Function at 0x4a4050
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x4f2ac3
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov dword [esp + 0x54], 0
mov edi, dword [esp + 0x60]
mov esi, dword [esp + 0x5c]
mov ebp, dword [sym.imp.mfc90.dll_Ordinal_2539]
push edi
push esi
lea eax, [esp + 0x1c]
push str._s__d
push eax
call ebp
mov ecx, dword [esp + 0x24]
push ecx
push str.CallAutoPatch___s_
push 8
call fcn.0043d500
push str._tmp_
lea edx, [esp + 0x7c]
push 0x103ad10
push edx
call fcn.00402a60
mov ebx, 1
mov byte [esp + 0x7c], bl
push str.tc_au.exe
push eax
lea eax, [esp + 0x48]
push eax
call fcn.00402a60
add esp, 0x34
mov byte [esp + 0x54], 3
lea ecx, [esp + 0x5c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x18]
push 0
push ecx
call dword [sym.imp.MSVCR90.dll__access]
add esp, 8
test eax, eax
jne 0x4a4144
push str._tc_au.exe
lea edx, [esp + 0x60]
push 0x103ad10
push edx
call fcn.00402a60
add esp, 0xc
mov byte [esp + 0x54], 4
mov eax, dword [eax]
push 0
push eax
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov byte [esp + 0x54], 3
lea ecx, [esp + 0x5c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
test esi, esi
je 0x4a4357
mov al, byte [esi + 1]
cmp al, 0x63
jne 0x4a41f9
mov eax, dword [0x1039f54]
test eax, 0x8000000
je 0x4a4185
cmp byte [0x1038f43], 0
jne 0x4a4185
mov ecx, dword [esp + 0x14]
push ecx
push str.CallAutoPatch_setconfig_TC_CARE_RESTARTONBOOT__s_
push 8
call fcn.0043d500
add esp, 0xc
jmp 0x4a441f
test edi, edi
je 0x4a41b9
test eax, 0x40000000
jne 0x4a41b9
mov edx, dword [esp + 0x14]
push edx
push str.CallAutoPatch_setconfig_Dont_EJECT_DLLs__s_
push 8
call fcn.0043d500
push ebx
push str.tc_ReEnv
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491ff0
add esp, 0x1c
mov eax, dword [0x10da2dc]
test eax, eax
je 0x4a41d4
mov eax, dword [eax + 0x20]
push 0x63
push ebx
push 0x13d4
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [esp + 0x14]
push ecx
push str.CallAutoPatch_setconfig__s_
push 8
mov byte [0x10da2b9], bl
mov byte [0x10d9863], bl
call fcn.0043d500
add esp, 0xc
jmp 0x4a441f
cmp al, 0x72
jne 0x4a425c
lea ecx, [esp + 0x5c]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x54], 5
push edi
push esi
lea edx, [esp + 0x64]
push str._s__d
push edx
call ebp
mov eax, dword [esp + 0x6c]
push eax
push str.CallAutoPatch_memory_over_1G__s_
push 8
call fcn.0043d500
add esp, 0x1c
test dword [0x1039f54], 0x8000000
je 0x4a4291
mov ecx, dword [esp + 0x5c]
push ecx
push str.CallAutoPatch_memory_over_1G_RESTARTONBOOT__s_
push 8
call fcn.0043d500
add esp, 0xc
mov byte [esp + 0x54], 3
lea ecx, [esp + 0x5c]
jmp 0x4a4419
cmp al, 0x62
jne 0x4a42c6
lea ecx, [esp + 0x5c]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x54], 6
push edi
push esi
lea eax, [esp + 0x64]
push str._s__d
push eax
call ebp
mov ecx, dword [esp + 0x6c]
push ecx
push str.recv_TC_SET_INIT_BACKUP___s_
push 8
call fcn.0043d500
add esp, 0x1c
mov eax, dword [0x10da2dc]
test eax, eax
je 0x4a42ac
mov edx, dword [eax + 0x20]
push 0x63
push ebx
push 0x13d4
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [0x10da2b9], bl
mov byte [0x10d9863], bl
mov byte [esp + 0x54], 3
lea ecx, [esp + 0x5c]
jmp 0x4a4419
cmp al, 0x68
jne 0x4a42f3
lea ecx, [esp + 0x5c]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x54], 7
push edi
push esi
lea eax, [esp + 0x64]
push str._s__d
push eax
call ebp
mov ecx, dword [esp + 0x6c]
push ecx
push str.CallAutoPatch_hang_polltime___s_
jmp 0x4a4287
cmp al, 0x78
jne 0x4a4357
lea ecx, [esp + 0x5c]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x54], 8
push edi
push esi
lea eax, [esp + 0x64]
push str._s__d
push eax
call ebp
mov ecx, dword [esp + 0x6c]
push ecx
push str.CallAutoPatch_hang_polltime_test__s_
push 8
call fcn.0043d500
mov eax, dword [0x10da2dc]
add esp, 0x1c
test eax, eax
je 0x4a4343
mov edx, dword [eax + 0x20]
push 0x63
push ebx
push 0x13d4
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [0x10da070], bl
mov byte [esp + 0x54], 3
lea ecx, [esp + 0x5c]
jmp 0x4a4419
lea eax, [esp + 0x1c]
push eax
call fcn.00465390
add esp, 4
mov byte [esp + 0x54], 9
push str.tc_au.exe
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov bl, 0xa
mov byte [esp + 0x54], bl
push eax
lea ecx, [esp + 0x60]
push 0x4ff418
push ecx
call fcn.00410070
add esp, 0xc
mov byte [esp + 0x54], 0xb
push eax
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0x54], bl
lea ecx, [esp + 0x5c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x54], 9
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov edx, dword [esp + 0x1c]
push 0
push 0
push esi
push edx
push str.open
push 0
call fcn.00464ac0
add esp, 0x18
push 0x28
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetProcessMemoryInfo
test esi, esi
jne 0x4a43f3
mov esi, 0x5116d8
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x1c]
shr ecx, 0xa
push ecx
push esi
push edx
push str.CallAutoPatch__s__s__Memory_Size_:__d_Kbytes_
push 8
call fcn.0043d500
add esp, 0x14
mov byte [esp + 0x54], 3
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x54], 0
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dword [esp + 0x54], 0xffffffff
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret