Function at 0x56d520
Capabilities:
Check if file exists
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x637395
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x274c
call fcn.005b5230
mov eax, dword [0x6b278c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x268c], ecx
mov dword [ebp - 4], 2
mov byte [ebp - 0x120], 0
push 0x103
push 0
lea eax, [ebp - 0x11f]
push eax
call fcn.005b4de0
add esp, 0xc
mov byte [ebp - 0x228], 0
push 0x103
push 0
lea ecx, [ebp - 0x227]
push ecx
call fcn.005b4de0
add esp, 0xc
lea edx, [ebp - 0x120]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x104
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea edx, [ebp - 0x228]
push edx
call fcn.005b5990
add esp, 4
test eax, eax
jbe 0x56d5ed
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x268c]
call fcn.00414070
mov byte [ebp - 0x330], 0
push 0x103
push 0
lea ecx, [ebp - 0x32f]
push ecx
call fcn.005b4de0
add esp, 0xc
lea edx, [ebp + 0x40]
push edx
call fcn.0043a560
add esp, 4
push 0
push str.360se.exe
lea ecx, [ebp + 0x40]
call fcn.00431a70
cmp eax, dword [0x63f3a0]
je 0x56d644
lea eax, [ebp - 0x330]
push eax
mov ecx, dword [ebp - 0x268c]
call fcn.00569c10
jmp 0x56d71c
push 0
push str.360chrome.exe
lea ecx, [ebp + 0x40]
call fcn.00431a70
cmp eax, dword [0x63f3a0]
je 0x56d672
lea ecx, [ebp - 0x330]
push ecx
mov ecx, dword [ebp - 0x268c]
call fcn.00569de0
jmp 0x56d71c
push 0
push str.qqbrowser.exe
lea ecx, [ebp + 0x40]
call fcn.00431a70
cmp eax, dword [0x63f3a0]
je 0x56d69d
lea edx, [ebp - 0x330]
push edx
mov ecx, dword [ebp - 0x268c]
call fcn.00569fb0
jmp 0x56d71c
push 0
push str.2345explorer.exe
lea ecx, [ebp + 0x40]
call fcn.00431a70
cmp eax, dword [0x63f3a0]
je 0x56d6c8
lea eax, [ebp - 0x330]
push eax
mov ecx, dword [ebp - 0x268c]
call fcn.00569fd0
jmp 0x56d71c
push 0
push str.liebao.exe
lea ecx, [ebp + 0x40]
call fcn.00431a70
cmp eax, dword [0x63f3a0]
je 0x56d6f3
lea ecx, [ebp - 0x330]
push ecx
mov ecx, dword [ebp - 0x268c]
call fcn.0056a0d0
jmp 0x56d71c
push 0
push str.chrome.exe
lea ecx, [ebp + 0x40]
call fcn.00431a70
cmp eax, dword [0x63f3a0]
je 0x56d71c
lea edx, [ebp - 0x330]
push edx
mov ecx, dword [ebp - 0x268c]
call fcn.0056a210
lea eax, [ebp - 0x330]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x56d780
lea ecx, [ebp - 0x330]
push ecx
push str.cookie_path_err__s_
call fcn.00412530
push eax
call fcn.0040d040
add esp, 0xc
mov byte [ebp - 0x25d9], 1
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.0040e3e0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x24]
call fcn.0040e3e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x40]
call fcn.0040e3e0
mov al, byte [ebp - 0x25d9]
jmp 0x56e2f4
mov dword [ebp - 0x334], 0
mov byte [ebp - 4], 3
push 0x40
push 0
lea edx, [ebp - 0x480]
push edx
call fcn.005b4de0
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x440]
push eax
call fcn.005b4de0
add esp, 0xc
push 0x40
lea ecx, [ebp - 0x480]
push ecx
mov ecx, dword [ebp - 0x268c]
call fcn.0056b560
mov byte [ebp - 0x268d], al
movzx edx, byte [ebp - 0x268d]
test edx, edx
jne 0x56d834
call fcn.00412530
mov dword [ebp - 0x2694], eax
push str.cookie_GetUniqueId_err
mov eax, dword [ebp - 0x2694]
push eax
call fcn.0040d040
add esp, 8
mov byte [ebp - 0x25da], 1
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.0040e3e0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x24]
call fcn.0040e3e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x40]
call fcn.0040e3e0
mov al, byte [ebp - 0x25da]
jmp 0x56e2f4
mov ecx, dword [ebp - 0x268c]
call fcn.0040e460
mov dword [ebp - 0x2698], eax
lea ecx, [ebp - 0x480]
push ecx
mov edx, dword [ebp - 0x2698]
push edx
push 0x65c2ac
lea eax, [ebp - 0x440]
push eax
call fcn.005b763d
add esp, 0x10
lea ecx, [ebp - 0x440]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x56d902
lea edx, [ebp - 0x440]
push edx
lea ecx, [ebp - 0x25f8]
call fcn.0040e3a0
mov dword [ebp - 0x269c], eax
mov byte [ebp - 4], 4
lea eax, [ebp - 0x25f8]
push eax
lea ecx, [ebp - 0x2614]
push ecx
call fcn.00439f10
add esp, 8
