Function at 0x54a540
Capabilities:
Copy file
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x538
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0xf8], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0x528], 0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0x118], 0
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x108], 0
nop
imul eax, dword [0x00588ea8], 0xbbe70dcd
mov dword [0x00588e9c], eax
mov eax, dword [0x00588ea8]
add eax, 0xd3c370a4
mov dword [0x00588e94], eax
mov eax, dword [0x00588ea0]
add eax, 0xbbd18f93
mov dword [0x00588ea8], eax
xor dword [0x00588e94], 0x3d3473df
imul eax, dword [0x00588ea4], 0x5c1f8989
mov dword [0x00588ea4], eax
mov eax, dword [0x00588e94]
add eax, 0xcc9f3f97
mov dword [0x00588ea8], eax
mov eax, dword [0x00588ea4]
add eax, 0x17252d28
mov dword [0x00588ea8], eax
mov eax, dword [0x00588ea4]
add eax, 0x8d45f2a0
mov dword [0x00588e94], eax
xor dword [0x00588ea4], 0x29608095
mov eax, dword [0x00588e90]
add eax, 0xba38efb6
mov dword [0x00588ea0], eax
mov eax, dword [0x00588e90]
add eax, 0x50b26e41
mov dword [0x00588ea0], eax
mov ecx, 0xdbe9cdf8
mov eax, dword [0x00588e9c]
xor edx, edx
div ecx
mov dword [0x00588ea0], eax
mov eax, dword [0x00588ea4]
add eax, 0xe9f1b564
mov dword [0x00588e90], eax
mov eax, dword [0x00588ea8]
sub eax, 0x4f2f4c9e
mov dword [0x00588ea0], eax
mov eax, dword [0x00588e94]
add eax, 0x2bfb4cb9
mov dword [0x00588e90], eax
mov eax, dword [0x00588ea8]
and eax, 0x8c74cd4
mov dword [0x00588e90], eax
mov eax, dword [0x00588e9c]
add eax, 0x62c2c53a
mov dword [0x00588e94], eax
mov eax, dword [0x00588e94]
add eax, 0x912365b9
mov dword [0x00588ea0], eax
mov eax, dword [0x00588e98]
add eax, 0xdfdcbf4b
mov dword [0x00588e9c], eax
mov eax, dword [0x00588ea0]
add eax, 0x85cbc8ab
mov dword [0x00588ea4], eax
imul eax, dword [0x00588e9c], 0xc3a1f3ff
mov dword [0x00588ea8], eax
add dword [0x00588e94], 0x2a22b894
add dword [0x00588e98], 0xc21ed25c
mov ecx, 0xae605d4c
mov eax, dword [0x00588ea4]
xor edx, edx
div ecx
mov dword [0x00588e90], eax
mov eax, dword [0x00588e90]
add eax, 0x6f071055
mov dword [0x00588e98], eax
imul eax, dword [0x00588ea4], 0xfe71dc0d
mov dword [0x00588e90], eax
mov eax, dword [0x00588ea4]
xor eax, 0x3105e88d
mov dword [0x00588e9c], eax
mov eax, dword [0x00588e90]
add eax, 0x325e0dbc
mov dword [0x00588ea8], eax
add dword [0x00588e90], 0x39574255
mov eax, dword [0x00588ea8]
add eax, 0x405076ee
mov dword [0x00588e98], eax
mov eax, dword [0x00588ea4]
and eax, 0xbed81468
mov dword [0x00588e90], eax
mov eax, dword [0x00588e90]
xor eax, 0x11c4d9fb
mov dword [0x00588ea0], eax
add dword [0x00588ea8], 0x8aab680b
mov eax, dword [0x00588e90]
add eax, 0xa104a93f
mov dword [0x00588e98], eax
mov eax, dword [0x00588e9c]
add eax, 0x84c9ddf3
mov dword [0x00588e98], eax
mov eax, dword [0x00588e90]
add eax, 0x3ecd9a22
mov dword [0x00588ea0], eax
mov eax, dword [0x00588e9c]
add eax, 0x2394b646
mov dword [0x00588ea4], eax
mov eax, dword [0x00588e90]
and eax, 0xd1ea97a8
mov dword [0x00588e9c], eax
mov eax, dword [0x00588ea8]
add eax, 0xfd6ff155
mov dword [0x00588ea4], eax
mov eax, dword [0x00588e94]
add eax, 0xb166e221
mov dword [0x00588ea8], eax
mov eax, dword [0x00588e98]
add eax, 0x655dd2ed
mov dword [0x00588ea8], eax
mov eax, dword [0x00588e98]
