Function at 0x42eec0
Capabilities:
Copy file
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x492c81
mov eax, dword fs:[0]
push eax
sub esp, 0xef0
mov eax, dword [0x4b0650]
xor eax, esp
mov dword [esp + 0xeec], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b0650]
xor eax, esp
push eax
lea eax, [esp + 0xf04]
mov dword fs:[0], eax
xor ebp, ebp
lea eax, [esp + 0x148]
push ebp
push eax
call fcn.00436020
add esp, 8
cmp dword [esp + 0x15c], ebp
mov dword [esp + 0xf0c], ebp
jne 0x42ef41
cmp dword [esp + 0x160], 0x10
jb 0x42f945
mov ecx, dword [esp + 0x14c]
push ecx
call fcn.00460238
add esp, 4
jmp 0x42f945
lea edx, [esp + 0xd8]
push ebp
push edx
call fcn.00435f70
add esp, 8
cmp dword [esp + 0xec], ebp
mov byte [esp + 0xf0c], 1
jne 0x42efa4
mov esi, 0x10
cmp dword [esp + 0xf0], esi
jb 0x42ef81
mov eax, dword [esp + 0xdc]
push eax
call fcn.00460238
add esp, 4
cmp dword [esp + 0x160], esi
mov dword [esp + 0xf0], 0xf
mov dword [esp + 0xec], ebp
mov byte [esp + 0xdc], 0
jmp 0x42ef26
push str.dlcore.dll
lea edx, [esp + 0x14c]
push edx
lea eax, [esp + 0x134]
push eax
call fcn.00409e90
push str._tnproxy.dll
lea ecx, [esp + 0x158]
push ecx
lea edx, [esp + 0x1b0]
push edx
mov byte [esp + 0xf24], 2
call fcn.00409e90
push str.extract.dll
lea eax, [esp + 0x164]
push eax
lea ecx, [esp + 0x1a0]
push ecx
mov byte [esp + 0xf30], 3
call fcn.00409e90
add esp, 0x24
mov eax, dword [esp + 0xdc]
mov ebx, 0x10
cmp dword [esp + 0xf0], ebx
mov byte [esp + 0xf0c], 4
jae 0x42f029
lea eax, [esp + 0xdc]
push eax
lea ecx, [esp + 0x22c]
call fcn.00430d10
xor eax, eax
lea edx, [esp + 0xef8]
push edx
lea ecx, [esp + 0x22c]
mov byte [esp + 0xf10], 5
mov word [esp + 0xefc], bp
mov dword [esp + 0xefe], eax
mov word [esp + 0xf02], ax
call fcn.004308f0
movzx esi, word [esp + 0xefc]
push ebp
mov edi, 0xf
push 0x49a44b
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebp
mov byte [esp + 0x24], 0
call fcn.00404950
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0xf8]
push ecx
mov byte [esp + 0xf14], 6
call fcn.004358b0
add esp, 8
cmp dword [esp + 0x30], ebx
mov byte [esp + 0xf0c], 8
jb 0x42f0cc
mov edx, dword [esp + 0x1c]
push edx
call fcn.00460238
add esp, 4
cmp dword [esp + 0x108], ebp
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x1c], 0
jne 0x42f207
cmp dword [esp + 0x10c], ebx
jb 0x42f0ff
mov eax, dword [esp + 0xf8]
push eax
call fcn.00460238
add esp, 4
lea ecx, [esp + 0x228]
mov dword [esp + 0x10c], edi
mov dword [esp + 0x108], ebp
mov byte [esp + 0xf8], 0
mov byte [esp + 0xf0c], 4
call fcn.00430960
cmp dword [esp + 0x198], ebx
jb 0x42f142
mov ecx, dword [esp + 0x184]
push ecx
call fcn.00460238
add esp, 4
cmp dword [esp + 0x1b4], ebx
mov dword [esp + 0x198], edi
mov dword [esp + 0x194], ebp
mov byte [esp + 0x184], 0
jb 0x42f171
mov edx, dword [esp + 0x1a0]
push edx
