Function at 0x428d80
Capabilities:
Copy file
Create process on windows
Create shortcut via ishelllink
Delete file
Get common file path
Persist via lnk shortcut
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x46050a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8b8
push ebx
push ebp
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x78], ebx
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x8f0]
mov dword [esp + 0x8d0], 3
test eax, eax
jne 0x428dd0
mov byte [esp + 0x8d0], 2
jmp 0x4294f9
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x3b9]
mov byte [esp + 0x3b8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x8dc]
test eax, eax
jne 0x428dfb
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [esp + 0x3b8]
push ecx
push eax
call fcn.00405ca0
add esp, 8
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dl, byte [esp + 0x13]
push 0
lea ecx, [esp + 0x34]
mov byte [esp + 0x34], dl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x2b5]
mov byte [esp + 0x2b4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
mov byte [esp + 0x8d0], 4
push eax
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x428ea7
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x2b4]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jne 0x428ea7
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
call dword [sym.imp.ole32.dll_CoUninitialize]
push 1
lea ecx, [esp + 0x34]
mov byte [esp + 0x8d4], 3
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov byte [esp + 0x8d0], 2
jmp 0x4294f9
lea edi, [esp + 0x2b4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ecx + 0x2b4]
mov cl, byte [esp + ecx + 0x2b3]
cmp cl, 0x5c
je 0x428ece
mov byte [eax], 0x5c
mov edi, 0x47165c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x2b4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x2b4]
push ecx
push eax
lea ecx, [esp + 0x38]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
lea ecx, [esp + 0x30]
push 0x47188c
lea edx, [esp + 0x5c]
push ecx
push edx
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
lea eax, [esp + 0x3c4]
lea ecx, [esp + 0x3c]
push eax
lea edx, [esp + 0x78]
push ecx
push edx
mov byte [esp + 0x8e8], 5
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0x18
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x4b9]
mov byte [esp + 0x4b8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebx + 0x170]
mov edi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
test eax, eax
mov byte [esp + 0x8d0], 6
jne 0x428f8c
mov eax, edi
mov edx, dword [ebx + 0x160]
mov esi, edi
test edx, edx
je 0x428f9a
mov esi, edx
mov edx, dword [ebx + 0x180]
test edx, edx
jne 0x428fa6
mov edx, edi
mov ecx, dword [esp + 0x8ec]
test ecx, ecx
jne 0x428fb3
mov ecx, edi
mov ebp, dword [esp + 0x918]
push eax
push esi
push edx
push ebp
push ecx
lea eax, [esp + 0x4cc]
push 0x471870
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, dword [esp + 0x88]
add esp, 0x1c
test eax, eax
jne 0x428fe5
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
call fcn.00405f20
add esp, 4
test eax, eax
jne 0x4290e1
lea ecx, [esp + 0x30]
push 0x4716c4
lea edx, [esp + 0x24]
push ecx
push edx
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0xc
mov eax, dword [esp + 0x24]
mov byte [esp + 0x8d0], 7
test eax, eax
jne 0x429022
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
call dword [sym.imp.imagehlp.dll_MakeSureDirectoryPathExists]
mov esi, 9
mov ecx, dword [esp + 0x24]
mov edx, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
test ecx, ecx
jne 0x42903e
mov ecx, edx
mov eax, dword [esp + 0x8dc]
test eax, eax
jne 0x42904b
mov eax, edx
push 0
lea edx, [esp + 0x3bc]
push 0
push edx
push ecx
push eax
call fcn.00402f40
add esp, 0x14
cmp eax, 1
je 0x429072
cmp eax, 0xfffffff4
je 0x429072
mov eax, esi
dec esi
test eax, eax
jne 0x42902e
mov esi, dword [esp + 0x6c]
test esi, esi
jne 0x429080
mov esi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [esp + 0x3b8]
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x48]
push edx
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
mov eax, dword [eax + 4]
add esp, 0xc
test eax, eax
jne 0x4290a6
