Function at 0x4a6e94
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xf
push 0
push 0
dec ecx
jne 0x4a6e9c
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4a740a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4a73c7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a741c
push 0
call sub.user32.dll_FindWindowA
mov edi, eax
push 0
push 0
push 0x10
push edi
call sub.user32.dll_SendMessageA
xor ebx, ebx
push 0x4a741c
push 0
call sub.user32.dll_FindWindowA
mov edi, eax
test edi, edi
jle 0x4a6f9d
inc ebx
push 0x64
call sub.kernel32.dll_Sleep_1
cmp ebx, 0x32
jle 0x4a6ee0
lea eax, [ebp - 0x24]
mov edx, 0x4a743c
call fcn.00404af4
mov eax, dword [esi + 0x324]
mov eax, dword [eax + 0x220]
call fcn.00416bd8
mov eax, dword [esi + 0x324]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [esi + 0x324]
mov eax, dword [eax + 0x220]
call fcn.00416c94
push 0x23
mov eax, dword [ebp - 0x24]
call fcn.00404f1c
mov edx, eax
mov ecx, 0x4a7470
mov eax, dword [0x4ac484]
mov eax, dword [eax]
call fcn.00459e88
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 6
jne 0x4a6f7f
xor ebx, ebx
push 0
push 0
push 0x10
push edi
call sub.user32.dll_SendMessageA
jmp 0x4a6ee0
cmp dword [ebp - 0x1c], 2
jne 0x4a6f96
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a73d5
xor ebx, ebx
jmp 0x4a6ee0
mov eax, dword [0x4ac67c]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4a7278
inc eax
mov dword [ebp - 0x2c], eax
xor ebx, ebx
lea ecx, [ebp - 0x38]
mov eax, dword [0x4ac67c]
mov eax, dword [eax]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.00408dd8
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00408b60
mov eax, dword [ebp - 0x30]
push eax
lea edx, [ebp - 0x3c]
mov eax, 0x4a748c
call fcn.00408b60
mov edx, dword [ebp - 0x3c]
pop eax
call fcn.00404e68
jne 0x4a702a
mov edx, dword [0x4ac170]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov ecx, 0x4a74a4
call fcn.00404d68
mov ecx, 0x4a74a4
mov edx, dword [0x4ac570]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
call fcn.00404d68
jmp 0x4a70f0
lea ecx, [ebp - 0x48]
mov eax, dword [0x4ac67c]
mov eax, dword [eax]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
call fcn.00408dd8
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.00408b60
mov eax, dword [ebp - 0x40]
push eax
lea edx, [ebp - 0x4c]
mov eax, 0x4a74b8
call fcn.00408b60
mov edx, dword [ebp - 0x4c]
pop eax
call fcn.00404e68
jne 0x4a70a8
lea ecx, [ebp - 0x50]
mov eax, dword [0x4ac67c]
mov eax, dword [eax]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x50]
mov edx, dword [0x4ac170]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
call fcn.00404d68
mov edx, dword [0x4ac570]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
mov ecx, 0x4a74d0
call fcn.00404d68
jmp 0x4a70f0
lea ecx, [ebp - 0x54]
mov eax, dword [0x4ac67c]
mov eax, dword [eax]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x54]
mov edx, dword [0x4ac170]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
call fcn.00404d68
lea ecx, [ebp - 0x58]
mov eax, dword [0x4ac67c]
mov eax, dword [eax]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x58]
mov edx, dword [0x4ac570]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
call fcn.00404d68
lea ecx, [ebp - 0x64]
mov eax, dword [0x4ac67c]
mov eax, dword [eax]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.00408dd8
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.00408b60
mov eax, dword [ebp - 0x5c]
push eax
mov eax, 0x4a74b8
lea edx, [ebp - 0x68]
call fcn.00408b60
mov edx, dword [ebp - 0x68]
