Function at 0x4c93f3
Capabilities:
Create directory
Extract resource via kernel32 functions
Get common file path
Get file size
Get hostname
Read file on windows

Disassembly:
mov eax, 0x536778
call fcn.00535848
sub esp, 0x688
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ecx, 0x604eb8
call fcn.004487b7
mov ecx, 0x605010
call fcn.00448772
push 0x10
mov ecx, 0x605168
call fcn.0044886c
push 0x10
mov ecx, 0x605174
call fcn.0044886c
xor ebx, ebx
mov dword [0x605180], ebx
mov dword [0x605184], ebx
mov dword [0x605188], ebx
mov dword [0x60519c], ebx
mov dword [0x6051a0], 0xf
mov byte [0x60518c], bl
mov byte [0x6051a8], bl
mov dword [0x6051ac], 0x38e7
mov dword [ebp - 0x1c], 1
mov byte [ebp - 0x18], bl
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, 0x6051b0
call fcn.004cbbd2
mov esi, 0x54ddd9
push esi
lea ecx, [ebp - 0x34]
call fcn.0043a56f
xor edi, edi
inc edi
mov dword [ebp - 0x50], edi
push eax
lea ecx, [ebp - 0x4c]
call fcn.0043a541
lea ecx, [ebp - 0x34]
call fcn.0043c446
lea ecx, [ebp - 0x50]
lea eax, [ebp - 0x34]
push eax
push ecx
mov ecx, 0x6051b8
call fcn.004cbc44
lea ecx, [ebp - 0x4c]
call fcn.0043c446
push esi
lea ecx, [ebp - 0x34]
call fcn.0043a56f
mov dword [ebp - 0x50], edi
push eax
lea ecx, [ebp - 0x4c]
call fcn.0043a541
lea ecx, [ebp - 0x34]
call fcn.0043c446
lea ecx, [ebp - 0x50]
lea eax, [ebp - 0x34]
push eax
push ecx
mov ecx, 0x6051c0
call fcn.004cbc44
lea ecx, [ebp - 0x4c]
call fcn.0043c446
push esi
lea ecx, [ebp - 0x34]
call fcn.0043a56f
mov dword [ebp - 0x50], edi
push eax
lea ecx, [ebp - 0x4c]
call fcn.0043a541
lea ecx, [ebp - 0x34]
call fcn.0043c446
lea ecx, [ebp - 0x50]
lea eax, [ebp - 0x34]
push eax
push ecx
mov ecx, 0x6051c8
call fcn.004cbc44
lea ecx, [ebp - 0x4c]
call fcn.0043c446
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, 0x6051d0
call fcn.004cbbd2
push esi
lea ecx, [ebp - 0x34]
call fcn.0043a56f
mov dword [ebp - 0x50], edi
push eax
lea ecx, [ebp - 0x4c]
call fcn.0043a541
lea ecx, [ebp - 0x34]
call fcn.0043c446
lea ecx, [ebp - 0x50]
lea eax, [ebp - 0x34]
push eax
push ecx
mov ecx, 0x6051d8
call fcn.004cbc44
lea ecx, [ebp - 0x4c]
call fcn.0043c446
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, 0x6051e0
call fcn.004cbbd2
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x173f
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, 0x6051e8
call fcn.004cbbd2
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x173e
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, 0x6051f0
call fcn.004cbbd2
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x18], bl
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, 0x6051f8
call fcn.004cbbd2
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x18], bl
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, 0x605200
call fcn.004cbbd2
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x18], 1
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, 0x605208
call fcn.004cbbd2
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x41900000
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, 0x605210
call fcn.004cbbd2
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x18], 1
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, 0x605218
call fcn.004cbbd2
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0x42700000
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, 0x605220
call fcn.004cbbd2
mov dword [ebp - 0x1c], esi
or dword [ebp - 0x18], 0xffffffff
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, 0x605228
call fcn.004cbbd2
mov dword [ebp - 0x1c], esi
or dword [ebp - 0x18], 0xffffffff
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, 0x605230
call fcn.004cbbd2
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0x42c80000
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, 0x605238
call fcn.004cbbd2
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0x42c80000
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, 0x605240
call fcn.004cbbd2
lea ecx, [ebp - 0x34]
call fcn.004c8522
mov dword [ebp - 0x50], esi
push eax
lea ecx, [ebp - 0x4c]
call fcn.0043a41d
lea ecx, [ebp - 0x34]
call fcn.0043c274
lea ecx, [ebp - 0x50]
lea eax, [ebp - 0x34]
push eax
push ecx
mov ecx, 0x605248
call fcn.004cbb60
lea ecx, [ebp - 0x4c]
call fcn.0043c274
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x18], bl
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, 0x605250