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
push 1
lea ecx, [esp + 0x48]
sete bl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
test bl, bl
mov byte [esp + 0x8d0], 6
push 1
lea ecx, [esp + 0x24]
je 0x4290db
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
jmp 0x42914f
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [esp + 0x5c]
test eax, eax
jne 0x4290ee
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
call fcn.00405f20
add esp, 4
mov ebx, 2
test eax, eax
jne 0x429335
mov esi, 9
mov ecx, dword [esp + 0x34]
mov edx, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
test ecx, ecx
jne 0x429119
mov ecx, edx
mov eax, dword [esp + 0x90c]
test eax, eax
jne 0x429126
mov eax, edx
push 0
push 0
push 0x47188c
push ecx
push eax
call fcn.00402f40
add esp, 0x14
cmp eax, 1
je 0x42917c
cmp eax, 0xfffffff4
je 0x42914a
mov ecx, esi
dec esi
test ecx, ecx
jne 0x429109
cmp eax, 1
je 0x42917c
push 1
lea ecx, [esp + 0x6c]
mov byte [esp + 0x8d4], 5
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push 1
lea ecx, [esp + 0x5c]
mov byte [esp + 0x8d4], 4
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
jmp 0x428e86
mov edx, dword [sym.imp.MSVCP60.dll_const_std::basic_ifstream_char__struct_std::char_traits_char__::vbtable]
lea ecx, [esp + 0x108]
mov dword [esp + 0xac], edx
call dword [sym.imp.MSVCP60.dll_protected:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::constructor_void_]
mov dword [esp + 0x18], 1
push 0
lea eax, [esp + 0xb8]
push 0
push eax
lea ecx, [esp + 0xb8]
mov byte [esp + 0x8dc], 8
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char_____bool_]
push 0
lea ecx, [esp + 0xb8]
mov dword [esp + 0x8d4], 9
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_filebuf_char__struct_std::char_traits_char__::constructor_struct__iobuf__]
mov ecx, dword [esp + 0xac]
mov eax, dword [sym.imp.MSVCP60.dll_const_std::basic_ifstream_char__struct_std::char_traits_char__::vftable]
mov edx, dword [ecx + 4]
mov dword [esp + edx + 0xac], eax
mov eax, dword [esp + 0x5c]
mov byte [esp + 0x8d0], 0xa
test eax, eax
jne 0x429204
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push 1
push eax
lea ecx, [esp + 0xbc]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_filebuf_char__struct_std::char_traits_char______thiscall_std::basic_filebuf_char__struct_std::char_traits_char__::open_char_const___int_]
test eax, eax
jne 0x429231
mov ecx, dword [esp + 0xac]
push eax
push ebx
mov edx, dword [ecx + 4]
lea ecx, [esp + edx + 0xb4]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov eax, dword [esp + 0x104]
test eax, eax
je 0x429306
xor eax, eax
lea ecx, [esp + 0x40]
push 4
mov word [esp + 0x45], ax
push ecx
lea ecx, [esp + 0xb4]
mov byte [esp + 0x48], 0
mov byte [esp + 0x4b], al
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::read_char___int_]
lea ecx, [esp + 0xb4]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_filebuf_char__struct_std::char_traits_char______thiscall_std::basic_filebuf_char__struct_std::char_traits_char__::close_void_]
test eax, eax
jne 0x42928e
mov edx, dword [esp + 0xac]
push eax
push ebx
mov eax, dword [edx + 4]
lea ecx, [esp + eax + 0xb4]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov ecx, 4
lea edi, [esp + 0x40]
lea esi, [esp + 0x18]
xor eax, eax
mov byte [esp + 0x18], 0x4d
mov byte [esp + 0x19], 0x5a
mov byte [esp + 0x1a], 0x90
mov byte [esp + 0x1b], 0
repe cmpsb byte [esi], byte es:[edi]
je 0x4292ba
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x429306
mov eax, dword [esp + 0x5c]
test eax, eax
jne 0x4292cb
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x108]
mov byte [esp + 0x8d0], 6
call dword [sym.imp.MSVCP60.dll_public_virtual:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::destructor_void_]
mov ecx, dword [sym.imp.MSVCP60.dll_const_std::basic_ios_char__struct_std::char_traits_char__::vftable]
mov dword [esp + 0x108], ecx
lea ecx, [esp + 0x108]
call dword [sym.imp.MSVCP60.dll_public_virtual:_void___thiscall_std::ios_base::destructor_void_]
jmp 0x4294b6
lea ecx, [esp + 0x108]
mov byte [esp + 0x8d0], 6
call dword [sym.imp.MSVCP60.dll_public_virtual:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::destructor_void_]
mov edx, dword [sym.imp.MSVCP60.dll_const_std::basic_ios_char__struct_std::char_traits_char__::vftable]
lea ecx, [esp + 0x108]
mov dword [esp + 0x108], edx
call dword [sym.imp.MSVCP60.dll_public_virtual:_void___thiscall_std::ios_base::destructor_void_]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1b1]
mov byte [esp + 0x1b0], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xad]
mov byte [esp + 0xac], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4293ab
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1b0]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jne 0x4293ab
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4294b6
lea edi, [esp + 0x1b0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ecx + 0x1b0]
mov cl, byte [esp + ecx + 0x1af]
cmp cl, 0x5c
je 0x4293d2
mov byte [eax], 0x5c
or ecx, 0xffffffff
lea edi, [esp + 0x1b0]
xor eax, eax
lea edx, [esp + 0xac]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x1b0]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x472dc0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0xac]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x472d44
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x1c]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [esp + 0x14]
push ecx
push 0x464e9c
push 1
push 0
push 0x464ebc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x4294b6
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x54]
push ecx
push 0x464eac
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
jge 0x429557
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
push 1
lea ecx, [esp + 0x6c]
mov byte [esp + 0x8d4], 5
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push 1
lea ecx, [esp + 0x5c]
mov byte [esp + 0x8d4], 4
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push 1
lea ecx, [esp + 0x34]
mov byte [esp + 0x8d4], 3
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov byte [esp + 0x8d0], bl
push 1
lea ecx, [esp + 0x8dc]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push 1
lea ecx, [esp + 0x8ec]
mov byte [esp + 0x8d4], 1
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push 1
lea ecx, [esp + 0x8fc]
mov byte [esp + 0x8d4], 0
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push 1
lea ecx, [esp + 0x90c]
mov dword [esp + 0x8d4], 0xffffffff
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
xor al, al
jmp 0x429c44
mov eax, dword [esp + 0x78]
mov edi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov esi, edi
mov ecx, dword [eax + 0x170]
test ecx, ecx
je 0x42956f
mov esi, ecx
mov eax, dword [esp + 0x78]
mov edx, dword [eax + 0x160]
test edx, edx
jne 0x42957f
mov edx, edi
mov ecx, dword [eax + 0x180]
test ecx, ecx
jne 0x42958b
mov ecx, edi
mov eax, dword [esp + 0x8ec]
test eax, eax
jne 0x429598
mov eax, edi
push esi
push edx
push ecx
push ebp
push eax
lea ecx, [esp + 0x5d0]
push 0x471870
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov dl, byte [esp + 0x2f]
add esp, 0x1c
lea ecx, [esp + 0x7c]
mov byte [esp + 0x7c], dl
push 0
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
lea edi, [esp + 0x5bc]
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x80]
push ebp
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x42961a
mov edi, dword [esp + 0x80]
mov ecx, ebp
mov eax, ecx
lea esi, [esp + 0x5bc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x80]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Eos_unsigned_int_]
mov cl, byte [esp + 0x58]
xor ebp, ebp
mov byte [esp + 0x8c], cl
push ebp
lea ecx, [esp + 0x90]
mov byte [esp + 0x8d4], 0xb
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov edx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea ecx, [esp + 0x58]
mov eax, dword [edx]
push eax
push ebp
push ecx
lea ecx, [esp + 0x98]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
mov ecx, dword [esp + 0x90]
mov bl, 0xc
cmp ecx, ebp
mov byte [esp + 0x8d0], bl
jne 0x429673
mov ecx, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov eax, dword [esp + 0x14]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x50]
mov ecx, dword [esp + 0x80]
cmp ecx, ebp
