Function at 0x4f23d8
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4f2705
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x3e8
call sub.kernel32.dll_Sleep
xor eax, eax
push ebp
push 0x4f26d1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004f1b2c
mov ecx, dword [ebp - 4]
mov eax, 0x5024d8
mov edx, 0x4f2720
call fcn.0040a924
lea eax, [ebp - 8]
call fcn.004f1f6c
mov edx, dword [ebp - 8]
mov eax, 0x5024cc
call fcn.0040a018
lea edx, [ebp - 0xc]
mov eax, 0x4f2740
call fcn.00429f48
push dword [ebp - 0xc]
push 0x4f2758
push dword [0x5024cc]
mov eax, 0x5024dc
mov edx, 3
call fcn.0040a9ac
mov dl, 1
mov eax, dword [0x5024dc]
call fcn.00421c14
test al, al
jne 0x4f248c
lea edx, [ebp - 0x10]
mov eax, dword [0x5024dc]
call fcn.0042841c
mov eax, dword [ebp - 0x10]
call fcn.00421cf4
push dword [0x5024dc]
push 0x4f2758
push dword [0x5024cc]
push 0x4f2768
mov eax, 0x5024dc
mov edx, 4
call fcn.0040a9ac
lea eax, [ebp - 0x18]
call fcn.004f23ac
mov eax, dword [ebp - 0x18]
call fcn.0040a6d4
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.0040a738
lea eax, [ebp - 0x14]
mov edx, 0x4f2780
call fcn.0040a8cc
mov eax, dword [ebp - 0x14]
mov dl, 1
call fcn.00421c14
test al, al
je 0x4f2528
mov dl, 1
mov eax, dword [0x5024dc]
call fcn.00421b7c
test al, al
jne 0x4f2528
push 0
mov eax, dword [0x5024dc]
call fcn.0040a6d4
push eax
lea eax, [ebp - 0x1c]
call fcn.004f23ac
lea eax, [ebp - 0x1c]
mov edx, 0x4f27a0
call fcn.0040a8cc
mov eax, dword [ebp - 0x1c]
call fcn.0040a6d4
push eax
call sub.kernel32.dll_CopyFileW
jmp 0x4f2558
push 0
mov eax, dword [0x5024dc]
call fcn.0040a6d4
push eax
lea eax, [ebp - 0x20]
call fcn.004f23ac
lea eax, [ebp - 0x20]
mov edx, 0x4f27d4
call fcn.0040a8cc
mov eax, dword [ebp - 0x20]
call fcn.0040a6d4
push eax
call sub.kernel32.dll_CopyFileW
push 0
push 0x10000000
push 0
push 0
push 0
mov eax, dword [0x5024d8]
call fcn.0040a6d4
push eax
call sub.user32.dll_CreateDesktopW
mov dword [0x5024d0], eax
mov eax, 0x502470
xor ecx, ecx
mov edx, 0x44
call fcn.00407778
mov dword [0x502470], 0x44
mov eax, dword [0x5024d8]
call fcn.0040a6d4
mov dword [0x502478], eax
push 0x5024b4
push 0x502470
push 0
push 0
push 0x24
push 0
push 0
push 0
push 0
mov eax, dword [0x5024dc]
call fcn.0040a6d4
push eax
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x4f26c4
xor eax, eax
push ebp
push 0x4f26b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5024bc]
push eax
push 0
push 0x1fffff
call sub.kernel32.dll_OpenProcess
mov dword [0x5024c4], eax
push 0x4f2808
push 0xa
mov ecx, dword [0x4ff634]
mov dl, 1
mov eax, dword [0x492d40]
call fcn.004b4588
mov dword [0x5024d4], eax
mov dl, 1
mov eax, dword [0x492a38]
call fcn.00407d04
mov dword [0x5024c8], eax
mov edx, dword [0x5024d4]
mov eax, dword [0x5024c8]
call fcn.004b42c4
push 0
push 0
mov eax, dword [0x5024c8]
call fcn.004b208c
mov eax, dword [0x5024c8]
mov edx, dword [eax + 4]
mov eax, dword [0x5024c4]
call fcn.00412bd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f26ba
mov eax, dword [0x5024b4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x5024c4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x5024b8]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x5024d0]
push eax
call sub.user32.dll_CloseDesktop
mov eax, dword [0x5024c8]
call fcn.00407d34
mov eax, dword [0x5024d4]
call fcn.00407d34
mov eax, dword [0x5024c8]
mov eax, dword [eax + 4]
call fcn.00406e48
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f2400