030
add esp, 8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xa
jne 0x44dc74
mov dword [ebp - 0x2b8], 0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1c]
call fcn.004072c0
mov byte [ebp - 4], 7
lea ecx, [ebp + 0xc]
call fcn.004072c0
mov byte [ebp - 4], 6
lea ecx, [ebp + 0x10]
call fcn.004072c0
mov byte [ebp - 4], 5
lea ecx, [ebp + 0x18]
call fcn.004072c0
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x1c]
call fcn.004072c0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x20]
call fcn.004072c0
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x24]
call fcn.004072c0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x28]
call fcn.004072c0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x3c]
call fcn.004072c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x54]
call fcn.004072c0
mov eax, dword [ebp - 0x2b8]
jmp 0x44e63c
cmp dword [ebp - 0x2c], 1
je 0x44dc84
cmp dword [ebp - 0x2c], 3
jne 0x44dd19
mov dword [ebp - 0x2bc], 1
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1c]
call fcn.004072c0
mov byte [ebp - 4], 7
lea ecx, [ebp + 0xc]
call fcn.004072c0
mov byte [ebp - 4], 6
lea ecx, [ebp + 0x10]
call fcn.004072c0
mov byte [ebp - 4], 5
lea ecx, [ebp + 0x18]
call fcn.004072c0
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x1c]
call fcn.004072c0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x20]
call fcn.004072c0
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x24]
call fcn.004072c0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x28]
call fcn.004072c0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x3c]
call fcn.004072c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x54]
call fcn.004072c0
mov eax, dword [ebp - 0x2bc]
jmp 0x44e63c
mov dword [ebp - 0x2c0], 0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1c]
call fcn.004072c0
mov byte [ebp - 4], 7
lea ecx, [ebp + 0xc]
call fcn.004072c0
mov byte [ebp - 4], 6
lea ecx, [ebp + 0x10]
call fcn.004072c0
mov byte [ebp - 4], 5
lea ecx, [ebp + 0x18]
call fcn.004072c0
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x1c]
call fcn.004072c0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x20]
call fcn.004072c0
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x24]
call fcn.004072c0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x28]
call fcn.004072c0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x3c]
call fcn.004072c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x54]
call fcn.004072c0
mov eax, dword [ebp - 0x2c0]
jmp 0x44e63c
push 0x26
lea edx, [ebp - 0x2c4]
push edx
call fcn.0044c830
add esp, 8
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x328], eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x328]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00406980
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2c4]
call fcn.004072c0
push 0
push 0x2e
lea ecx, [ebp + 0x18]
call fcn.00410310
push eax
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp + 0x18]
call fcn.00406cd0
mov byte [ebp - 4], 0xb
push 0x5957d4
lea ecx, [ebp - 0x1c]
call fcn.00406a60
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00406a40
push ecx
mov ecx, esp
mov dword [ebp - 0x2c8], esp
lea edx, [ebp - 0x1c]
push edx
call fcn.004068e0
mov dword [ebp - 0x32c], eax
call fcn.0044c7a0
add esp, 4
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0
jne 0x44de64
push 0
lea ecx, [ebp - 0x1c]
call fcn.004072e0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push 0x5957d8
lea ecx, [ebp - 0x1c]
call fcn.00406a60
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x28]
call fcn.004068e0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x28]
push ecx
call fcn.0044ebe0
add esp, 4
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x18]
call fcn.004068e0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x24]
call fcn.00410610
mov byte [ebp - 4], 0xe
push 0x10
lea eax, [ebp - 0x2cc]
push eax
call fcn.004fac60
add esp, 8
mov dword [ebp - 0x334], eax
mov ecx, dword [ebp - 0x334]
mov dword [ebp - 0x338], ecx
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x338]
push edx
lea ecx, [ebp - 0x24]
call fcn.00406980
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2cc]
call fcn.004072c0
lea eax, [ebp - 0x28]
push eax
push 0x5957dc
lea ecx, [ebp - 0x2d0]
push ecx
call fcn.00406ef0
add esp, 0xc
mov dword [ebp - 0x33c], eax
mov edx, dword [ebp - 0x33c]
mov dword [ebp - 0x340], edx
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x340]
push eax
lea ecx, [ebp - 0x24]
call fcn.00406a40
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2d0]
call fcn.004072c0
