Function at 0x5f96fc
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x5f99da
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 1
mov eax, dword [ebx + 0x3c8]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x5f9906
inc edi
xor esi, esi
mov edx, esi
mov eax, dword [ebx + 0x3c8]
call fcn.004474e0
cmp byte [eax + 0x14], 0
je 0x5f98fe
mov edx, esi
mov eax, dword [ebx + 0x3c8]
call fcn.004474e0
mov eax, dword [eax]
push eax
mov edx, esi
mov eax, dword [ebx + 0x3c8]
call fcn.004474e0
mov edx, dword [eax + 0xc]
lea eax, [ebp - 4]
pop ecx
call fcn.00407e78
mov edx, esi
mov eax, dword [ebx + 0x3c8]
call fcn.004474e0
mov eax, dword [eax]
push eax
mov edx, esi
mov eax, dword [ebx + 0x3c8]
call fcn.004474e0
mov edx, dword [eax + 8]
lea eax, [ebp - 8]
pop ecx
call fcn.00407e78
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.00420d54
test al, al
je 0x5f98fe
cmp byte [ebx + 0x3cd], 0
je 0x5f984b
lea edx, [ebp - 0x18]
mov eax, dword [0x616da8]
mov eax, dword [eax]
call fcn.00525b6c
mov eax, dword [ebp - 0x18]
call fcn.005f91f0
cmp byte [0x61db6c], 0
je 0x5f97ea
lea eax, [ebp - 8]
mov edx, 0x5f99f4
call fcn.00407e20
push dword [ebp - 8]
push 0x5f9a1c
push dword [ebx + 0x3b4]
push 0x5f9a38
lea eax, [ebp - 8]
mov edx, 4
call fcn.00407f00
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.005f8bd8
push 1
push 0
push 0x5f9a3c
lea eax, [ebp - 0x1c]
mov ecx, dword [ebx + 0x3c0]
mov edx, dword [ebx + 0x3b4]
call fcn.00407e78
mov eax, dword [ebp - 0x1c]
call fcn.00407c1c
push eax
push 0x5f9a44
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x5f99b2
mov eax, dword [ebp - 4]
call fcn.005f9154
test al, al
je 0x5f985f
mov eax, dword [ebp - 4]
call fcn.005f91f0
push 0
mov eax, dword [ebp - 4]
call fcn.00407c1c
push eax
mov eax, dword [ebp - 8]
call fcn.00407c1c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x5f9897
mov eax, dword [ebp - 8]
call fcn.0042132c
test al, al
jne 0x5f989b
mov eax, dword [ebp - 8]
call fcn.00407c1c
call fcn.005f9198
jmp 0x5f989b
mov byte [ebp - 0x11], 0
mov edx, esi
mov eax, dword [ebx + 0x3c8]
call fcn.004474e0
mov eax, dword [eax + 4]
lea edx, [ebp - 4]
call fcn.005d986c
mov edx, esi
mov eax, dword [ebx + 0x3c8]
call fcn.004474e0
mov edx, dword [eax + 8]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
call fcn.00407e78
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0042169c
mov eax, dword [ebp - 0x20]
mov edx, 0x5f9a5c
call fcn.00407fb0
jne 0x5f98fe
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00420d54
test al, al
je 0x5f98fe
mov eax, dword [ebp - 4]
call fcn.0042132c
inc esi
dec edi
jne 0x5f9735
cmp byte [ebp - 0x11], 0
je 0x5f9952
lea eax, [ebp - 4]
mov ecx, dword [ebx + 0x3c0]
mov edx, dword [ebx + 0x3b4]
call fcn.00407e78
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00420d54
test al, al
je 0x5f99b2
push 5
push 0
push 0x5f9a3c
mov eax, dword [ebp - 4]
call fcn.00407c1c
push eax
push 0x5f9a44
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x5f99b2
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x5f9a74
mov edx, 0x5f9b14
mov eax, 0x5f9b38
call fcn.005f90a8
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x5f9b5c
mov edx, 0x5f9b5c
mov eax, 0x5f9b74
call fcn.005f90a8
push 4
mov eax, dword [ebp - 0x10]
call fcn.00407c1c
push eax
mov eax, dword [ebp - 0xc]
call fcn.00407c1c
push eax
mov eax, ebx
call fcn.0049b6d4
push eax
call sub.user32.dll_MessageBoxW
cmp eax, 6
jne 0x5f99b2
mov eax, 0x5f9b98
call fcn.005f8cc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f99e1
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00406ee4
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00406ee4
ret