Function at 0x401000
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x523]
mov byte [ebp - 0x524], bl
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x524]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x72b]
mov byte [ebp - 0x72c], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x406048]
pop ecx
mov dword [ebp - 0x420], eax
xor eax, eax
lea edi, [ebp - 0x41c]
push 0x40
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x113]
mov byte [ebp - 0x114], bl
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
mov dword [ebp - 0x10], esi
push eax
push 0x65
push dword [ebp + 8]
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x72c]
push eax
lea eax, [ebp - 0x524]
push ebx
push eax
lea eax, [ebp - 0x114]
push eax
push 1
call sub.VERSION.dll_VerFindFileA
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x31b]
mov byte [ebp - 0x31c], bl
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x31c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, ebx
jle 0x4010f4
cmp byte [ebp + eax - 0x31c], 0x5c
je 0x4010f4
dec eax
jmp 0x4010e3
push 0x40
mov byte [ebp + eax - 0x31c], bl
pop ecx
xor eax, eax
lea edi, [ebp - 0x82f]
mov byte [ebp - 0x830], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x72c]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
call sub.VERSION.dll_VerInstallFileA
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x218]
push 0x406044
push eax
call edi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x218]
push eax
call edi
cmp dword [ebp - 0xc], ebx
je 0x4011cf
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x628]
push 0x406044
push eax
call edi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x628]
push eax
call edi
lea eax, [ebp - 0x218]
push ebx
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
je 0x4011f2
push str.DllRegisterServer
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4011f2
call eax
lea eax, [ebp - 0x114]
push esi
push eax
push 0x66
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x218]
push 0x406044
push eax
call edi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x218]
push eax
call edi
push 1
push ebx
lea eax, [ebp - 0x218]
push ebx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10