Function at 0x4127fa
Capabilities:
Check if file exists
Create process on windows
Create process suspended
Get file attributes
Move file

Disassembly:
mov eax, 0x604b76
call fcn.00465b38
sub esp, 0x968
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x34], esi
push dword [esi + 0x190]
lea edi, [esi + 0x190]
mov dword [ebp - 0x20], 1
call fcn.0040fd4a
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0041ce30
test eax, eax
je 0x4128b3
lea ecx, [ebp - 0x30]
call fcn.00410375
test eax, eax
je 0x412a57
push edi
lea ecx, [ebp - 0x14]
call fcn.005ecafe
push 0x66a230
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.005e21dc
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x38]
push eax
call fcn.005ecafe
push str._old
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call fcn.005ed182
push dword [ebp - 0x14]
call fcn.004101ab
mov edi, eax
pop ecx
cmp edi, ebx
je 0x412894
push dword [ebp - 0x14]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edi, eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.005ecd91
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.005ecd91
cmp edi, ebx
je 0x412a57
push 0x69dc58
lea ecx, [ebp - 0x10]
call fcn.005ece05
push 0xdd
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.005edf3b
mov edi, dword [ebp + 8]
push dword [ebp - 0x10]
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0xc]
mov ecx, esi
call fcn.00411391
test eax, eax
je 0x412a64
push 0xde
lea ecx, [ebp - 0x10]
call fcn.005edf3b
mov eax, dword [edi]
push dword [ebp - 0x10]
mov ecx, edi
call dword [eax + 0xc]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x3d2]
mov word [ebp - 0x3d4], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x3d4]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edi, [esi + 0x194]
lea eax, [ebp - 0x3d4]
push eax
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.005ecf28
push 5
pop eax
cmp dword [ebp + 0x14], eax
jne 0x412991
push dword [esi + 0x1b0]
lea edi, [esi + 0x1b0]
call fcn.00451f87
test eax, eax
pop ecx
je 0x4129b1
push dword [edi]
lea eax, [ebp + 0xc]
mov ecx, esi
mov dword [ebp + 0xc], ebx
push eax
call fcn.00414fbd
test eax, eax
je 0x4131fa
mov ecx, dword [ebp - 0x14]
push edi
call fcn.005eced8
mov dword [esi + 0x17c], 1
jmp 0x4129b1
cmp dword [ebp + 0x14], 8
je 0x412a71
cmp dword [esi + 0x1ac], ebx
je 0x412d22
push dword [ebp + 0xc]
mov ecx, edi
call fcn.005ecf28
mov ecx, esi
call fcn.004142e5
test eax, eax
je 0x4131fa
mov ecx, esi
call fcn.0041c515
cmp eax, ebx
je 0x4129d2
mov ecx, esi
call fcn.00415559
push 0xe0
lea ecx, [ebp - 0x10]
call fcn.005edf3b
mov ecx, dword [ebp + 8]
push dword [ebp - 0x10]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, esi
call fcn.004120e1
test eax, eax
je 0x4131fa
mov ecx, esi
call fcn.00412714
test eax, eax
je 0x4131d9
push 0xe1
lea ecx, [ebp - 0x10]
call fcn.005edf3b
call fcn.0043881a
mov ecx, 0x167
xor eax, eax
lea edi, [ebp - 0x970]
push 1
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x974]
push 0x5a0
push eax
mov dword [ebp - 0x974], 0x53430000
mov dword [ebp - 0x970], ebx
call fcn.00439a05
add esp, 0xc
mov dword [ebp - 0x20], ebx
jmp 0x4131fa
push 0x24
call fcn.004296ed
pop ecx
jmp 0x413205
push 0x11
call fcn.004296ed
pop ecx
jmp 0x4131fa
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x34]
add eax, 0x190
lea ecx, [ebp + 0xc]
push eax
xor esi, esi
mov dword [ebp + 0x10], eax
call fcn.005ecafe
push str.OeaViewer.exe
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 4
