Function at 0x431b6e
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c4ef8
mov eax, dword fs:[0]
push eax
mov eax, 0x1ba0
call fcn.00506f00
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea esi, [ebx + 0x1258]
push esi
call fcn.0042f36d
mov edi, eax
mov dword [esp], 0x5f1030
push edi
push edi
push 0x10
mov ecx, ebx
mov dword [ebp - 0x1b44], edi
mov dword [ebp - 0x1b48], edx
call fcn.00434e8f
mov eax, dword [ebx + 0x2434]
cmp dword [eax - 0xc], 0
je 0x431cae
push 0x1508
lea eax, [ebp - 0x1b2c]
push 0
push eax
call fcn.0056b050
lea eax, [ebp - 0x1b2c]
push eax
push esi
call fcn.0042ed78
add esp, 0x14
test eax, eax
je 0x431c20
push dword [ebx + 0x2434]
lea eax, [ebp - 0xca8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x431cae
push esi
call fcn.00434add
cmp dword [ebx + 0x2358], 1
pop ecx
jg 0x431c3e
push 0x5f1104
push edi
push edi
push 0x20
jmp 0x4321b6
push ecx
lea esi, [ebx + 0x218]
mov ecx, esp
push esi
call fcn.00413f09
mov ecx, 0x6822b8
call fcn.00434a47
push 0x5f113c
push edi
push 0
push 2
mov ecx, ebx
call fcn.00434e8f
lea eax, [ebx + 0x2258]
push eax
push dword [ebx + 0x214]
lea eax, [ebx + 0x235c]
sub esp, 0xe4
mov ecx, esp
push eax
call fcn.0042cb10
lea eax, [ebx + 0x1a58]
mov ecx, 0x6822b8
push eax
lea eax, [ebx + 0x1258]
push eax
lea eax, [ebx + 0x258]
push eax
push esi
call fcn.00430de7
jmp 0x4321bd
cmp dword [ebx + 0x2414], 1
jne 0x431dbd
sub esp, 0xe4
lea eax, [ebx + 0x235c]
mov ecx, esp
push eax
call fcn.0042cb10
mov ecx, ebx
call fcn.00431026
test al, al
je 0x431dbd
push 0x5f1188
push edi
push edi
push 0x10
mov ecx, ebx
call fcn.00434e8f
call fcn.0041279d
push eax
lea ecx, [ebp - 0x1b30]
call fcn.00411d94
push dword [ebx + 0x2388]
and dword [ebp - 4], 0
lea eax, [ebp - 0x1b30]
push 0x5f119c
push eax
call fcn.00412690
mov esi, dword [ebp - 0x1b30]
add esp, 0xc
push esi
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push dword [ebx + 0x2388]
mov dword [ebp - 0x1b34], eax
lea eax, [ebp - 0x620]
push eax
mov dword [ebp - 0x624], 0x7ec
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x4a
pop ecx
lea eax, [ebp - 0x624]
mov dword [ebp - 0x1b50], ecx
mov dword [ebp - 0x1b48], eax
lea eax, [ebp - 0x1b50]
push eax
push 0
push ecx
push dword [ebx + 0x208]
mov dword [ebp - 0x1b4c], 0x204
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x1b34]
test eax, eax
je 0x431dab
push 0x1d4c0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x1b34]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00412ac4
lea esi, [ebx + 0x1258]
push 0x5f1200
push edi
push edi
push 8
mov ecx, ebx
call fcn.00434e8f
cmp dword [ebx + 0x2440], 0
jne 0x4321ad
push ecx
mov ecx, esp
push esi
call fcn.00413f09
lea eax, [ebp - 0x1b34]
mov ecx, ebx
push eax
call fcn.0042fde7
mov eax, dword [ebx + 0x2404]
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
cmp eax, ecx
jne 0x431ffc
cmp dword [ebx + 0x2400], ecx
jne 0x431ffc
call fcn.0041279d
push eax
lea ecx, [ebp - 0x1b40]
call fcn.00411d94
mov eax, dword [ebx + 0x2380]
sub eax, 0x10
mov byte [ebp - 4], 2
push eax
call fcn.00412393
mov edi, eax
pop ecx
mov dword [ebp - 0x1b54], edi
lea ecx, [edi + 0x10]
mov dword [ebp - 0x1b94], ecx
mov byte [ebp - 4], 3
call fcn.0041279d
push eax
lea ecx, [ebp - 0x1b30]
call fcn.00411d94
lea ecx, [ebp - 0x1bac]
mov byte [ebp - 4], 4
call fcn.0042ca82
mov byte [ebp - 4], 5
call fcn.00430f47
test eax, eax
je 0x431ee6
mov eax, dword [ebx + 0x23a0]
cmp dword [eax - 0xc], 0
je 0x431ee6
push ecx
mov esi, esp
mov dword [ebp - 0x1b3c], esp
push edi
mov dword [ebp - 0x1b38], esi
call fcn.00412393
add eax, 0x10
mov dword [esi], eax
mov edi, esp
mov byte [ebp - 4], 6
push ecx
mov esi, esp
mov dword [ebp - 0x1b48], esi
mov eax, dword [ebx + 0x23a0]
sub eax, 0x10
push eax
call fcn.00412393
pop ecx
add eax, 0x10
push edi
mov dword [esi], eax
call fcn.004303cc
pop ecx
pop ecx
lea eax, [ebp - 0x1b38]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x1bac]
call fcn.00434114
mov byte [ebp - 4], 7
jmp 0x431f46
push ecx
mov esi, esp
mov dword [ebp - 0x1b48], esp
push edi
mov dword [ebp - 0x1b3c], esi
call fcn.00412393
add eax, 0x10
mov dword [esi], eax
mov edi, esp
mov byte [ebp - 4], 8
push ecx
mov esi, esp
mov dword [ebp - 0x1b3c], esi
mov eax, dword [ebx + 0x239c]
sub eax, 0x10
push eax
call fcn.00412393
pop ecx
add eax, 0x10
push edi
mov dword [esi], eax
call fcn.004303cc
pop ecx
pop ecx
lea eax, [ebp - 0x1b38]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x1bac]
call fcn.00434114
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x1b30]
call fcn.00411f3a
mov ecx, dword [ebp - 0x1b38]
add ecx, 0xfffffff0
mov byte [ebp - 4], 5
call fcn.00412ac4
mov esi, dword [ebp - 0x1b30]
lea eax, [ebx + 0x1258]
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x431fb7
push ecx
mov edi, esp
push dword [ebp - 0x1b54]
mov dword [ebp - 0x1b48], edi
call fcn.00412393
pop ecx
add eax, 0x10
mov ecx, ebx
mov dword [edi], eax
call fcn.004317c3
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
lea eax, [ebx + 0x1258]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0x1bac]
call fcn.0042e60b
mov ecx, dword [ebp - 0x1b9c]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [esi - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x1b54]
call fcn.00412ac4
mov ecx, dword [ebp - 0x1b40]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov edi, dword [ebp - 0x1b44]
jmp 0x43219b
cmp eax, 4
je 0x43219b
cmp eax, 2
je 0x432144
cmp eax, 3
je 0x432144
push 0x3c
lea eax, [ebp - 0x1b90]
push 0
push eax
call fcn.0056b050
mov eax, dword [ebp - 0x1b34]
add esp, 0xc
mov ecx, dword [ebx + 0x23b4]
and dword [ebp - 0x1b88], 0
test ecx, ecx
mov dword [ebp - 0x1b84], eax
mov eax, dword [ebp - 0x1b7c]
cmovne eax, ecx
mov dword [ebp - 0x1b90], 0x3c
mov dword [ebp - 0x1b7c], eax
lea eax, [ebp - 0x1b90]
push eax
mov dword [ebp - 0x1b80], esi
mov dword [ebp - 0x1b74], 1
mov dword [ebp - 0x1b8c], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [ebx + 0x23b0]
cmp dword [eax - 0xc], 0
jne 0x4320a1
mov eax, dword [ebx + 0x23ac]
cmp dword [eax - 0xc], 0
je 0x432134
push dword [ebp - 0x1b58]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov esi, eax
push esi
call fcn.0042f83b
pop ecx
push eax
push esi
push ecx
lea edx, [ebx + 0x218]
mov ecx, esp
push edx
call fcn.00413f09
mov ecx, ebx
call fcn.004350b9
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0056b050
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0056b050
add esp, 0x18
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
mov ecx, ebx
push eax
push str.softmastergreen.dll
lea eax, [ebp - 0x218]
push eax
call fcn.00434ca5
lea eax, [ebp - 0x420]
push eax
push esi
call fcn.00502a0e
pop ecx
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0x1b58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x43219b
push 0x3c
lea eax, [ebp - 0x1b90]
push 0
push eax
call fcn.0056b050
mov eax, dword [ebp - 0x1b34]
add esp, 0xc
and dword [ebp - 0x1b88], 0
mov dword [ebp - 0x1b84], eax
lea eax, [ebp - 0x1b90]
mov dword [ebp - 0x1b90], 0x3c
push eax
mov dword [ebp - 0x1b80], esi
mov dword [ebp - 0x1b74], 1
mov dword [ebp - 0x1b8c], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 0x1b34]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 0x5f1330
push edi
push edi
push 9
mov ecx, ebx
call fcn.00434e8f
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00506d7f
mov esp, ebp
pop ebp
ret