Function at 0x427520
Capabilities:
Copy file
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x484781
mov eax, dword fs:[0]
push eax
sub esp, 0xef0
mov eax, dword [0x49e058]
xor eax, esp
mov dword [esp + 0xeec], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49e058]
xor eax, esp
push eax
lea eax, [esp + 0xf04]
mov dword fs:[0], eax
xor ebp, ebp
lea eax, [esp + 0x148]
push ebp
push eax
call fcn.0042e210
add esp, 8
cmp dword [esp + 0x15c], ebp
mov dword [esp + 0xf0c], ebp
jne 0x4275a1
cmp dword [esp + 0x160], 0x10
jb 0x427fa5
mov ecx, dword [esp + 0x14c]
push ecx
call fcn.0044d7d9
add esp, 4
jmp 0x427fa5
lea edx, [esp + 0xd8]
push ebp
push edx
call fcn.0042e160
add esp, 8
cmp dword [esp + 0xec], ebp
mov byte [esp + 0xf0c], 1
jne 0x427604
mov esi, 0x10
cmp dword [esp + 0xf0], esi
jb 0x4275e1
mov eax, dword [esp + 0xdc]
push eax
call fcn.0044d7d9
add esp, 4
cmp dword [esp + 0x160], esi
mov dword [esp + 0xf0], 0xf
mov dword [esp + 0xec], ebp
mov byte [esp + 0xdc], 0
jmp 0x427586
push str.dlcore.dll
lea edx, [esp + 0x14c]
push edx
lea eax, [esp + 0x134]
push eax
call fcn.00411dd0
push str._tnproxy.dll
lea ecx, [esp + 0x158]
push ecx
lea edx, [esp + 0x1b0]
push edx
mov byte [esp + 0xf24], 2
call fcn.00411dd0
push str.extract.dll
lea eax, [esp + 0x164]
push eax
lea ecx, [esp + 0x1a0]
push ecx
mov byte [esp + 0xf30], 3
call fcn.00411dd0
add esp, 0x24
mov eax, dword [esp + 0xdc]
mov ebx, 0x10
cmp dword [esp + 0xf0], ebx
mov byte [esp + 0xf0c], 4
jae 0x427689
lea eax, [esp + 0xdc]
push eax
lea ecx, [esp + 0x22c]
call fcn.00429380
xor eax, eax
lea edx, [esp + 0xef8]
push edx
lea ecx, [esp + 0x22c]
mov byte [esp + 0xf10], 5
mov word [esp + 0xefc], bp
mov dword [esp + 0xefe], eax
mov word [esp + 0xf02], ax
call fcn.00428f60
movzx esi, word [esp + 0xefc]
push ebp
mov edi, 0xf
push 0x48b16b
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebp
mov byte [esp + 0x24], 0
call fcn.004049b0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0xf8]
push ecx
mov byte [esp + 0xf14], 6
call fcn.0042dcd0
add esp, 8
cmp dword [esp + 0x30], ebx
mov byte [esp + 0xf0c], 8
jb 0x42772c
mov edx, dword [esp + 0x1c]
push edx
call fcn.0044d7d9
add esp, 4
cmp dword [esp + 0x108], ebp
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x1c], 0
jne 0x427867
cmp dword [esp + 0x10c], ebx
jb 0x42775f
mov eax, dword [esp + 0xf8]
push eax
call fcn.0044d7d9
add esp, 4
lea ecx, [esp + 0x228]
mov dword [esp + 0x10c], edi
mov dword [esp + 0x108], ebp
mov byte [esp + 0xf8], 0
mov byte [esp + 0xf0c], 4
call fcn.00428fd0
cmp dword [esp + 0x198], ebx
jb 0x4277a2
mov ecx, dword [esp + 0x184]
push ecx
call fcn.0044d7d9
add esp, 4
cmp dword [esp + 0x1b4], ebx
mov dword [esp + 0x198], edi
mov dword [esp + 0x194], ebp
mov byte [esp + 0x184], 0
jb 0x4277d1
mov edx, dword [esp + 0x1a0]
push edx