call fcn.005ed182
lea eax, [ebp + 0x18]
mov edi, str.OEAServer
push eax
push edi
mov dword [ebp + 0x18], ebx
call fcn.004da680
pop ecx
test eax, eax
pop ecx
je 0x412af3
cmp dword [ebp + 0x18], 4
jne 0x412af3
push edi
lea ecx, [ebp - 0xb4]
call fcn.004d9660
push 0x7530
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 5
call fcn.004d9e80
lea ecx, [ebp - 0xb4]
call fcn.004d9d40
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 4
call fcn.004d9b50
push 0xfffffffffffffffe
push dword [0x66b7a4]
call fcn.004b9fa0
push 0xfffffffffffffffe
push dword [0x66b7a8]
call fcn.004b9fa0
add esp, 0x10
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x30]
call fcn.0040ffa6
cmp eax, 1
je 0x412bb6
push ebx
call fcn.00403d84
pop ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x3c]
call fcn.004042c5
push dword [ebp + 0x10]
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 6
call fcn.005ecafe
push 0x66a230
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 7
call fcn.005e21dc
lea eax, [ebp + 0x14]
lea ecx, [ebp + 8]
push eax
call fcn.005ecafe
push str._old
lea ecx, [ebp + 8]
mov byte [ebp - 4], 8
call fcn.005ed182
push 1
push dword [ebp + 8]
call fcn.00429956
pop ecx
pop ecx
push dword [ebp + 8]
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 1
lea ecx, [ebp + 8]
pop esi
mov byte [ebp - 4], 7
call fcn.005ecd91
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 6
call fcn.005ecd91
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 4
call fcn.004042e8
mov ecx, dword [ebp - 0x34]
push ebx
call fcn.0041491d
test eax, eax
jne 0x412bcf
mov byte [ebp - 4], 3
lea ecx, [ebp + 0xc]
jmp 0x4131d2
mov eax, dword [ebp - 0x14]
push dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call fcn.00452001
pop ecx
test eax, eax
pop ecx
je 0x412bc3
mov ecx, dword [ebp - 0x34]
call fcn.004142e5
test eax, eax
je 0x412bc3
push 0x69dc58
lea ecx, [ebp + 8]
call fcn.005ece05
push dword [ebp + 0xc]
lea eax, [ebp + 8]
mov byte [ebp - 4], 9
push str.__s__StartOeaSrv
push eax
call fcn.005e20b1
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x98]
mov dword [ebp - 0x9c], ebx
push 0x10
mov dword [ebp - 0x44], ebx
pop ecx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x40]
lea ecx, [ebp + 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x9c]
push eax
push ebx
push ebx
push 0x4000410
push ebx
push ebx
push ebx
push 0x104
call fcn.005ed1d6
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x44]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x40]
call edi
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.005ed226
lea ecx, [ebp + 8]
mov byte [ebp - 4], 4
call fcn.005ecd91
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x1c], ebx
mov ecx, edi
mov dword [ebp - 0x18], ebx
call fcn.0041b7bf
test eax, eax
jne 0x412d10
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x30]
push eax
call fcn.0041042e
test eax, eax
je 0x412d10
lea eax, [edi + 0x190]
lea ecx, [ebp + 8]
push eax
call fcn.005ecafe
push 0x66a230
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xa
call fcn.005e21dc
push 0x66c3cc
lea ecx, [ebp + 8]
call fcn.005ed182
push dword [ebp + 8]
mov ecx, edi
call fcn.0041491d
push dword [ebp + 8]
lea ecx, [ebp - 0x30]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.004105e4
test eax, eax
je 0x412cfb
push dword [ebp + 8]
lea ecx, [ebp - 0x30]
call fcn.004106b6
push dword [ebp + 8]
call fcn.004101ab
pop ecx
mov byte [ebp - 4], 4
lea ecx, [ebp + 8]
