Function at 0x423030
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460698
mov eax, dword fs:[0]
push eax
mov eax, 0x1674
call fcn.00429500
mov eax, dword [0x47d144]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x209
mov dword [ebp - 4], 0
lea eax, [ebp - 0x163b]
push 0
push eax
mov dword [ebp - method.BootContainer.virtual_0], vtable.BootContainer.0
mov dword [ebp - 0x1640], 0
mov byte [ebp - 0x163c], 0
call fcn.00440840
push 0x208
lea eax, [ebp - 0x142c]
mov dword [ebp - 0x1430], 0
push 0
push eax
call fcn.00440840
add esp, 0x18
mov dword [ebp - 0x1224], 0
lea ecx, [ebp - 0x1644]
mov byte [ebp - 4], 1
call fcn.0041cea0
test al, al
jne 0x4230df
push 0x3f4
jmp 0x4231bd
push 0x473518
push 0
call fcn.0041cd80
test al, al
je 0x4230f8
mov byte [ebp - 0x163c], 1
jmp 0x423101
cmp byte [ebp - 0x163c], 0
je 0x42310f
call fcn.004253f0
test al, al
sete byte [ebp - 0x163c]
push str.silent
push 0x4735ec
call fcn.0041cd80
test al, al
je 0x423135
cmp byte [ebp - 0x163c], 0
je 0x423135
push 0x3f5
jmp 0x4231bd
push 0x104
lea eax, [ebp - 0x163a]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x163a]
push eax
call dword [0x47d0ec]
push 8
push str.bts.session
lea ecx, [ebp - 0x142c]
mov dword [ebp - 0x1430], eax
mov dword [ebp - 0x1224], str.bts.session
call fcn.00409a70
add esp, 8
test al, al
jne 0x423211
push 0x101
push str.eset.temp
lea ecx, [ebp - 0x142c]
mov dword [ebp - 0x1224], str.eset.temp
call fcn.00409a70
add esp, 8
test al, al
jne 0x423211
xor eax, eax
mov word [ebp - 0x142c], ax
mov dword [ebp - 0x1224], eax
push 0x3ea
mov eax, dword [ebp - 0x1644]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4623b8]
lea ecx, [ebp - 0x1644]
call esi
test edi, edi
je 0x423206
push edi
lea ecx, [ebp - 0x1644]
call fcn.0041d2f0
push str.silent
push 0x4735ec
call fcn.0041cd80
test al, al
je 0x423206
push 0
push 0
push 0x10
push edi
call dword [0x47d0cc]
mov esi, dword [ebp - 0x1640]
jmp 0x423685
test edi, edi
je 0x423247
push str.silent
push 0x4735ec
call fcn.0041cd80
test al, al
jne 0x423247
cmp byte [ebp - 0x163b], al
jne 0x423247
push str.BtsIntroShow
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0
push 0
push eax
push edi
call dword [0x47d0cc]
xor eax, eax
push 2
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x163a]
push 0x471e24
push eax
call fcn.00443b01
add esp, 0xc
test eax, eax
je 0x4233fe
push 3
lea eax, [ebp - 0x163a]
push eax
lea eax, [ebp - 0x18]
push 4
push eax
call fcn.004474cf
add esp, 0x10
lea eax, [ebp - 0x18]
push eax
call dword [0x47d0f0]
cmp eax, 4
je 0x4233fe
lea ecx, [ebp - 0x1644]
call fcn.0041cb80
test al, al
je 0x423651
cmp dword [ebp + 0x1c], 8
lea esi, [ebp + 8]
jb 0x4232b6
mov esi, dword [ebp + 8]
push 0x208
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.00440840
push 0x1000
lea eax, [ebp - 0x1220]
push 0
push eax
call fcn.00440840
push dword [ebp - 0x1430]
lea eax, [ebp - 0x142c]
mov dword [ebp - 0x1678], 0
push eax
push str.__s_s_
lea eax, [ebp - 0x220]
mov dword [ebp - 0x1660], 0
push 0x104
push eax
mov dword [ebp - 0x165c], 0
mov dword [ebp - 0x1658], 0
mov dword [ebp - 0x1654], 0
mov dword [ebp - 0x1650], 0
mov dword [ebp - 0x164c], 0
mov dword [ebp - 0x1648], 0
call fcn.0041d3f0
add esp, 0x2c
lea eax, [ebp - 0x163a]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.__bts_container
push str._s__d___s___s
lea eax, [ebp - 0x1220]
push 0x800
push eax
call fcn.0041d3f0
add esp, 0x1c
push str.__bts_container
push 0
call fcn.0041cd80
test al, al
jne 0x423395
lea esi, [ebp - 0x1220]
movzx eax, byte [ebp - 0x163c]
