Function at 0x406600
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path

Disassembly:
jmp 0x406600
mov eax, 0x16fc
call fcn.0041be90
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x16f8], eax
push edi
push 0x250
xor edi, edi
lea eax, [esp + 0x60]
push edi
push eax
call fcn.0041be10
push 0x44
lea ecx, [esp + 0x28]
push edi
push ecx
call fcn.0041be10
xor eax, eax
push 0x618
push eax
lea edx, [esp + 0xaec]
push edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call fcn.0041be10
push 0x450440
lea eax, [esp + 0xaf4]
push 0x104
push eax
call fcn.0041c22f
push 0x479448
lea ecx, [esp + 0xd08]
push 0x104
push ecx
call fcn.0041c22f
push 0x44fc20
lea edx, [esp + 0xf1c]
push 0x104
push edx
call fcn.0041c22f
add esp, 0x48
cmp word [0x46b190], di
je 0x4068ce
push 0x46b190
lea eax, [esp + 0x2b0]
push 0x104
push eax
call fcn.0041c22f
lea eax, [esp + 0x2b8]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4066d6
sub eax, edx
sar eax, 1
lea ecx, [esp + eax*2 + 0x2aa]
push ecx
lea edx, [esp + 0x2b0]
push edx
call fcn.00401113
add esp, 8
test eax, eax
jne 0x406714
push 0x435bfc
lea eax, [esp + 0x2b0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push esi
jmp 0x406730
push 0x410
lea ecx, [esp + 0x6cc]
push 0
push ecx
call fcn.0041be10
mov edx, edi
imul edx, edx, 0x208
lea esi, [esp + edx + 0xae4]
push esi
lea eax, [esp + 0x2c8]
push eax
lea ecx, [esp + 0x6dc]
push 0x435d60
push ecx
call ebx
add esp, 0x1c
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x6cc]
push eax
call ebp
cmp eax, 0xffffffff
jne 0x40683a
cmp edi, 2
push 0
je 0x4067a9
lea ecx, [esp + 0x6cc]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4068cb
jmp 0x40683a
lea edx, [esp + 0x6cc]
push edx
call fcn.0040114a
mov eax, dword [0x486308]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10f0]
push ecx
push 0x104
mov dword [0x486308], 0
mov dword [esp + 0x18], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4068cb
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x4c4]
push eax
lea ecx, [esp + 0x10f8]
push 0x4781b0
push ecx
call fcn.00401221
add esp, 0x10
push 0
lea edx, [esp + 0x6cc]
push edx
lea eax, [esp + 0x4c8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esp + 0x4c0]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add edi, 1
cmp edi, 3
jne 0x406730
lea edx, [esp + 0xce0]
push edx
lea eax, [esp + 0xeec]
push eax
lea ecx, [esp + 0xae0]
push ecx
lea edx, [esp + 0x2c4]
push edx
lea eax, [esp + 0x1308]
push str._s_s__s__s_NOMESSAGE
push eax
mov dword [esp + 0x3c], 0x44
call ebx
add esp, 0x18
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [esp + 0x1318]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4068cb
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x14]
push eax
call esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x16fc]
pop edi
xor ecx, esp
xor eax, eax
call fcn.0041bdf4
add esp, 0x16fc
ret