xor eax, 0x6ae9641d
mov dword [0x00588ea4], eax
mov eax, dword [0x00588e9c]
add eax, 0x966ebdca
mov dword [0x00588ea8], eax
call fcn.005479b0
call fcn.00548840
lea rcx, [rbp + 0xf8]
xor rdx, rdx
call fcn.00408b80
lea rcx, [rbp + 0xf0]
mov rdx, qword [rbp + 0xf8]
xor r8, r8
call fcn.0040f580
lea rcx, [rbp + 0x120]
mov rdx, qword [rbp + 0xf0]
call fcn.00546ac0
lea rcx, [rbp + 0x118]
mov rdx, qword [rbp + 0x120]
lea r8, [0x0054b190]
call fcn.0040ee80
lea rcx, [rbp + 0xe8]
mov edx, 1
call fcn.00408b80
lea rcx, [rbp + 0x108]
mov rdx, qword [rbp + 0xe8]
xor r8, r8
call fcn.0040f580
mov rcx, qword [rbp + 0x108]
call fcn.0040f240
mov rcx, rax
lea rdx, [0x0054b19c]
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x54aa12
call fcn.00548e90
call fcn.00548e30
test al, al
je 0x54ab64
lea rcx, [rbp + 0xd8]
call fcn.00549a30
lea rcx, [rbp + 0xe0]
mov rdx, qword [0x00588eb0]
lea r8, [0x0054b1ac]
mov r9, qword [rbp + 0xd8]
call fcn.00549f60
lea rcx, [0x00588eb0]
mov rdx, qword [rbp + 0xe0]
call fcn.0040e770
lea rcx, [rbp + 0xc8]
call fcn.00549980
lea rcx, [rbp + 0xd0]
mov rdx, qword [0x00588eb0]
lea r8, [0x0054b1c0]
mov r9, qword [rbp + 0xc8]
call fcn.00549f60
lea rcx, [0x00588eb0]
mov rdx, qword [rbp + 0xd0]
call fcn.0040e770
lea rcx, [rbp + 0xb8]
call fcn.00549b30
lea rcx, [rbp + 0xc0]
mov rdx, qword [0x00588eb0]
lea r8, [0x0054b1d4]
mov r9, qword [rbp + 0xb8]
call fcn.00549f60
lea rcx, [0x00588eb0]
mov rdx, qword [rbp + 0xc0]
call fcn.0040e770
lea rcx, [rbp + 0xa8]
call fcn.00549ae0
lea rcx, [rbp + 0xb0]
mov rdx, qword [0x00588eb0]
lea r8, [0x0054b1f0]
mov r9, qword [rbp + 0xa8]
call fcn.00549f60
lea rcx, [0x00588eb0]
mov rdx, qword [rbp + 0xb0]
call fcn.0040e770
lea rcx, [rbp + 0x98]
call fcn.00549e00
lea rcx, [rbp + 0xa0]
mov rdx, qword [0x00588eb0]
lea r8, [0x0054b204]
mov r9, qword [rbp + 0x98]
call fcn.00549f60
lea rcx, [0x00588eb0]
mov rdx, qword [rbp + 0xa0]
call fcn.0040e770
jmp 0x54ac68
lea rcx, [rbp + 0x90]
mov rdx, qword [0x00588eb0]
lea r8, [0x0054b1ac]
lea r9, [0x0054b204]
call fcn.00549f60
lea rcx, [0x00588eb0]
mov rdx, qword [rbp + 0x90]
call fcn.0040e770
lea rcx, [rbp + 0x88]
mov rdx, qword [0x00588eb0]
lea r8, [0x0054b1c0]
lea r9, [0x0054b204]
call fcn.00549f60
lea rcx, [0x00588eb0]
mov rdx, qword [rbp + 0x88]
call fcn.0040e770
lea rcx, [rbp + 0x80]
mov rdx, qword [0x00588eb0]
lea r8, [0x0054b1d4]
lea r9, [0x0054b218]
call fcn.00549f60
lea rcx, [0x00588eb0]
mov rdx, qword [rbp + 0x80]
call fcn.0040e770
lea rcx, [rbp + 0x70]
call fcn.00549e00
lea rcx, [rbp + 0x78]
mov rdx, qword [0x00588eb0]
lea r8, [0x0054b204]
mov r9, qword [rbp + 0x70]
call fcn.00549f60
lea rcx, [0x00588eb0]
mov rdx, qword [rbp + 0x78]
call fcn.0040e770
lea rcx, [rbp + 0x60]
call fcn.00549ae0
lea rcx, [rbp + 0x68]
mov rdx, qword [0x00588eb0]
lea r8, [0x0054b1f0]
mov r9, qword [rbp + 0x60]
call fcn.00549f60
lea rcx, [0x00588eb0]
mov rdx, qword [rbp + 0x68]
call fcn.0040e770
lea rcx, [rbp + 0x58]
xor rdx, rdx
call fcn.00408b80
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
xor r8, r8
call fcn.0040f580
mov rcx, qword [rbp + 0x50]
call fcn.0040f240
mov rbx, rax
lea rcx, [rbp + 0x48]
mov rdx, qword [0x00588eb0]
mov r8, qword [0x00588eb8]
call fcn.0040ee80
mov rcx, qword [rbp + 0x48]
call fcn.0040f240
mov rcx, rbx
