Function at 0x41d270
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5241b2
mov eax, dword fs:[0]
push eax
sub esp, 0xbf0
mov eax, dword [0x57594c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
call fcn.00425770
add esp, 4
cmp dword [ebp + 8], 3
jge 0x41d2b9
call fcn.0041d240
xor eax, eax
jmp 0x41d711
lea eax, [ebp - 0xa48]
push eax
call fcn.004271a0
add esp, 4
mov dword [ebp - 4], 0
push 0
push 0x23
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0xa48]
call fcn.00424dc0
test eax, eax
je 0x41d639
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0xa30]
call fcn.004067b0
mov byte [ebp - 4], 1
push 0x547220
lea ecx, [ebp - 0xa30]
call fcn.0040e3b0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb5c], esp
push ecx
call fcn.00427420
add esp, 4
mov dword [ebp - 0xb40], eax
lea edx, [ebp - 0xb84]
push edx
call fcn.004276f0
add esp, 0x1c
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp - 0xb0c]
mov dword [ebp - 0xb08], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xb08]
push ecx
lea ecx, [ebp - 0xa30]
call fcn.00408350
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xb84]
call fcn.004068e0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb44], esp
lea edx, [ebp - 0xa30]
push edx
call fcn.00406900
mov dword [ebp - 0xb4c], eax
call fcn.00431440
add esp, 0x18
mov byte [ebp - 0xaf5], al
movzx eax, byte [ebp - 0xaf5]
test eax, eax
jne 0x41d62a
lea ecx, [ebp - 0xbcc]
push ecx
lea ecx, [ebp - 0xa30]
call fcn.00424a30
mov dword [ebp - 0xb10], eax
mov edx, dword [ebp - 0xb10]
mov dword [ebp - 0xb28], edx
mov byte [ebp - 4], 3
lea eax, [ebp - 0xb9c]
push eax
call fcn.00427420
add esp, 4
mov dword [ebp - 0xb18], eax
mov ecx, dword [ebp - 0xb18]
mov dword [ebp - 0xb20], ecx
mov byte [ebp - 4], 4
lea edx, [ebp - 0xbe4]
push edx
mov ecx, dword [ebp - 0xb20]
call fcn.00424a30
mov dword [ebp - 0xb30], eax
push 1
mov ecx, dword [ebp - 0xb28]
call fcn.00409770
push eax
mov ecx, dword [ebp - 0xb30]
call fcn.00409770
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0xb38], eax
lea ecx, [ebp - 0xbe4]
call fcn.00406d30
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xb9c]
call fcn.004068e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xbcc]
call fcn.00406d30
cmp dword [ebp - 0xb38], 0
je 0x41d62a
mov dword [ebp - 0xae4], 0x44
push 0x40
push 0
lea eax, [ebp - 0xae0]
push eax
call fcn.004bfe20
add esp, 0xc
mov dword [ebp - 0xaf4], 0
xor ecx, ecx
mov dword [ebp - 0xaf0], ecx
mov dword [ebp - 0xaec], ecx
mov dword [ebp - 0xae8], ecx
xor edx, edx
mov word [ebp - 0xa18], dx
push 0x7fe
push 0
lea eax, [ebp - 0xa16]
push eax
call fcn.004bfe20
add esp, 0xc
lea ecx, [ebp - 0xbfc]
push ecx
lea ecx, [ebp - 0xa30]
call fcn.00424a30
mov dword [ebp - 0xb2c], eax
mov ecx, dword [ebp - 0xb2c]
call fcn.00409770
push eax
push 0x547224
lea edx, [ebp - 0xa18]
push edx
call fcn.00419930
add esp, 0xc
lea ecx, [ebp - 0xbfc]
call fcn.00406d30
mov dword [ebp - 0xafc], 1
jmp 0x41d535
mov eax, dword [ebp - 0xafc]
add eax, 1
mov dword [ebp - 0xafc], eax
mov ecx, dword [ebp - 0xafc]
cmp ecx, dword [ebp + 8]
jge 0x41d5c7
push 0x547230
lea edx, [ebp - 0xa18]
push edx
call fcn.004198d0
add esp, 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb3c], esp
mov eax, dword [ebp - 0xafc]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + eax*4]
push eax
call fcn.00406b80
mov dword [ebp - 0xb64], eax
lea ecx, [ebp - 0xbb4]
push ecx
call fcn.0041dc50
add esp, 0x1c
mov dword [ebp - 0xb00], eax
mov edx, dword [ebp - 0xb00]
mov dword [ebp - 0xb24], edx
mov ecx, dword [ebp - 0xb24]
call fcn.00409770
push eax
lea eax, [ebp - 0xa18]
push eax
call fcn.004198d0
add esp, 8
lea ecx, [ebp - 0xbb4]
call fcn.00406d30
jmp 0x41d526
lea ecx, [ebp - 0xaf4]
push ecx
lea edx, [ebp - 0xae4]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xa18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41d62a
mov dword [ebp - 0xb14], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa30]
call fcn.004068e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa48]
call fcn.004068e0
mov eax, dword [ebp - 0xb14]
jmp 0x41d711
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa30]
call fcn.004068e0
push 0x58
lea ecx, [ebp - 0xaa0]
call fcn.004093b0
mov ecx, 4
shl ecx, 1
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0xb6c], esp
sub esp, 0x18
mov edi, esp
mov dword [ebp - 0xb58], esp
sub esp, 0x18
mov edx, esp
mov dword [ebp - 0xb54], esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + ecx]
push ecx
mov ecx, edx
call fcn.00406b80
mov dword [ebp - 0xb48], eax
push edi
call fcn.0041dc50
add esp, 0x1c
mov dword [ebp - 0xb34], eax
mov edx, dword [ebp - 0xb34]
mov dword [ebp - 0xb68], edx
mov ecx, esi
call fcn.004067d0
mov dword [ebp - 0xb1c], eax
mov eax, dword [ebp - 0xb1c]
mov dword [ebp - 0xb50], eax
lea ecx, [ebp - 0xaa0]
call fcn.004113b0
mov dword [ebp - 0xb60], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0xaa0]
call fcn.00428ad0
mov eax, dword [ebp - 0xa6c]
mov dword [ebp - 0xb04], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xaa0]
call fcn.00411480
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa48]
call fcn.004068e0
mov eax, dword [ebp - 0xb04]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b8d48
mov esp, ebp
pop ebp
ret