jne 0x42968f
mov ecx, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov eax, dword [esp + 0x14]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, dword [esp + 0x6c]
cmp ecx, ebp
jne 0x4296a8
mov ecx, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov eax, dword [esp + 0x14]
push ebp
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [esp + 0x8f8]
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x24]
push ecx
push edx
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
push str..lnk
push eax
lea eax, [esp + 0x58]
mov byte [esp + 0x8e4], 0xd
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
mov eax, dword [eax + 4]
add esp, 0x18
cmp eax, ebp
jne 0x4296f2
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call esi
push 1
lea ecx, [esp + 0x48]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push 1
lea ecx, [esp + 0x24]
mov byte [esp + 0x8d4], bl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
lea ecx, [esp + 0x8f8]
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x24]
push edx
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
push str..lnk
lea ecx, [esp + 0x54]
push eax
push ecx
mov byte [esp + 0x8e8], 0xe
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
mov eax, dword [eax + 4]
add esp, 0x18
cmp eax, ebp
jne 0x429758
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [esp + 0x6c0]
push 0x104
push edx
push 0xffffffffffffffff
push eax
push ebp
push ebp
call edi
push 1
lea ecx, [esp + 0x48]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push 1
lea ecx, [esp + 0x24]
mov byte [esp + 0x8d4], bl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [esp + 0x54]
lea edx, [esp + 0x6c0]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
lea eax, [esp + 0x8f8]
lea ecx, [esp + 0x1b0]
push eax
lea edx, [esp + 0x24]
push ecx
push edx
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_char_const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
push str..lnk
push eax
lea eax, [esp + 0x58]
mov byte [esp + 0x8e4], 0xf
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
mov eax, dword [eax + 4]
add esp, 0x18
cmp eax, ebp
jne 0x4297e6
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
call esi
push 1
lea ecx, [esp + 0x48]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [esp + 0x24]
mov byte [esp + 0x8d0], bl
cmp eax, ebp
je 0x429821
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x429818
cmp al, 0xff
je 0x429818
dec al
mov byte [ecx], al
jmp 0x429821
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x8f8]
lea edx, [esp + 0x1b0]
push ecx
lea eax, [esp + 0x48]
push edx
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_char_const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
push str..lnk
lea ecx, [esp + 0x30]
push eax
push ecx
mov byte [esp + 0x8e8], 0x10
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
mov eax, dword [eax + 4]
add esp, 0x18
cmp eax, ebp
jne 0x429862
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea edx, [esp + 0x6c0]
push 0x104
push edx
push 0xffffffffffffffff
push eax
push ebp
push ebp
call edi
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x42989b
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x429892
cmp al, 0xff
je 0x429892
dec al
mov byte [ecx], al
jmp 0x42989b
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x24], ebp
cmp ecx, ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x8d0], bl
je 0x4298d1
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x4298c8
cmp al, 0xff
je 0x4298c8
dec al
mov byte [ecx], al
jmp 0x4298d1
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [esp + 0x54]
lea edx, [esp + 0x6c0]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [esp + 0x54]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esp + 0x8f8]
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x48]
push ecx
push edx
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
push str..lnk
push eax
lea eax, [esp + 0x34]
mov byte [esp + 0x8e4], 0x11
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
mov eax, dword [eax + 4]
add esp, 0x18
cmp eax, ebp
jne 0x429937
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push 5
push ebp