pop eax
call fcn.00404e68
je 0x4a721b
mov eax, dword [ebp - 0x10]
call fcn.004095b8
test al, al
je 0x4a71e3
mov eax, dword [ebp - 0x10]
call fcn.004097d0
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
jne 0x4a71e3
push 0x4a74e8
push dword [ebp - 0x10]
push 0x4a74f8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404ddc
mov eax, dword [esi + 0x324]
mov eax, dword [eax + 0x220]
call fcn.00416bd8
mov eax, dword [esi + 0x324]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [esi + 0x324]
mov eax, dword [eax + 0x220]
call fcn.00416c94
push 0x25
mov eax, dword [ebp - 0xc]
call fcn.00404f1c
mov edx, eax
mov ecx, 0x4a7470
mov eax, dword [0x4ac484]
mov eax, dword [eax]
call fcn.00459e88
cmp eax, 2
jne 0x4a7147
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a73d5
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.00409904
mov eax, dword [ebp - 0x18]
call fcn.004095c8
test al, al
jne 0x4a7202
mov eax, dword [ebp - 0x18]
call fcn.004095ec
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404f1c
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404f1c
push eax
call sub.kernel32.dll_CopyFileA
push 0xffffffffffffffff
lea ecx, [ebp - 0x6c]
mov eax, dword [0x4ac67c]
mov eax, dword [eax]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x6c]
mov eax, dword [0x4ac1f4]
mov eax, dword [eax]
mov edx, 0x4a7530
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x70]
mov eax, dword [0x4ac67c]
mov eax, dword [eax]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x70]
mov eax, dword [0x4ac57c]
mov eax, dword [eax]
mov edx, 0x4a7530
mov edi, dword [eax]
call dword [edi + 0xc]
inc ebx
dec dword [ebp - 0x2c]
jne 0x4a6fb8
push 0xffffffffffffffff
mov eax, dword [0x4ac1f4]
mov eax, dword [eax]
mov ecx, 0x4a7540
mov edx, 0x4a7550
mov ebx, dword [eax]
call dword [ebx + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x4ac57c]
mov eax, dword [eax]
mov ecx, 0x4a7540
mov edx, 0x4a7550
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [0x4ac1f4]
mov eax, dword [eax]
mov ecx, 0x4a7560
mov edx, 0x4a7550
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [0x4ac570]
mov eax, dword [eax]
call fcn.00468378
push 0x4a7578
mov eax, 0x4a74a4
lea edx, [ebp - 0x74]
call fcn.00467cf8
push dword [ebp - 0x74]
push 0x4a759c
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 8]
call fcn.004090d0
push dword [ebp - 0x78]
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00404ddc
mov eax, dword [esi + 0x324]
mov eax, dword [eax + 0x220]
call fcn.00416bd8
mov eax, dword [esi + 0x324]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [esi + 0x324]
mov eax, dword [eax + 0x220]
call fcn.00416c94
push 0
mov eax, dword [ebp - 0x24]
call fcn.00404f1c
mov edx, eax
mov ecx, 0x4a7470
mov eax, dword [0x4ac484]
mov eax, dword [eax]
call fcn.00459e88
mov byte [ebp - 1], 1
mov byte [esi + 0x378], 1
cmp byte [esi + 0x3a0], 0
je 0x4a7399
lea eax, [ebp - 0x28]
mov edx, 0x4a74d0
call fcn.00404af4
push 5
push 0x4a75a0
push 0x4a75a0
mov eax, dword [ebp - 0x28]
call fcn.00404f1c
push eax
push 0x4a75a4
push 0
call sub.shell32.dll_ShellExecuteA
push 5
push 0x4a75a0
push 0x4a75a0
push 0x4a75ac
push 0x4a75a4
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, esi
call fcn.0045656c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a73d5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7411
lea eax, [ebp - 0x78]
mov edx, 0x13
call fcn.00404a80
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404a80
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00404a80
ret