call fcn.00460238
add esp, 4
cmp dword [esp + 0x144], ebx
mov dword [esp + 0x1b4], edi
mov dword [esp + 0x1b0], ebp
mov byte [esp + 0x1a0], 0
jb 0x42f1a0
mov eax, dword [esp + 0x130]
push eax
call fcn.00460238
add esp, 4
cmp dword [esp + 0xf0], ebx
mov dword [esp + 0x144], edi
mov dword [esp + 0x140], ebp
mov byte [esp + 0x130], 0
jb 0x42f1cf
mov ecx, dword [esp + 0xdc]
push ecx
call fcn.00460238
add esp, 4
cmp dword [esp + 0x160], ebx
mov dword [esp + 0xf0], edi
mov dword [esp + 0xec], ebp
mov byte [esp + 0xdc], 0
jb 0x42f945
mov edx, dword [esp + 0x14c]
push edx
call fcn.00460238
add esp, 4
jmp 0x42f945
lea eax, [esp + 0xf4]
push esi
push eax
call fcn.0042ea90
add esp, 8
test al, al
je 0x42f8e9
push 1
push 3
lea ecx, [esp + 0x58]
call fcn.00407f40
push esi
push 0x49a4f0
lea ecx, [esp + 0xfc]
push ecx
lea edx, [esp + 0x64]
mov bl, 9
push edx
mov byte [esp + 0xf1c], bl
call fcn.00407be0
add esp, 8
push eax
call fcn.00425cc0
add esp, 8
mov ecx, eax
call fcn.0042d840
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x54]
call fcn.00405650
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x100]
mov byte [esp + 0xf18], 0xa
call fcn.00404870
lea ecx, [esp + 0x34]
mov byte [esp + 0xf0c], bl
call fcn.0041e990
lea ecx, [esp + 0xf4]
push ecx
call fcn.004352a0
add esp, 4
test al, al
jne 0x42f2bb
lea edx, [esp + 0xf4]
push edx
call fcn.00435400
add esp, 4
push str.Tencentdl.exe
lea eax, [esp + 0xf8]
push eax
lea ecx, [esp + 0x118]
push ecx
call fcn.00409e90
push str.dlcore.dll
lea edx, [esp + 0x104]
push edx
lea eax, [esp + 0x178]
push eax
mov byte [esp + 0xf24], 0xb
call fcn.00409e90
push str._tnproxy.dll
lea ecx, [esp + 0x110]
push ecx
lea edx, [esp + 0x22c]
push edx
mov byte [esp + 0xf30], 0xc
call fcn.00409e90
push str.extract.dll
lea eax, [esp + 0x11c]
push eax
lea ecx, [esp + 0x21c]
push ecx
mov byte [esp + 0xf3c], 0xd
call fcn.00409e90
add esp, 0x30
cmp dword [esp + 0x128], 0x10
mov ecx, dword [esp + 0x114]
mov byte [esp + 0xf0c], 0xe
jae 0x42f35e
lea ecx, [esp + 0x114]
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, 0x10
cmp dword [esp + 0xf0], esi
jb 0x42f390
mov eax, dword [esp + 0xdc]
cmp eax, ebp
je 0x42f399
cmp ecx, ebp
je 0x42f399
push ebp
push ecx
push eax
call edi
cmp eax, 1
sete byte [esp + 0x16]
jmp 0x42f39e
lea eax, [esp + 0xdc]
jmp 0x42f37d
mov byte [esp + 0x16], 0
cmp dword [esp + 0x17c], esi
mov dl, byte [esp + 0x16]
mov eax, dword [esp + 0x168]
mov byte [esp + 0x17], dl
mov bl, 1
jae 0x42f3bf
lea eax, [esp + 0x168]
push eax
call fcn.00412dd0
add esp, 4
test al, al
je 0x42f4ca
cmp dword [esp + 0x144], esi
mov eax, dword [esp + 0x130]
jae 0x42f3e7
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x66c]
call fcn.00430d10
xor eax, eax
mov dword [esp + 0xef2], eax
mov word [esp + 0xef6], ax
lea eax, [esp + 0xef0]
push eax
lea ecx, [esp + 0x66c]
mov byte [esp + 0xf10], 0xf
mov word [esp + 0xef4], bp
call fcn.004308f0
cmp dword [esp + 0x17c], 0x10
movzx esi, word [esp + 0xef4]
mov eax, dword [esp + 0x168]
jae 0x42f449
lea eax, [esp + 0x168]
push eax
lea ecx, [esp + 0xaac]
call fcn.00430d10
lea ecx, [esp + 0xee8]
xor eax, eax
push ecx
lea ecx, [esp + 0xaac]
mov byte [esp + 0xf10], 0x10
mov word [esp + 0xeec], bp
mov dword [esp + 0xeee], eax
mov word [esp + 0xef2], ax
call fcn.004308f0
movzx eax, word [esp + 0xeec]
cmp esi, eax
jae 0x42f499
xor bl, bl
lea ecx, [esp + 0xaa8]
mov byte [esp + 0xf0c], 0xf
call fcn.00430960
lea ecx, [esp + 0x668]
mov byte [esp + 0xf0c], 0xe
call fcn.00430960
test bl, bl
mov esi, 0x10
je 0x42f502
cmp dword [esp + 0x17c], esi
mov ecx, dword [esp + 0x168]
jae 0x42f4e1
lea ecx, [esp + 0x168]
cmp dword [esp + 0x144], esi
jb 0x42f6e5
mov eax, dword [esp + 0x130]
cmp eax, ebp
je 0x42f502
cmp ecx, ebp
je 0x42f502
push ebp
push ecx
push eax
call edi
cmp dword [esp + 0x224], esi
mov ecx, dword [esp + 0x210]
jae 0x42f519
lea ecx, [esp + 0x210]
cmp dword [esp + 0x1b4], esi
jb 0x42f6f1
mov eax, dword [esp + 0x1a0]
cmp eax, ebp
je 0x42f53a
cmp ecx, ebp
je 0x42f53a
push ebp
push ecx
push eax
call edi
cmp dword [esp + 0x208], esi
mov ecx, dword [esp + 0x1f4]
jae 0x42f551
lea ecx, [esp + 0x1f4]
cmp dword [esp + 0x198], esi
jb 0x42f6fd
mov eax, dword [esp + 0x184]
cmp eax, ebp
je 0x42f572
cmp ecx, ebp
je 0x42f572
push ebp
push ecx
push eax
call edi
lea edx, [esp + 0x1d4]
xor esi, esi
push edx
mov dword [esp + 0xef4], esi
call fcn.0042d640
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0x3c]
mov bl, 0x11
push ecx
mov byte [esp + 0xf18], bl
call fcn.00434bd0
add esp, 0xc
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x11c]
mov byte [esp + 0xf18], 0x12
call fcn.00404870
lea ecx, [esp + 0x34]
mov byte [esp + 0xf0c], bl
call fcn.0041e990
cmp dword [esp + 0x1e8], ebp
lea edi, [esi + 0x10]
je 0x42f63f
cmp dword [esp + 0x1ec], edi
mov eax, dword [esp + 0x1d8]
jae 0x42f5f1
lea eax, [esp + 0x1d8]
push eax
call fcn.00412dd0
add esp, 4
test al, al
je 0x42f63f
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x1d8]
push eax
call fcn.004133f0
add esp, 8
test al, al
je 0x42f63f
cmp dword [esp + 0x1ec], edi
mov eax, dword [esp + 0x1d8]
jae 0x42f631
lea eax, [esp + 0x1d8]
push 0x49b6c0
push eax
call fcn.004312a0
add esp, 8
cmp dword [esp + 0x128], edi
mov eax, dword [esp + 0x114]
jae 0x42f656
lea eax, [esp + 0x114]
push eax
call fcn.00412dd0
add esp, 4
test al, al
je 0x42f693
cmp dword [esp + 0x128], edi
mov eax, dword [esp + 0x114]
jae 0x42f67a
lea eax, [esp + 0x114]
push ebp
push ebp
push str.__RegServer
push eax
push ebp
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
mov dword [esp + 0xef0], esi
push str.Installlog.txt
lea ecx, [esp + 0xf8]
push ecx
lea edx, [esp + 0x1c0]
push edx