call fcn.0044d7d9
add esp, 4
cmp dword [esp + 0x144], ebx
mov dword [esp + 0x1b4], edi
mov dword [esp + 0x1b0], ebp
mov byte [esp + 0x1a0], 0
jb 0x427800
mov eax, dword [esp + 0x130]
push eax
call fcn.0044d7d9
add esp, 4
cmp dword [esp + 0xf0], ebx
mov dword [esp + 0x144], edi
mov dword [esp + 0x140], ebp
mov byte [esp + 0x130], 0
jb 0x42782f
mov ecx, dword [esp + 0xdc]
push ecx
call fcn.0044d7d9
add esp, 4
cmp dword [esp + 0x160], ebx
mov dword [esp + 0xf0], edi
mov dword [esp + 0xec], ebp
mov byte [esp + 0xdc], 0
jb 0x427fa5
mov edx, dword [esp + 0x14c]
push edx
call fcn.0044d7d9
add esp, 4
jmp 0x427fa5
lea eax, [esp + 0xf4]
push esi
push eax
call fcn.004270f0
add esp, 8
test al, al
je 0x427f49
push 1
push 3
lea ecx, [esp + 0x58]
call fcn.00407ff0
push esi
push 0x48bc24
lea ecx, [esp + 0xfc]
push ecx
lea edx, [esp + 0x64]
mov bl, 9
push edx
mov byte [esp + 0xf1c], bl
call fcn.00407c90
add esp, 8
push eax
call fcn.00425df0
add esp, 8
mov ecx, eax
call fcn.00425c90
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x54]
call fcn.00405700
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x100]
mov byte [esp + 0xf18], 0xa
call fcn.004048d0
lea ecx, [esp + 0x34]
mov byte [esp + 0xf0c], bl
call fcn.0041ce20
lea ecx, [esp + 0xf4]
push ecx
call fcn.0042d6c0
add esp, 4
test al, al
jne 0x42791b
lea edx, [esp + 0xf4]
push edx
call fcn.0042d820
add esp, 4
push str.Tencentdl.exe
lea eax, [esp + 0xf8]
push eax
lea ecx, [esp + 0x118]
push ecx
call fcn.00411dd0
push str.dlcore.dll
lea edx, [esp + 0x104]
push edx
lea eax, [esp + 0x178]
push eax
mov byte [esp + 0xf24], 0xb
call fcn.00411dd0
push str._tnproxy.dll
lea ecx, [esp + 0x110]
push ecx
lea edx, [esp + 0x22c]
push edx
mov byte [esp + 0xf30], 0xc
call fcn.00411dd0
push str.extract.dll
lea eax, [esp + 0x11c]
push eax
lea ecx, [esp + 0x21c]
push ecx
mov byte [esp + 0xf3c], 0xd
call fcn.00411dd0
add esp, 0x30
cmp dword [esp + 0x128], 0x10
mov ecx, dword [esp + 0x114]
mov byte [esp + 0xf0c], 0xe
jae 0x4279be
lea ecx, [esp + 0x114]
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, 0x10
cmp dword [esp + 0xf0], esi
jb 0x4279f0
mov eax, dword [esp + 0xdc]
cmp eax, ebp
je 0x4279f9
cmp ecx, ebp
je 0x4279f9
push ebp
push ecx
push eax
call edi
cmp eax, 1
sete byte [esp + 0x16]
jmp 0x4279fe
lea eax, [esp + 0xdc]
jmp 0x4279dd
mov byte [esp + 0x16], 0
cmp dword [esp + 0x17c], esi
mov dl, byte [esp + 0x16]
mov eax, dword [esp + 0x168]
mov byte [esp + 0x17], dl
mov bl, 1
jae 0x427a1f
lea eax, [esp + 0x168]
push eax
call fcn.00411710
add esp, 4
test al, al
je 0x427b2a
cmp dword [esp + 0x144], esi
mov eax, dword [esp + 0x130]
jae 0x427a47
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x66c]
call fcn.00429380
xor eax, eax
mov dword [esp + 0xef2], eax
mov word [esp + 0xef6], ax
lea eax, [esp + 0xef0]
push eax
lea ecx, [esp + 0x66c]