call fcn.004cbbd2
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x18], 1
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, 0x605258
call fcn.004cbbd2
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x18], bl
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, 0x605260
call fcn.004cbbd2
mov dword [ebp - 0x70], 0x100
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x694]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x4c9799
mov dword [ebp - 0x24], ebx
push 7
pop esi
mov dword [ebp - 0x20], esi
xor eax, eax
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x694]
push eax
lea ecx, [ebp - 0x34]
call fcn.0043c2b9
jmp 0x4c97dd
push ecx
push ecx
lea ecx, [ebp - 0x1e4]
call fcn.0043adb7
call fcn.00517a8a
push eax
push ecx
lea ecx, [ebp - 0x1d4]
call fcn.004cfb21
pop ecx
mov ecx, eax
call fcn.0043b5fd
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x1cc]
call fcn.0043c8d5
lea ecx, [ebp - 0x1e4]
call fcn.00436d2d
push 7
pop esi
mov dword [ebp - 0x50], edi
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0043a41d
lea ecx, [ebp - 0x34]
call fcn.0043c274
lea ecx, [ebp - 0x50]
lea eax, [ebp - 0x34]
push eax
push ecx
mov ecx, 0x605268
call fcn.004cbb60
lea ecx, [ebp - 0x4c]
call fcn.0043c274
lea ecx, [ebp - 0x34]
call fcn.004c88d0
mov dword [ebp - 0x50], edi
push eax
lea ecx, [ebp - 0x4c]
call fcn.0043a541
lea ecx, [ebp - 0x34]
call fcn.0043c446
lea ecx, [ebp - 0x50]
lea eax, [ebp - 0x34]
push eax
push ecx
mov ecx, 0x605270
call fcn.004cbc44
lea ecx, [ebp - 0x4c]
call fcn.0043c446
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x18], bl
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, 0x605278
call fcn.004cbbd2
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], esi
xor eax, eax
mov word [ebp - 0x34], ax
mov edi, 0x54de54
push edi
lea ecx, [ebp - 0x34]
call fcn.0043c2b9
mov dword [ebp - 0x50], 1
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0043a41d
lea ecx, [ebp - 0x34]
call fcn.0043c274
lea ecx, [ebp - 0x50]
lea eax, [ebp - 0x34]
push eax
push ecx
mov ecx, 0x605280
call fcn.004cbb60
lea ecx, [ebp - 0x4c]
call fcn.0043c274
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], esi
xor eax, eax
mov word [ebp - 0x34], ax
push edi
lea ecx, [ebp - 0x34]
call fcn.0043c2b9
mov dword [ebp - 0x50], 1
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0043a41d
lea ecx, [ebp - 0x34]
call fcn.0043c274
lea ecx, [ebp - 0x50]
lea eax, [ebp - 0x34]
push eax
push ecx
mov ecx, 0x605288
call fcn.004cbb60
lea ecx, [ebp - 0x4c]
call fcn.0043c274
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], esi
xor eax, eax
mov word [ebp - 0x34], ax
push edi
lea ecx, [ebp - 0x34]
call fcn.0043c2b9
mov dword [ebp - 0x50], 1
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0043a41d
lea ecx, [ebp - 0x34]
call fcn.0043c274
lea ecx, [ebp - 0x50]
lea eax, [ebp - 0x34]
push eax
push ecx
mov ecx, 0x605290
call fcn.004cbb60
lea ecx, [ebp - 0x4c]
call fcn.0043c274
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], esi
xor eax, eax
mov word [ebp - 0x34], ax
push edi
lea ecx, [ebp - 0x34]
call fcn.0043c2b9
mov dword [ebp - 0x50], 1
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0043a41d
lea ecx, [ebp - 0x34]
call fcn.0043c274
lea ecx, [ebp - 0x50]
lea eax, [ebp - 0x34]
push eax
push ecx
mov ecx, 0x605298
call fcn.004cbb60
lea ecx, [ebp - 0x4c]
call fcn.0043c274
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], esi
xor eax, eax
mov word [ebp - 0x34], ax
push edi
lea ecx, [ebp - 0x34]
call fcn.0043c2b9
xor esi, esi
inc esi
mov dword [ebp - 0x50], esi
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0043a41d
lea ecx, [ebp - 0x34]
call fcn.0043c274
lea ecx, [ebp - 0x50]
lea eax, [ebp - 0x34]
push eax
push ecx
mov ecx, 0x6052a0
call fcn.004cbb60
lea ecx, [ebp - 0x4c]
call fcn.0043c274
mov dword [0x6052a8], ebx
mov dword [0x6052ac], ebx
mov dword [0x6052b0], ebx
mov dword [0x6052b4], ebx
mov dword [0x6052b8], ebx
call fcn.004cf04e
mov dword [0x6052b4], eax
mov dword [0x6052c0], esi
mov dword [0x6052c4], ebx
mov dword [0x6052c8], ebx
call fcn.004cf3b7
mov dword [0x6052c4], eax
mov dword [0x6052cc], 0x1000000
mov word [0x6052d0], bx
mov byte [0x6052d2], bl
mov dword [0x6052d4], ebx
mov dword [0x6052d8], ebx
push 0x64
pop eax
mov dword [0x6052dc], eax
mov dword [0x6052e0], eax
mov dword [0x6052e4], ebx
mov dword [0x6052e8], ebx
lea eax, [ebp - 0x494]
cmp byte [0x5fea1a], bl