call fcn.00409e90
add esp, 0xc
cmp byte [esp + 0x16], 0
mov byte [esp + 0xf0c], 0x13
je 0x42f76b
cmp esi, 0x20
jle 0x42f76b
cmp dword [esp + 0x1d0], edi
jb 0x42f709
mov eax, dword [esp + 0x1bc]
mov dword [esp + 0xee8], eax
jmp 0x42f717
lea eax, [esp + 0x130]
jmp 0x42f4f9
lea eax, [esp + 0x1a0]
jmp 0x42f531
lea eax, [esp + 0x184]
jmp 0x42f569
lea ecx, [esp + 0x1bc]
mov dword [esp + 0xee8], ecx
lea edx, [esp + 0xee8]
push edx
call fcn.0042ee50
mov esi, eax
add esp, 4
mov ecx, esi
call fcn.0042e080
mov ecx, dword [esi]
push str.Install_OK__from
call fcn.0042dbb0
mov ecx, dword [esi]
lea eax, [esp + 0xd8]
push eax
call fcn.0042d9a0
mov ecx, dword [esi]
push str.__to
call fcn.0042dbb0
lea ecx, [esp + 0x110]
push ecx
mov ecx, dword [esi]
call fcn.0042d9a0
jmp 0x42f863
cmp dword [esp + 0x1d0], edi
jb 0x42f784
mov eax, dword [esp + 0x1bc]
mov dword [esp + 0xee8], eax
jmp 0x42f792
lea ecx, [esp + 0x1bc]
mov dword [esp + 0xee8], ecx
lea edx, [esp + 0xee8]
push edx
call fcn.0042ee50
mov esi, eax
add esp, 4
mov ecx, esi
call fcn.0042e080
mov ecx, dword [esi]
push str.Install_Failed__from
call fcn.0042dbb0
mov ecx, dword [esi]
lea eax, [esp + 0xd8]
push eax
call fcn.0042d9a0
mov ecx, dword [esi]
push str.__to
call fcn.0042dbb0
lea ecx, [esp + 0x110]
push ecx
mov ecx, dword [esi]
call fcn.0042d9a0
movzx edx, byte [0x4b2c11]
push edx
mov ecx, esi
call fcn.0042e780
cmp dword [esp + 0x1d0], edi
jb 0x42f809
mov eax, dword [esp + 0x1bc]
mov dword [esp + 0xee8], eax
jmp 0x42f817
lea ecx, [esp + 0x1bc]
mov dword [esp + 0xee8], ecx
lea edx, [esp + 0xee8]
push edx
call fcn.0042ee50
mov esi, eax
add esp, 4
mov ecx, esi
call fcn.0042e080
mov ecx, dword [esi]
push str.copy
call fcn.0042dbb0
mov ecx, dword [esi]
lea eax, [esp + 0x17]
push eax
call fcn.0042e2e0
mov ecx, dword [esi]
push str.__Reg
call fcn.0042dbb0
lea ecx, [esp + 0xef0]
push ecx
mov ecx, dword [esi]
call fcn.0042e4e0
movzx edx, byte [0x4b2c11]
push edx
mov ecx, esi
call fcn.0042e780
lea ecx, [esp + 0x1b8]
call fcn.0041e990
lea ecx, [esp + 0x1d4]
call fcn.0041e990
lea ecx, [esp + 0x1f0]
call fcn.0041e990
lea ecx, [esp + 0x20c]
call fcn.0041e990
lea ecx, [esp + 0x164]
call fcn.0041e990
lea ecx, [esp + 0x110]
call fcn.0041e990
lea ecx, [esp + 0xa4]
mov byte [esp + 0xf0c], 8
call fcn.004034d0
lea eax, [esp + 0xa4]
push eax
mov dword [esp + 0xa8], 0x49a288
call fcn.0047bad2
add esp, 4
lea ecx, [esp + 0xf4]
call fcn.0041e990
lea ecx, [esp + 0x228]
mov byte [esp + 0xf0c], 4
call fcn.00430960
lea ecx, [esp + 0x180]
call fcn.0041e990
lea ecx, [esp + 0x19c]
call fcn.0041e990
lea ecx, [esp + 0x12c]
call fcn.0041e990
lea ecx, [esp + 0xd8]
call fcn.0041e990
lea ecx, [esp + 0x148]
call fcn.0041e990
mov ecx, dword [esp + 0xf04]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xeec]
xor ecx, esp
call fcn.004601ff
add esp, 0xefc
ret