mov byte [esp + 0xf10], 0xf
mov word [esp + 0xef4], bp
call fcn.00428f60
cmp dword [esp + 0x17c], 0x10
movzx esi, word [esp + 0xef4]
mov eax, dword [esp + 0x168]
jae 0x427aa9
lea eax, [esp + 0x168]
push eax
lea ecx, [esp + 0xaac]
call fcn.00429380
lea ecx, [esp + 0xee8]
xor eax, eax
push ecx
lea ecx, [esp + 0xaac]
mov byte [esp + 0xf10], 0x10
mov word [esp + 0xeec], bp
mov dword [esp + 0xeee], eax
mov word [esp + 0xef2], ax
call fcn.00428f60
movzx eax, word [esp + 0xeec]
cmp esi, eax
jae 0x427af9
xor bl, bl
lea ecx, [esp + 0xaa8]
mov byte [esp + 0xf0c], 0xf
call fcn.00428fd0
lea ecx, [esp + 0x668]
mov byte [esp + 0xf0c], 0xe
call fcn.00428fd0
test bl, bl
mov esi, 0x10
je 0x427b62
cmp dword [esp + 0x17c], esi
mov ecx, dword [esp + 0x168]
jae 0x427b41
lea ecx, [esp + 0x168]
cmp dword [esp + 0x144], esi
jb 0x427d45
mov eax, dword [esp + 0x130]
cmp eax, ebp
je 0x427b62
cmp ecx, ebp
je 0x427b62
push ebp
push ecx
push eax
call edi
cmp dword [esp + 0x224], esi
mov ecx, dword [esp + 0x210]
jae 0x427b79
lea ecx, [esp + 0x210]
cmp dword [esp + 0x1b4], esi
jb 0x427d51
mov eax, dword [esp + 0x1a0]
cmp eax, ebp
je 0x427b9a
cmp ecx, ebp
je 0x427b9a
push ebp
push ecx
push eax
call edi
cmp dword [esp + 0x208], esi
mov ecx, dword [esp + 0x1f4]
jae 0x427bb1
lea ecx, [esp + 0x1f4]
cmp dword [esp + 0x198], esi
jb 0x427d5d
mov eax, dword [esp + 0x184]
cmp eax, ebp
je 0x427bd2
cmp ecx, ebp
je 0x427bd2
push ebp
push ecx
push eax
call edi
lea edx, [esp + 0x1d4]
xor esi, esi
push edx
mov dword [esp + 0xef4], esi
call fcn.00425a90
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0x3c]
mov bl, 0x11
push ecx
mov byte [esp + 0xf18], bl
call fcn.0042d250
add esp, 0xc
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x11c]
mov byte [esp + 0xf18], 0x12
call fcn.004048d0
lea ecx, [esp + 0x34]
mov byte [esp + 0xf0c], bl
call fcn.0041ce20
cmp dword [esp + 0x1e8], ebp
lea edi, [esi + 0x10]
je 0x427c9f
cmp dword [esp + 0x1ec], edi
mov eax, dword [esp + 0x1d8]
jae 0x427c51
lea eax, [esp + 0x1d8]
push eax
call fcn.00411710
add esp, 4
test al, al
je 0x427c9f
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x1d8]
push eax
call fcn.00411c80
add esp, 8
test al, al
je 0x427c9f
cmp dword [esp + 0x1ec], edi
mov eax, dword [esp + 0x1d8]
jae 0x427c91
lea eax, [esp + 0x1d8]
push 0x48c178
push eax
call fcn.00429910
add esp, 8
cmp dword [esp + 0x128], edi
mov eax, dword [esp + 0x114]
jae 0x427cb6
lea eax, [esp + 0x114]
push eax
call fcn.00411710
add esp, 4
test al, al
je 0x427cf3
cmp dword [esp + 0x128], edi
mov eax, dword [esp + 0x114]
jae 0x427cda
lea eax, [esp + 0x114]
push ebp
push ebp
push str.__RegServer
push eax
push ebp
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
mov dword [esp + 0xef0], esi
push str.Installlog.txt
lea ecx, [esp + 0xf8]
push ecx
lea edx, [esp + 0x1c0]
push edx
call fcn.00411dd0
add esp, 0xc
cmp byte [esp + 0x16], 0
mov byte [esp + 0xf0c], 0x13
je 0x427dcb
cmp esi, 0x20
jle 0x427dcb
cmp dword [esp + 0x1d0], edi
jb 0x427d69
mov eax, dword [esp + 0x1bc]
mov dword [esp + 0xee8], eax
jmp 0x427d77
lea eax, [esp + 0x130]
jmp 0x427b59
lea eax, [esp + 0x1a0]
jmp 0x427b91
lea eax, [esp + 0x184]
jmp 0x427bc9
lea ecx, [esp + 0x1bc]
mov dword [esp + 0xee8], ecx
lea edx, [esp + 0xee8]
push edx
call fcn.004274b0
mov esi, eax
add esp, 4
mov ecx, esi
call fcn.004266e0
mov ecx, dword [esi]
push str.Install_OK__from
call fcn.00426210
mov ecx, dword [esi]
lea eax, [esp + 0xd8]
push eax
call fcn.00426000
mov ecx, dword [esi]
push str.__to
call fcn.00426210
lea ecx, [esp + 0x110]
push ecx
mov ecx, dword [esi]
call fcn.00426000
jmp 0x427ec3
cmp dword [esp + 0x1d0], edi
jb 0x427de4
mov eax, dword [esp + 0x1bc]
mov dword [esp + 0xee8], eax
jmp 0x427df2
lea ecx, [esp + 0x1bc]
mov dword [esp + 0xee8], ecx
lea edx, [esp + 0xee8]
push edx
call fcn.004274b0
mov esi, eax
add esp, 4
mov ecx, esi
call fcn.004266e0
mov ecx, dword [esi]
push str.Install_Failed__from
call fcn.00426210
mov ecx, dword [esi]
lea eax, [esp + 0xd8]
push eax
call fcn.00426000
mov ecx, dword [esi]
push str.__to
call fcn.00426210
lea ecx, [esp + 0x110]
push ecx
mov ecx, dword [esi]
call fcn.00426000
movzx edx, byte [0x4a0840]
push edx
mov ecx, esi
call fcn.00426de0
cmp dword [esp + 0x1d0], edi
jb 0x427e69
mov eax, dword [esp + 0x1bc]
mov dword [esp + 0xee8], eax
jmp 0x427e77
lea ecx, [esp + 0x1bc]
mov dword [esp + 0xee8], ecx
lea edx, [esp + 0xee8]
push edx
call fcn.004274b0
mov esi, eax
add esp, 4
mov ecx, esi
call fcn.004266e0
mov ecx, dword [esi]
push str.copy
call fcn.00426210
mov ecx, dword [esi]
lea eax, [esp + 0x17]
push eax
call fcn.00426940
mov ecx, dword [esi]
push str.__Reg
call fcn.00426210
lea ecx, [esp + 0xef0]
push ecx
mov ecx, dword [esi]
call fcn.00426b40
movzx edx, byte [0x4a0840]
push edx
mov ecx, esi
call fcn.00426de0
lea ecx, [esp + 0x1b8]
call fcn.0041ce20
lea ecx, [esp + 0x1d4]
call fcn.0041ce20
lea ecx, [esp + 0x1f0]
call fcn.0041ce20
lea ecx, [esp + 0x20c]
call fcn.0041ce20
lea ecx, [esp + 0x164]
call fcn.0041ce20
lea ecx, [esp + 0x110]
call fcn.0041ce20
lea ecx, [esp + 0xa4]
mov byte [esp + 0xf0c], 8
call fcn.00403580
lea eax, [esp + 0xa4]
push eax
mov dword [esp + 0xa8], 0x48afa8
call fcn.0046df42
add esp, 4
lea ecx, [esp + 0xf4]
call fcn.0041ce20
lea ecx, [esp + 0x228]
mov byte [esp + 0xf0c], 4
call fcn.00428fd0
lea ecx, [esp + 0x180]
call fcn.0041ce20
lea ecx, [esp + 0x19c]
call fcn.0041ce20
lea ecx, [esp + 0x12c]
call fcn.0041ce20
lea ecx, [esp + 0xd8]
call fcn.0041ce20
lea ecx, [esp + 0x148]
call fcn.0041ce20
mov ecx, dword [esp + 0xf04]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xeec]
xor ecx, esp
call fcn.0044d7a0
add esp, 0xefc
ret