lea ecx, [ebp - 0x1644]
neg eax
mov dword [ebp - 0x1680], 0x3c
mov dword [ebp - 0x167c], 0x440
sbb eax, eax
mov dword [ebp - 0x166c], esi
and eax, str.runas
mov dword [ebp - 0x1664], 1
mov dword [ebp - 0x1674], eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x1670], eax
lea eax, [ebp - 0x142c]
mov dword [ebp - 0x1668], eax
lea eax, [ebp - 0x1680]
push eax
call fcn.0041d240
jmp 0x423651
push 0x208
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.00440840
push dword [ebp - 0x1430]
lea eax, [ebp - 0x142c]
push eax
push 0x473554
lea eax, [ebp - 0x220]
push 0x104
push eax
call fcn.0041d3f0
add esp, 0x20
lea eax, [ebp - 0x220]
push 1
push eax
lea eax, [ebp - 0x163a]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x423517
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x13a
ja 0x42346e
je 0x4234c6
cmp eax, 0x27
je 0x4234c6
cmp eax, 0x70
jmp 0x423473
cmp eax, 0x50f
je 0x4234c6
mov eax, dword [ebp - 0x1644]
mov esi, dword [eax + 4]
cmp esi, method.BootContainer.virtual_4
jne 0x4234ac
mov eax, dword [ebp - 0x1640]
test eax, eax
js 0x423651
cmp eax, 9
jge 0x423651
mov dword [ebp - 0x1640], 0x3f4
jmp 0x423651
push 0x3f4
mov ecx, esi
call dword [0x4623b8]
lea ecx, [ebp - 0x1644]
call esi
jmp 0x423651
mov eax, dword [ebp - 0x1644]
mov esi, dword [eax + 4]
cmp esi, method.BootContainer.virtual_4
jne 0x4234fd
mov eax, dword [ebp - 0x1640]
test eax, eax
js 0x423651
cmp eax, 9
jge 0x423651
mov dword [ebp - 0x1640], 0x3f8
jmp 0x423651
push 0x3f8
mov ecx, esi
call dword [0x4623b8]
lea ecx, [ebp - 0x1644]
call esi
jmp 0x423651
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x163a]
push 0x104
push eax
call fcn.004476de
add esp, 0xc
lea eax, [ebp - 0x163a]
push eax
call dword [0x47d0ec]
cmp dword [ebp + 0x1c], 8
lea esi, [ebp + 8]
mov dword [ebp - 0x1430], eax
jb 0x423551
mov esi, dword [ebp + 8]
push 0x1000
lea eax, [ebp - 0x1220]
push 0
push eax
call fcn.00440840
add esp, 0xc
mov dword [ebp - 0x1678], 0
lea eax, [ebp - 0x163a]
mov dword [ebp - 0x1674], 0
mov dword [ebp - 0x1660], 0
mov dword [ebp - 0x165c], 0
push esi
push eax
mov dword [ebp - 0x1658], 0
mov dword [ebp - 0x1654], 0
mov dword [ebp - 0x1650], 0
mov dword [ebp - 0x164c], 0
mov dword [ebp - 0x1648], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.__bts_container
push str._s__d___s___s
lea eax, [ebp - 0x1220]
push 0x800
push eax
call fcn.0041d3f0
lea eax, [ebp - 0x163a]
mov dword [ebp - 0x1680], 0x3c
mov dword [ebp - 0x1670], eax
lea ecx, [ebp - 0x1644]
lea eax, [ebp - 0x1220]
mov dword [ebp - 0x167c], 0x440
mov dword [ebp - 0x166c], eax
add esp, 0x1c
lea eax, [ebp - 0x142c]
mov dword [ebp - 0x1664], 1
mov dword [ebp - 0x1668], eax
lea eax, [ebp - 0x1680]
push eax
call fcn.0041d240
push ecx
lea ecx, [ebp - 0x142c]
call fcn.00409cf0
add esp, 4
mov esi, dword [ebp - 0x1640]
test edi, edi
je 0x423685
lea eax, [esi - 0x3e8]
cmp eax, 0x3e6
ja 0x4236bd
cmp esi, 0x3fa
jl 0x4236c5
cmp esi, 0x3fb
jg 0x4236c5
push 0
push 0
push 0x10
push edi
call dword [0x47d0cc]
mov edx, dword [ebp + 0x1c]
mov dword [ebp - method.BootContainer.virtual_0], vtable.BootContainer.0
cmp edx, 8
jb 0x4236f0
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4236e6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42370d
jmp 0x4236e6
cmp esi, 0x10000
jl 0x423678
push str.silent
push 0x4735ec
call fcn.0041cd80
test al, al
jne 0x423678
push edi
lea ecx, [ebp - 0x1644]
call fcn.0041d2f0
jmp 0x423685
push edx
push ecx
call fcn.004281c2
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004281b1
mov esp, ebp
pop ebp
ret
call fcn.00443d74
int3