mov rdx, rax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
je 0x54afac
call fcn.00548e30
test al, al
je 0x54ae3d
lea rcx, [rbp + 0x528]
mov rdx, qword [0x00588eb0]
call fcn.0040e7f0
mov rcx, qword [rbp + 0x528]
call fcn.0040f240
mov rcx, rax
call sub.kernel32.dll_lstrlenA
lea rcx, [rbp + 0x528]
mov edx, eax
xor r8, r8
call fcn.0040f4b0
mov rcx, qword [rbp + 0x528]
call fcn.0054a050
test al, al
jne 0x54ad24
mov rcx, qword [rbp + 0x528]
call fcn.0054a080
lea rcx, [rbp + 0x110]
mov rdx, qword [rbp + 0x528]
lea r8, [0x0054b190]
call fcn.0040ee80
lea rcx, [rbp + 0x528]
mov rdx, qword [0x00588eb8]
call fcn.0040ed80
mov rcx, qword [rbp + 0x528]
call fcn.0040f240
mov rcx, rax
call sub.kernel32.dll_lstrlenA
lea rcx, [rbp + 0x528]
mov edx, eax
xor r8, r8
call fcn.0040f4b0
lea rcx, [rbp + 0x40]
xor rdx, rdx
call fcn.00408b80
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x40]
xor r8, r8
call fcn.0040f580
mov rcx, qword [rbp + 0x38]
call fcn.0040f240
mov rbx, rax
mov rcx, qword [rbp + 0x528]
call fcn.0040f240
mov rcx, rbx
mov rdx, rax
xor r8, r8
call sub.kernel32.dll_CopyFileA
mov rcx, qword [rbp + 0x118]
call fcn.0040f240
mov rbx, rax
mov rcx, qword [rbp + 0x110]
call fcn.0040f240
mov rcx, rbx
mov rdx, rax
xor r8, r8
call sub.kernel32.dll_CopyFileA
cmp dword [0x00588ee0], 1
jne 0x54ae12
mov rcx, qword [rbp + 0x110]
call fcn.0054a480
cmp eax, 0x989680
jge 0x54ae12
mov rcx, qword [rbp + 0x110]
call fcn.0040f240
mov rcx, rax
call fcn.0054a190
mov rcx, qword [0x00588ec0]
mov rdx, qword [0x00588ec8]
mov r8, qword [rbp + 0x528]
mov r9, qword [0x00588ed0]
call fcn.00549600
call fcn.00548000
jmp 0x54afba
lea rcx, [rbp + 0x528]
mov rdx, qword [0x00588eb0]
call fcn.0040e7f0
mov rcx, qword [rbp + 0x528]
call fcn.0040f240
mov rcx, rax
call sub.kernel32.dll_lstrlenA
lea rcx, [rbp + 0x528]
mov edx, eax
xor r8, r8
call fcn.0040f4b0
mov rcx, qword [rbp + 0x528]
call fcn.0054a050
test al, al
jne 0x54ae91
mov rcx, qword [rbp + 0x528]
call fcn.0054a080
lea rcx, [rbp + 0x110]
mov rdx, qword [rbp + 0x528]
lea r8, [0x0054b190]
call fcn.0040ee80
lea rcx, [rbp + 0x528]
mov rdx, qword [0x00588eb8]
call fcn.0040ed80
mov rcx, qword [rbp + 0x528]
call fcn.0040f240
mov rcx, rax
call sub.kernel32.dll_lstrlenA
lea rcx, [rbp + 0x528]
mov edx, eax
xor r8, r8
call fcn.0040f4b0
lea rcx, [rbp + 0x30]
xor rdx, rdx
call fcn.00408b80
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
xor r8, r8
call fcn.0040f580
mov rcx, qword [rbp + 0x28]
call fcn.0040f240
mov rbx, rax
mov rcx, qword [rbp + 0x528]
call fcn.0040f240
mov rcx, rbx
mov rdx, rax
xor r8, r8
call sub.kernel32.dll_CopyFileA
mov rcx, qword [rbp + 0x118]
call fcn.0040f240
mov rbx, rax
mov rcx, qword [rbp + 0x110]
call fcn.0040f240
mov rcx, rbx
mov rdx, rax
xor r8, r8
call sub.kernel32.dll_CopyFileA
cmp dword [0x00588ee0], 1
jne 0x54af7f
mov rcx, qword [rbp + 0x110]
call fcn.0054a480
cmp eax, 0x989680
jge 0x54af7f
mov rcx, qword [rbp + 0x110]
call fcn.0040f240
mov rcx, rax
call fcn.0054a190
mov rcx, qword [rbp + 0x528]
call fcn.0054a290
mov rcx, qword [rbp + 0x528]
call fcn.0040f240
mov rcx, rax
mov edx, 1
call sub.kernel32.dll_WinExec
call fcn.00548000
jmp 0x54afba
call fcn.00548e30
test al, al
jne 0x54afba
call fcn.00548e90
xor rcx, rcx
call sub.kernel32.dll_ExitProcess_1