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x2d4]
push eax
call fcn.00406d90
add esp, 0xc
mov dword [ebp - 0x344], eax
mov ecx, dword [ebp - 0x344]
mov dword [ebp - 0x348], ecx
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x348]
push edx
lea ecx, [ebp - 0x28]
call fcn.00406980
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2d4]
call fcn.004072c0
push ecx
mov ecx, esp
mov dword [ebp - 0x2d8], esp
lea eax, [ebp - 0x28]
push eax
call fcn.004068e0
mov dword [ebp - 0x34c], eax
mov ecx, dword [ebp - 0x34c]
mov dword [ebp - 0x350], ecx
mov byte [ebp - 4], 0x12
push ecx
mov ecx, esp
mov dword [ebp - 0x2dc], esp
lea edx, [ebp + 0xc]
push edx
call fcn.004068e0
mov dword [ebp - 0x354], eax
mov byte [ebp - 4], 0xe
call fcn.0044e790
add esp, 8
push ecx
mov ecx, esp
mov dword [ebp - 0x2e0], esp
lea eax, [ebp - 0x28]
push eax
call fcn.004068e0
mov dword [ebp - 0x358], eax
call fcn.0050ba00
add esp, 4
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0
jne 0x44e0c4
mov dword [ebp - 0x2e4], 1
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x24]
call fcn.004072c0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x18]
call fcn.004072c0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x28]
call fcn.004072c0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x10]
call fcn.004072c0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1c]
call fcn.004072c0
mov byte [ebp - 4], 7
lea ecx, [ebp + 0xc]
call fcn.004072c0
mov byte [ebp - 4], 6
lea ecx, [ebp + 0x10]
call fcn.004072c0
mov byte [ebp - 4], 5
lea ecx, [ebp + 0x18]
call fcn.004072c0
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x1c]
call fcn.004072c0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x20]
call fcn.004072c0
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x24]
call fcn.004072c0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x28]
call fcn.004072c0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x3c]
call fcn.004072c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x54]
call fcn.004072c0
mov eax, dword [ebp - 0x2e4]
jmp 0x44e63c
cmp dword [ebp + 0x14], 0
je 0x44e24d
push ecx
mov ecx, esp
mov dword [ebp - 0x2ec], esp
lea edx, [ebp - 0x28]
push edx
call fcn.004068e0
mov dword [ebp - 0x360], eax
lea eax, [ebp - 0x2f0]
push eax
call fcn.0045d980
add esp, 8
mov dword [ebp - 0x364], eax
mov ecx, dword [ebp - 0x364]
mov dword [ebp - 0x368], ecx
mov edx, dword [ebp - 0x320]
or edx, 1
mov dword [ebp - 0x320], edx
mov eax, dword [ebp - 0x368]
push eax
lea ecx, [ebp + 0x10]
push ecx
call fcn.00406fc0
add esp, 8
movzx edx, al
test edx, edx
je 0x44e14b
lea ecx, [ebp + 0x10]
call fcn.004070f0
movzx eax, al
test eax, eax
jne 0x44e14b
mov dword [ebp - 0x36c], 1
jmp 0x44e155
mov dword [ebp - 0x36c], 0
mov cl, byte [ebp - 0x36c]
mov byte [ebp - 0x2e5], cl
mov edx, dword [ebp - 0x320]
and edx, 1
je 0x44e17e
and dword [ebp - 0x320], 0xfffffffe
lea ecx, [ebp - 0x2f0]
call fcn.004072c0
movzx eax, byte [ebp - 0x2e5]
test eax, eax
je 0x44e24d
mov dword [ebp - 0x2f4], 1
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x24]
call fcn.004072c0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x18]
call fcn.004072c0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x28]
call fcn.004072c0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x10]
call fcn.004072c0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1c]
call fcn.004072c0
mov byte [ebp - 4], 7
lea ecx, [ebp + 0xc]
call fcn.004072c0
mov byte [ebp - 4], 6
lea ecx, [ebp + 0x10]
call fcn.004072c0
mov byte [ebp - 4], 5
lea ecx, [ebp + 0x18]
call fcn.004072c0
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x1c]
call fcn.004072c0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x20]
call fcn.004072c0
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x24]
call fcn.004072c0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x28]
call fcn.004072c0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x3c]
call fcn.004072c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x54]
call fcn.004072c0
mov eax, dword [ebp - 0x2f4]
jmp 0x44e63c
lea ecx, [ebp - 0x20]
call fcn.00410610
mov byte [ebp - 4], 0x13
push 4
lea ecx, [ebp - 0x2fc]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00406c40
mov dword [ebp - 0x370], eax
push 0x5957e0
mov edx, dword [ebp - 0x370]
push edx
call fcn.0042beb0
add esp, 8
mov byte [ebp - 0x2f5], al
lea ecx, [ebp - 0x2fc]
call fcn.004072c0
movzx eax, byte [ebp - 0x2f5]
test eax, eax
je 0x44e2fb
lea ecx, [ebp - 0x274]
call fcn.004f74a0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x274]
call fcn.004f7500