call fcn.005ecd91
neg esi
sbb esi, esi
and esi, 2
add esi, 4
mov dword [ebp - 0x20], esi
jmp 0x412bc3
lea ecx, [ebp - 0x1c]
call fcn.0048f4d0
push 0x20019
lea ecx, [ebp - 0x1c]
push dword [0x66b798]
mov byte [ebp - 4], 0xb
push reloc.WS2_32.dll_accept
call fcn.0048f660
test eax, eax
je 0x412da9
push dword [0x66b79c]
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x1c]
push eax
call fcn.0048fff0
push 0x66c3c8
mov byte [ebp - 4], 0xc
push dword [ebp + 0xc]
call fcn.0046638c
pop ecx
cmp eax, ebx
pop ecx
je 0x412d9d
push ebx
lea ecx, [ebp - 0x1cc]
call fcn.0042e982
lea ecx, [ebp - 0x1cc]
mov byte [ebp - 4], 0xd
call fcn.005e8558
lea ecx, [ebp - 0x1cc]
mov byte [ebp - 4], 0xc
call fcn.00413225
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0xb
call fcn.00480a70
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.0048f570
lea eax, [esi + 0x190]
lea ecx, [ebp + 0x14]
push eax
call fcn.005ecafe
push str.OeaViewer.exe
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0xe
call fcn.005ed182
lea ecx, [ebp - 0x30]
call fcn.0040fe62
cmp eax, 1
je 0x412f8a
lea ecx, [ebp - 0x30]
call fcn.0040ffa6
cmp eax, 1
je 0x412f65
mov eax, dword [0x682534]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], eax
push 0x68
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0x10
call fcn.005edf3b
lea ecx, [ebp - 0x30]
call fcn.004103d8
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x412e26
push 0x43e
jmp 0x412e2b
push 0x43d
lea ecx, [ebp + 0xc]
call fcn.005edf3b
push 0x134
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x412f3f
lea ecx, [ebp - 0x30]
call fcn.00410323
test eax, eax
jne 0x412e69
lea ecx, [ebp - 0x30]
call fcn.0041033b
mov ecx, esi
call fcn.0041d172
mov ecx, esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.0041b7bf
test eax, eax
jne 0x412f27
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x30]
push eax
call fcn.0041042e
test eax, eax
je 0x412f27
lea eax, [esi + 0x190]
lea ecx, [ebp + 8]
push eax
call fcn.005ecafe
push 0x66a230
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x11
call fcn.005e21dc
push 0x66c3cc
lea ecx, [ebp + 8]
call fcn.005ed182
push dword [ebp + 8]
mov ecx, esi
call fcn.0041491d
push dword [ebp + 8]
lea ecx, [ebp - 0x30]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.004105e4
test eax, eax
je 0x412f12
mov ecx, esi
call fcn.0041225e
test eax, eax
je 0x412ef6
push dword [ebp + 8]
lea ecx, [ebp - 0x30]
call fcn.004106b6
jmp 0x412f12
push 0x446
lea ecx, [ebp + 0xc]
call fcn.005edf3b
push 0x30
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp + 8]
call fcn.004101ab
pop ecx
mov byte [ebp - 4], 0x10
lea ecx, [ebp + 8]
call fcn.005ecd91
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0xf
call fcn.005ecd91
mov byte [ebp - 4], 0xe
lea ecx, [ebp + 0xc]
jmp 0x4131c6
cmp dword [ebp - 0x18], ebx
jne 0x412f4b
mov dword [ebp - 0x20], 4
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0xf
call fcn.005ecd91
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0xe
call fcn.005ecd91
jmp 0x412f8a
push ebx
mov ecx, esi
call fcn.0041491d
test eax, eax
je 0x4131cb
push dword [ebp + 0x14]
mov eax, dword [edi]
push eax
call fcn.00452001
pop ecx
test eax, eax
pop ecx
je 0x4131cb
mov ecx, esi
call fcn.004142e5
test eax, eax
je 0x4131cb
push 0xdf
lea ecx, [ebp - 0x10]
call fcn.005edf3b
mov ecx, dword [ebp + 8]
push dword [ebp - 0x10]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, esi
call fcn.004154ed
lea eax, [ebp - 0x38]