push ebp
push eax
push 0x472d38
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [esp + 0x24]
cmp ecx, ebp
je 0x42996b
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x429962
cmp al, 0xff
je 0x429962
dec al
mov byte [ecx], al
jmp 0x42996b
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x24], ebp
cmp ecx, ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x8d0], bl
je 0x4299a1
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x429998
cmp al, 0xff
je 0x429998
dec al
mov byte [ecx], al
jmp 0x4299a1
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
push 0x472da0
lea ecx, [esp + 0xa0]
push 0x476b28
push ecx
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0xc
mov eax, dword [eax + 4]
mov esi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
cmp eax, ebp
mov byte [esp + 0x8d0], 0x12
je 0x4299d2
mov esi, eax
lea edx, [esp + 0x8f8]
push str..lnk
lea eax, [esp + 0x48]
push edx
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
mov eax, dword [eax + 4]
add esp, 0xc
cmp eax, ebp
jne 0x4299f8
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push esi
push eax
push 0x472d90
push 0x472d84
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [esp + 0x48]
cmp ecx, ebp
je 0x429a2d
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x429a24
cmp al, 0xff
je 0x429a24
dec al
mov byte [ecx], al
jmp 0x429a2d
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0x48], ebp
cmp ecx, ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x50], ebp
je 0x429a5f
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x429a56
cmp al, 0xff
je 0x429a56
dec al
mov byte [ecx], al
jmp 0x429a5f
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x90]
cmp ecx, ebp
je 0x429a86
mov al, byte [ecx - 1]
test al, al
je 0x429a7c
cmp al, 0xff
je 0x429a7c
dec al
mov byte [ecx - 1], al
jmp 0x429a86
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x90], ebp
cmp ecx, ebp
mov dword [esp + 0x94], ebp
mov dword [esp + 0x98], ebp
je 0x429ac2
mov al, byte [ecx - 1]
test al, al
je 0x429ab8
cmp al, 0xff
je 0x429ab8
dec al
mov byte [ecx - 1], al
jmp 0x429ac2
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x80], ebp
cmp ecx, ebp
mov dword [esp + 0x84], ebp
mov dword [esp + 0x88], ebp
je 0x429afb
mov al, byte [ecx - 1]
test al, al
je 0x429af1
cmp al, 0xff
je 0x429af1
dec al
mov byte [ecx - 1], al
jmp 0x429afb
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x6c], ebp
cmp ecx, ebp
mov dword [esp + 0x70], ebp
mov dword [esp + 0x74], ebp
je 0x429b2b
mov al, byte [ecx - 1]
test al, al
je 0x429b21
cmp al, 0xff
je 0x429b21
dec al
mov byte [ecx - 1], al
jmp 0x429b2b
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x5c], ebp
cmp ecx, ebp
mov dword [esp + 0x60], ebp
mov dword [esp + 0x64], ebp
je 0x429b5b
mov al, byte [ecx - 1]
test al, al
je 0x429b51
cmp al, 0xff
je 0x429b51
dec al
mov byte [ecx - 1], al
jmp 0x429b5b
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x8dc]
mov dword [esp + 0x34], ebp
cmp ecx, ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
je 0x429b8e
mov al, byte [ecx - 1]
test al, al
je 0x429b84
cmp al, 0xff
je 0x429b84
dec al
mov byte [ecx - 1], al
jmp 0x429b8e
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x8ec]
mov dword [esp + 0x8dc], ebp
cmp ecx, ebp
mov dword [esp + 0x8e0], ebp
mov dword [esp + 0x8e4], ebp
je 0x429bca
mov al, byte [ecx - 1]
test al, al
je 0x429bc0
cmp al, 0xff
je 0x429bc0
dec al
mov byte [ecx - 1], al
jmp 0x429bca
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x8fc]
mov dword [esp + 0x8ec], ebp
cmp ecx, ebp
mov dword [esp + 0x8f0], ebp
mov dword [esp + 0x8f4], ebp
je 0x429c06
mov al, byte [ecx - 1]
test al, al
je 0x429bfc
cmp al, 0xff
je 0x429bfc
dec al
mov byte [ecx - 1], al
jmp 0x429c06
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x90c]
mov dword [esp + 0x8fc], ebp
cmp ecx, ebp
mov dword [esp + 0x900], ebp
mov dword [esp + 0x904], ebp
je 0x429c42
mov al, byte [ecx - 1]
test al, al
je 0x429c38
cmp al, 0xff
je 0x429c38
dec al
mov byte [ecx - 1], al
jmp 0x429c42
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x8c8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x8c4
ret 0x44