jne 0x4c9a9d
push eax
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [ebp - 0x494]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x4c9a75
push 5
pop ecx
mov esi, str.Aeroadmin
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push ebx
lea eax, [ebp - 0x494]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x4c9ac6
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea eax, [ebp - 0x494]
push eax
call fcn.00504a54
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea edi, [ebp - 0x494]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x4c9acf
push 5
pop ecx
mov esi, 0x55c66c
rep movsd dword es:[edi], dword [esi]
push ebx
push 0x80
push 3
push ebx
push 1
push accept
lea eax, [ebp - 0x494]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4c9b9e
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
lea eax, [ebp - 0x40]
push eax
push esi
mov ecx, eax
call fcn.00448cbd
push ebx
lea eax, [ebp - 0x18]
push eax
push esi
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x44]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 4
push 0x6051a4
lea ecx, [ebp - 0x44]
call fcn.004c810e
push 4
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x44]
call fcn.004c810e
mov esi, dword [ebp - 0x70]
test esi, esi
je 0x4c9b89
mov ecx, 0x605180
push ecx
push esi
call fcn.00446f64
push esi
push dword [0x605180]
lea ecx, [ebp - 0x44]
call fcn.004c810e
mov edx, 0x60518c
lea ecx, [ebp - 0x44]
call fcn.004c8282
lea ecx, [ebp - 0x40]
call fcn.0043c24c
mov dword [0x6051a4], ebx
lea eax, [ebp - 0x694]
push eax
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [ebp - 0x694]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x4c9bbf
push 9
pop ecx
mov esi, str.Aeroadminconfig
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x134], 0x55cd28
mov dword [ebp - 0xc4], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
push ebx
push ecx
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x134]
call fcn.0044509b
mov eax, dword [ebp - 0x134]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0x134], 0x55cd30
mov eax, dword [ebp - 0x134]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x138], eax
push ebx
lea ecx, [ebp - 0x124]
call fcn.004cd00f
push ecx
push 1
lea eax, [ebp - 0x694]
push eax
lea ecx, [ebp - 0x124]
call fcn.004ccfae
test eax, eax
jne 0x4c9c67
mov eax, dword [ebp - 0x134]
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x134]
add ecx, eax
mov eax, dword [ecx + 0xc]
push ebx
or eax, 2
push eax
call fcn.0043c9b0
mov eax, dword [ebp - 0x134]
mov eax, dword [eax + 4]
cmp dword [ebp + eax - 0x128], ebx
jne 0x4c9cd2
push str.en_US
push ebx
call fcn.00519780
pop ecx
pop ecx
mov dword [ebp - 4], ebx
wait
mov byte [ebp - 0x44], bl
push ebx
lea ecx, [ebp - 0x3c]
call fcn.004cdb5b
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x134]
call fcn.004cbd42
push 2
lea eax, [ebp - 0x44]
push eax
call fcn.004c9e16
lea ecx, [ebp - 0x44]
call fcn.004cbeff
wait
or dword [ebp - 4], 0xffffffff
jmp 0x4c9cd2
lea ecx, [ebp - 0xc4]
call fcn.004cc0c3
mov dword [ebp - 0xc4], vtable.std::ios_base.0
lea eax, [ebp - 0xc4]
push eax
call fcn.004eb501
pop ecx
push 0xa
push 0x7c
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4c9de2
movzx esi, word [edi]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], bl
push ebx
push 0x4000
lea ecx, [ebp - 0x34]
call fcn.0043a4c2
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x70], eax
lea ecx, [ebp - 0x34]
cmp dword [ebp - 0x20], 0x10
cmovae ecx, dword [ebp - 0x34]
lea eax, [edi + 2]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], esi
lea eax, [ebp - 0x6c]
push eax
lea edx, [ebp - 0x70]
call fcn.004e6e3a
mov dword [esp], str.en_US
push ebx
call fcn.00519780
lea ecx, [ebp - 0x294]
call fcn.004443c5
lea edx, [ebp - 0x34]
cmp dword [ebp - 0x20], 0x10
cmovae edx, dword [ebp - 0x34]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x284]
call fcn.00445231
pop ecx
mov dword [ebp - 4], 2
wait
mov byte [ebp - 0x44], bl
push ebx
lea ecx, [ebp - 0x3c]
call fcn.004cdb5b
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x294]
call fcn.004cbd42
push 8
lea eax, [ebp - 0x44]
push eax
call fcn.004c9e16
lea ecx, [ebp - 0x44]
call fcn.004cbeff
wait
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x294]
call fcn.00443fd6
lea ecx, [ebp - 0x34]
call fcn.0043c446
mov eax, 0x604eb8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret