Function at 0x48d8c0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52cc89
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x5ba11c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, edx
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 4], 0
mov edi, dword [esi]
mov ecx, dword [eax]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], edi
call fcn.004a5e70
test al, al
jne 0x48dbae
call fcn.004d03a0
mov esi, eax
mov ecx, esi
call fcn.004d0140
cmp byte [0x5c2104], 0
jne 0x48d983
mov ecx, 0xf0
call fcn.004d0a00
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x48d978
sub esp, 8
xorps xmm0, xmm0
mov ecx, eax
movsd qword [esp], xmm0
push 0x5c2104
sub esp, 0xc
push 0x12c
push str.C:BuildAgentwork4d643bb3f4c71f96RemoteInstallerInstallerUI_agent_install_action.cpp
push 0x20
call fcn.004d0210
jmp 0x48d97a
xor eax, eax
mov byte [ebp - 4], 0
mov dword [0x5c495c], eax
mov ecx, esi
call fcn.004d0150
mov ecx, dword [0x5c495c]
lea ecx, [ecx + 0xd0]
call fcn.004d0140
mov eax, dword [0x5c495c]
mov ecx, dword [ebp - 0x58]
mov eax, dword [eax]
mov esi, dword [ecx]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x44], eax
call fcn.0044d220
mov ecx, eax
test ecx, ecx
je 0x48e270
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x40], eax
push esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00452e50
test al, al
jne 0x48d9e3
push esi
lea ecx, [ebp - 0x40]
call fcn.00452330
mov byte [ebp - 4], 3
mov esi, dword [ebp - 0x40]
push esi
push str.MSI_file___s_does_not_exist
push dword [0x5c495c]
call dword [ebp - 0x44]
add esp, 0xc
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov byte [ebp - 4], 4
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48da1a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov ecx, dword [0x5c495c]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x5c495c]
lea ecx, [ecx + 0xd0]
call fcn.004d0150
mov byte [ebp - 4], 5
call fcn.0044d220
mov ecx, eax
test ecx, ecx
je 0x48e27a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x40], eax
push 0x70
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 6
call fcn.00452740
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 7
push eax
push dword [ebp - 0x58]
push ecx
mov ecx, edi
call fcn.00496da0
mov edx, dword [ebp - 0x40]
add edx, 0xfffffff0
mov byte [ebp - 4], 8
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48da99
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, 2
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.0044f250
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 0xa
call fcn.0044d220
mov ecx, eax
test ecx, ecx
je 0x48e284
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x40], eax
push 0x81
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xb
call fcn.00452740
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x40]
push dword [ebp - 0x44]
push eax
push ecx
mov ecx, edi
call fcn.00496680
mov edx, dword [ebp - 0x40]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xd
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48db0f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5c]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xe
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48db2d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [edi + 0x2c], 3
mov byte [ebp - 4], 0xf
call fcn.0044d220
mov ecx, eax
test ecx, ecx
je 0x48e28e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x40], eax
push 0x81
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x10
call fcn.00452740
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x11
push eax
mov ecx, edi
call fcn.004968a0
mov eax, dword [ebp - 0x40]
lea edx, [eax - 0x10]
mov byte [ebp - 4], 0x12
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x48db90
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004eabba
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x18], 1
mov eax, 0x580750
je 0x48dbbc
mov eax, dword [esi + 0x1c]
push eax
lea ecx, [ebp - 0x68]
call fcn.00452b60
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 0x13
push eax
lea edx, [esi + 0x10]
lea ecx, [ebp - 0x54]
call fcn.00452680
add esp, 4
mov byte [ebp - 4], 0x14
call fcn.004d03a0
mov edi, eax
mov ecx, edi
call fcn.004d0140
cmp byte [0x5c218e], 0
jne 0x48dc3e
mov ecx, 0xf0
call fcn.004d0a00
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 0x15
test eax, eax
je 0x48dc33
sub esp, 8
xorps xmm0, xmm0
mov ecx, eax
movsd qword [esp], xmm0
push 0x5c218e
sub esp, 0xc
push 0x138
push str.C:BuildAgentwork4d643bb3f4c71f96RemoteInstallerInstallerUI_agent_install_action.cpp
push 0x48
call fcn.004d0210
jmp 0x48dc35
xor eax, eax
mov byte [ebp - 4], 0x14
mov dword [0x5c4910], eax
mov ecx, edi
call fcn.004d0150
mov ecx, dword [0x5c4910]
lea ecx, [ecx + 0xd0]
call fcn.004d0140
mov eax, dword [0x5c4910]
mov esi, dword [esi + 8]
mov eax, dword [eax]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x50], eax
call fcn.0044d220
mov ecx, eax
test ecx, ecx
je 0x48e298
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x40], eax
push esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x16
call fcn.00452e50
test al, al
jne 0x48dc9c
push esi
lea ecx, [ebp - 0x40]
call fcn.00452330
mov eax, dword [ebp - 0x58]
mov byte [ebp - 4], 0x17
mov esi, dword [eax]
call fcn.0044d220
mov ecx, eax
test ecx, ecx
je 0x48e2a2
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x48], eax
push esi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x18
call fcn.00452e50
test al, al
jne 0x48dcdb
push esi
lea ecx, [ebp - 0x48]
call fcn.00452330
mov byte [ebp - 4], 0x19
mov edi, dword [ebp - 0x40]
mov esi, dword [ebp - 0x48]
push edi
push esi
push str.Copying_file___s__to___s_...
push dword [0x5c4910]
call dword [ebp - 0x50]
add esp, 0x10
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov byte [ebp - 4], 0x1a
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48dd16
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 0x1b
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x48dd31
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x14
mov ecx, dword [0x5c4910]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x5c4910]
lea ecx, [ecx + 0xd0]
call fcn.004d0150
xor dl, dl
lea ecx, [ebp - 0x54]
call fcn.004cb4f0
mov edi, dword [ebp - 0x6c]
cmp byte [edi + 0x15], 0
jne 0x48dd71
push ecx
mov ecx, dword [ebp - 0x64]
lea eax, [ebp - 0x54]
push eax
call fcn.004cb300
mov byte [ebp - 4], 0x1c
call fcn.0044d220
mov ecx, eax
test ecx, ecx
je 0x48e2ac
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x48], eax
push 0x72
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x1d
call fcn.00452740
lea eax, [edi + 0x1c]
mov byte [ebp - 4], 0x1e
push eax
mov edx, 0x5858b4
lea ecx, [ebp - 0x6c]
call fcn.0046ea00
add esp, 4
push 0x5858b8
mov edx, eax
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x64]
call fcn.004525a0
add esp, 4
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x20
push ecx
mov edx, eax
lea ecx, [ebp - 0x60]
call fcn.00452680
add esp, 4
mov edx, dword [ebp - 0x64]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x23
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48de00
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x6c]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x25
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48de1e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x27
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48de3c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x26
push dword [ebp - 0x60]
mov eax, dword [ebp - 0x5c]
add eax, 0x34
push str._s...
push eax
call fcn.00453b60
mov ecx, dword [ebp - 0x44]
add esp, 0xc
mov ecx, dword [ecx + 0x24]
test ecx, ecx
je 0x48e2b6
mov eax, dword [ecx]
push edi
call dword [eax + 8]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x74], edi
movups xmm0, xmmword [ebp - 0x80]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x3c], vtable.std::_Func_impl_no_alloc_class__lambda_813d9cfec1dbf79d82e84ef9528c0282___unsigned_long_int__union__LARGE_INTEGER__union__LARGE_INTEGER__union__LARGE_INTEGER__union__LARGE_INTEGER__unsigned_long_int__unsigned_long_int__void___void__.0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x28
push eax
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x58]
push 0x48d200
push dword [ebp - 0x54]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
jne 0x48e140
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x44], eax
call fcn.004d03a0
mov edi, eax
mov ecx, edi
call fcn.004d0140
cmp byte [0x5c217c], 0
jne 0x48df29
mov ecx, 0xf0
call fcn.004d0a00
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 0x29
test eax, eax
je 0x48df22
sub esp, 8
xorps xmm0, xmm0
mov ecx, eax
movsd qword [esp], xmm0
push 0x5c217c
sub esp, 0xc
push 0x155
push str.C:BuildAgentwork4d643bb3f4c71f96RemoteInstallerInstallerUI_agent_install_action.cpp
push 0x20
call fcn.004d0210
jmp 0x48df24
xor eax, eax
mov dword [0x5c49c8], eax
mov ecx, edi
call fcn.004d0150
mov ecx, dword [0x5c49c8]
lea ecx, [ecx + 0xd0]
call fcn.004d0140
mov eax, dword [0x5c49c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x50]
mov edx, dword [ebp - 0x44]
call fcn.0044f250
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x40]
push dword [eax]
call fcn.004523d0
mov edx, dword [ebp - 0x50]
mov edi, eax
mov dword [ebp - 0x4c], 1
add edx, 0xfffffff0
mov byte [ebp - 4], 0x2c
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48df92
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x2a
push dword [edi]
push dword [0x5c49c8]
call dword [ebp - 0x48]
mov edx, dword [ebp - 0x40]
add esp, 8
add edx, 0xfffffff0
mov byte [ebp - 4], 0x2d
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48dfc2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x28
mov ecx, dword [0x5c49c8]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x5c49c8]
lea ecx, [ecx + 0xd0]
call fcn.004d0150
push 0x72
lea ecx, [ebp - 0x4c]
call fcn.00454430
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x2e
mov edi, dword [ebp - 0x5c]
push ecx
mov ecx, dword [ebp - 0x58]
push ecx
push eax
push ecx
mov ecx, edi
call fcn.00496b80
mov edx, dword [ebp - 0x4c]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x2f
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48e022
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x44]
call fcn.0044f250
mov dword [ebp - 0x4c], eax
push 0x81
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x30
call fcn.00454430
mov byte [ebp - 4], 0x31
push dword [ebp - 0x4c]
push eax
push ecx
mov ecx, edi
call fcn.00496680
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x32
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48e073
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x44]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x33
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48e091
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x4c]
push 0x81
mov dword [edi + 0x2c], 3
call fcn.00454430
push eax
mov ecx, edi
mov byte [ebp - 4], 0x34
call fcn.004968a0
mov edx, dword [ebp - 0x4c]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x35
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48e0d3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x36
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x48e0f5
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea eax, [ebp - 0x3c]
cmp ecx, eax
setne al
push eax
call edx
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x60]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x37
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48e113
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x54]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x38
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48e131
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x68]
lea edx, [eax - 0x10]
mov byte [ebp - 4], 0x39
jmp 0x48db7e
mov byte [ebp - 4], 0x3a
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x48e162
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea eax, [ebp - 0x3c]
cmp ecx, eax
setne al
push eax
call edx
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x60]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x3b
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48e180
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x54]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x3c
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48e19e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x68]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x3d
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x48e1ba
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, 1
jmp 0x48db92
push 0x80004005
call fcn.0044a700
push 0x80004005
call fcn.0044a700
push 0x80004005
call fcn.0044a700
push 0x80004005
call fcn.0044a700
push 0x80004005
call fcn.0044a700
push 0x80004005
call fcn.0044a700
push 0x80004005
call fcn.0044a700
call fcn.004d1af6
int3