lea ecx, [ebp - 0x28]
call fcn.004072e0
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 0x5957ec
lea edx, [ebp - 0x20]
push edx
call fcn.004089d0
add esp, 0x10
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x274]
call fcn.004f74d0
jmp 0x44e307
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x20]
call fcn.00406980
lea ecx, [ebp + 0x20]
call fcn.004070f0
movzx ecx, al
test ecx, ecx
jne 0x44e361
lea edx, [ebp + 0x20]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x300]
push ecx
call fcn.00406d90
add esp, 0xc
mov dword [ebp - 0x374], eax
mov edx, dword [ebp - 0x374]
mov dword [ebp - 0x378], edx
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x378]
push eax
lea ecx, [ebp + 0x20]
call fcn.00406980
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x300]
call fcn.004072c0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 0x50], 0
je 0x44e3e4
mov byte [ebp - 0x275], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x304], esp
lea edx, [ebp + 0x54]
push edx
call fcn.004068e0
mov dword [ebp - 0x37c], eax
call fcn.004fb340
add esp, 4
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0
je 0x44e3ab
mov byte [ebp - 0x275], 1
movzx eax, byte [ebp - 0x275]
test eax, eax
je 0x44e3e4
push 0
lea ecx, [ebp - 0x24]
call fcn.004072e0
push eax
lea ecx, [ebp - 0x20]
call fcn.004072e0
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
push 0x5957f8
lea ecx, [ebp + 0x28]
call fcn.004069a0
mov dword [ebp + 0x34], 0
push 0x5957fc
lea ecx, [ebp + 0x28]
push ecx
call fcn.0042beb0
add esp, 8
movzx edx, al
test edx, edx
je 0x44e478
mov eax, dword [ebp + 0x40]
push eax
mov ecx, dword [ebp + 0x38]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x308], esp
lea edx, [ebp + 0x20]
push edx
call fcn.004068e0
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x388], eax
mov byte [ebp - 4], 0x16
push ecx
mov ecx, esp
mov dword [ebp - 0x30c], esp
lea edx, [ebp + 0x1c]
push edx
call fcn.004068e0
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x390], eax
mov byte [ebp - 4], 0x17
push ecx
mov ecx, esp
mov dword [ebp - 0x310], esp
lea edx, [ebp - 0x20]
push edx
call fcn.004068e0
mov dword [ebp - 0x394], eax
mov byte [ebp - 4], 0x13
call fcn.0044ec70
add esp, 0x14
cmp dword [ebp + 0x34], 0
je 0x44e51b
mov eax, dword [ebp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x2b4], 0x3c
mov dword [ebp - 0x2b0], 0x40
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2a8], 0
lea ecx, [ebp - 0x20]
call fcn.004072e0
mov dword [ebp - 0x2a4], eax
lea ecx, [ebp + 0x24]
call fcn.004072e0
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x29c], 0
mov dword [ebp - 0x298], 5
mov dword [ebp - 0x294], 0
lea ecx, [ebp - 0x2b4]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x44e51b
mov edx, dword [ebp + 0x30]
push edx
mov eax, dword [ebp - 0x27c]
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x27c]
mov dword [ecx], edx
lea ecx, [ebp + 0x3c]
call fcn.004070f0
movzx eax, al
test eax, eax
jne 0x44e576
push ecx
mov ecx, esp
mov dword [ebp - 0x314], esp
lea edx, [ebp + 0x3c]
push edx
call fcn.004068e0
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 4], 0x18
push ecx
mov ecx, esp
mov dword [ebp - 0x318], esp
lea edx, [ebp - 0x20]
push edx
call fcn.004068e0
mov dword [ebp - 0x3a0], eax
mov byte [ebp - 4], 0x13
call fcn.0044e660
add esp, 8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x31c], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x20]
call fcn.004072c0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x24]
call fcn.004072c0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x18]
call fcn.004072c0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x28]
call fcn.004072c0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x10]
call fcn.004072c0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1c]
call fcn.004072c0
mov byte [ebp - 4], 7
lea ecx, [ebp + 0xc]
call fcn.004072c0
mov byte [ebp - 4], 6
lea ecx, [ebp + 0x10]
call fcn.004072c0
mov byte [ebp - 4], 5
lea ecx, [ebp + 0x18]
call fcn.004072c0
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x1c]
call fcn.004072c0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x20]
call fcn.004072c0
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x24]
call fcn.004072c0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x28]
call fcn.004072c0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x3c]
call fcn.004072c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x54]
call fcn.004072c0
mov eax, dword [ebp - 0x31c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.00538a54
mov esp, ebp
pop ebp
ret