push ebx
push eax
mov ecx, esi
mov dword [ebp - 0x38], ebx
call fcn.00414fbd
test eax, eax
je 0x4131cb
mov eax, dword [edi]
cmp dword [ebp - 0x38], ebx
mov edi, dword [eax - 8]
jne 0x4130da
cmp edi, 4
jle 0x4130da
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 0x10]
push 4
push eax
call fcn.005e1bd3
push 0x66ae34
mov byte [ebp - 4], 0x12
push dword [ebp + 0x10]
call fcn.00466804
pop ecx
cmp eax, ebx
pop ecx
jne 0x4130ce
lea ecx, [ebp - 0x58]
call fcn.005e65fe
push str..oeax
lea ecx, [ebp - 0x58]
push dword [ebp - 0x50]
mov byte [ebp - 4], 0x13
call fcn.005e68a7
push str..oedx
lea ecx, [ebp - 0x58]
push dword [ebp - 0x50]
call fcn.005e68a7
mov ecx, dword [ebp - 0x14]
add edi, 0xfffffffc
lea eax, [ebp + 0xc]
push edi
push eax
call fcn.005e1c4f
xor edi, edi
cmp dword [ebp - 0x50], ebx
mov byte [ebp - 4], 0x14
jle 0x4130b6
mov eax, dword [ebp - 0x54]
lea eax, [eax + edi*4]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.005ecfd0
push dword [ebp + 8]
mov byte [ebp - 4], 0x15
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x413080
test al, 0x10
je 0x413094
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x14
call fcn.005ecd91
inc edi
cmp edi, dword [ebp - 0x50]
jl 0x413056
jmp 0x4130b6
lea eax, [ebp + 8]
lea ecx, [esi + 0x198]
push eax
call fcn.005eced8
lea ecx, [ebp + 8]
mov dword [ebp - 0x38], 1
mov byte [ebp - 4], 0x14
call fcn.005ecd91
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x13
call fcn.005ecd91
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x12
call fcn.005e6631
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0xe
call fcn.005ecd91
mov edi, dword [ebp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x4130f0
push eax
call esi
or dword [edi], 0xffffffff
push 0x69dc58
lea ecx, [ebp + 8]
call fcn.005ece05
cmp dword [ebp - 0x38], ebx
mov byte [ebp - 4], 0x16
je 0x41312a
mov eax, dword [ebp - 0x14]
push dword [eax]
mov eax, dword [ebp - 0x34]
push dword [eax + 0x198]
push dword [ebp + 0x14]
push str.__s____s___Exe:__s___Open
lea eax, [ebp + 8]
push eax
call fcn.005e20b1
add esp, 0x14
jmp 0x41315e
mov eax, dword [ebp - 0x34]
add eax, 0x198
mov ecx, dword [eax]
cmp dword [ecx - 8], ebx
je 0x41314a
mov ecx, dword [ebp - 0x14]
push dword [ecx]
push dword [eax]
push dword [ebp + 0x14]
push str.__s____s___Open
jmp 0x41311c
push dword [ebp + 0x14]
lea eax, [ebp + 8]
push str.__s___Open
push eax
call fcn.005e20b1
add esp, 0xc
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x98]
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x54], ebx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x50]
lea ecx, [ebp + 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x9c]
push eax
push ebx
push ebx
push 0x4000410
push ebx
push ebx
push ebx
push 0x104
call fcn.005ed1d6
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x54]
call esi
push dword [ebp - 0x50]
call esi
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.005ed226
mov dword [ebp - 0x20], 4
mov byte [ebp - 4], 0xe
lea ecx, [ebp + 8]
call fcn.005ecd91
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x14]
call fcn.005ecd91
jmp 0x4131fa
push 0xe4
lea ecx, [ebp - 0x10]
call fcn.005edf3b
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.00466936
pop ecx
mov dword [ebp - 0x20], 3
pop ecx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.005ecd91
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0040fe17
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x14