mov dword [ebp - 0x26a0], eax
mov edx, dword [ebp - 0x26a0]
mov dword [ebp - 0x26a4], edx
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x26a4]
call fcn.0040e5d0
mov dword [ebp - 0x26a8], eax
mov eax, dword [ebp - 0x26a8]
push eax
call fcn.004396c0
add esp, 4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2614]
call fcn.0040e530
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x25f8]
call fcn.0040e3e0
push 1
lea ecx, [ebp - 0x440]
push ecx
lea edx, [ebp - 0x330]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x56da74
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x2630]
call fcn.0040e3a0
mov dword [ebp - 0x26ac], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x330]
push ecx
lea ecx, [ebp - 0x2668]
call fcn.0040e3a0
mov dword [ebp - 0x26b0], eax
mov byte [ebp - 4], 7
lea edx, [ebp - 0x2630]
push edx
lea eax, [ebp - 0x264c]
push eax
call fcn.00439f10
add esp, 8
mov dword [ebp - 0x26b4], eax
mov ecx, dword [ebp - 0x26b4]
mov dword [ebp - 0x26b8], ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x26b8]
call fcn.0040e5d0
mov dword [ebp - 0x26bc], eax
lea edx, [ebp - 0x2668]
push edx
lea eax, [ebp - 0x2684]
push eax
call fcn.00439f10
add esp, 8
mov dword [ebp - 0x26c0], eax
mov ecx, dword [ebp - 0x26c0]
mov dword [ebp - 0x26c4], ecx
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x26c4]
call fcn.0040e5d0
mov dword [ebp - 0x26c8], eax
call fcn.00412530
mov dword [ebp - 0x26cc], eax
mov edx, dword [ebp - 0x26bc]
push edx
mov eax, dword [ebp - 0x26c8]
push eax
push str.cookie_CopyFileA_err__s__to___s_
mov ecx, dword [ebp - 0x26cc]
push ecx
call fcn.0040d040
add esp, 0x10
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2684]
call fcn.0040e530
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x264c]
call fcn.0040e530
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2668]
call fcn.0040e3e0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2630]
call fcn.0040e3e0
mov byte [ebp - 0x2685], 1
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.0040e3e0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x24]
call fcn.0040e3e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x40]
call fcn.0040e3e0
mov al, byte [ebp - 0x2685]
jmp 0x56e2f4
lea edx, [ebp - 0x440]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x56e297
lea ecx, [ebp - 0x48c]
call fcn.0047e5d0
mov dword [ebp - 0x26d0], eax
mov byte [ebp - 4], 0xa
push 1
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x48c]
call fcn.0047e680
lea ecx, [ebp - 0x24cc]
call fcn.0056ee30
mov dword [ebp - 0x26d4], eax
mov byte [ebp - 4], 0xb
push 0x100
call fcn.005b5429
add esp, 4
mov dword [ebp - 0x490], eax
push str.SELECT__FROM_cookies_where
mov ecx, dword [ebp - 0x490]
push ecx
call fcn.005b763d
add esp, 8
push str.host_key_like__
mov edx, dword [ebp - 0x490]
push edx
call fcn.005b7750
add esp, 8
lea ecx, [ebp + 0x24]
call fcn.0040e460
mov dword [ebp - 0x26d8], eax
mov eax, dword [ebp - 0x26d8]
push eax
mov ecx, dword [ebp - 0x490]
push ecx
call fcn.005b7750
add esp, 8
push 0x65c330
mov edx, dword [ebp - 0x490]
push edx
call fcn.005b7750
add esp, 8
mov dword [ebp - 0x24ac], 0
mov eax, dword [ebp - 0x490]
push eax
lea ecx, [ebp - 0x4a8]
push ecx
lea ecx, [ebp - 0x48c]
call fcn.0047e890
mov dword [ebp - 0x26dc], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x4a8]
call fcn.0047d730
mov byte [ebp - 0x26dd], al
movzx edx, byte [ebp - 0x26dd]
test edx, edx
jne 0x56e215
lea ecx, [ebp - 0x25b0]
call fcn.0056e360
mov dword [ebp - 0x26e4], eax
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x24d8], 0
mov dword [ebp - 0x24d4], 0
mov dword [ebp - 0x24d0], 0
mov dword [ebp - 0x25b4], 0
push 0x1000
push 0
lea eax, [ebp - 0x24a8]
push eax
call fcn.005b4de0
add esp, 0xc
push 0x1000
push 0
lea ecx, [ebp - 0x14a8]
push ecx
call fcn.005b4de0
add esp, 0xc
mov byte [ebp - 4], 0xe
push 0x65c334
lea ecx, [ebp - 0x4a8]
call fcn.0047d540
mov byte [ebp - 0x26e5], al
movzx edx, byte [ebp - 0x26e5]
test edx, edx
jne 0x56dc3c
push 0x65b6d6
push str.host_key
lea ecx, [ebp - 0x4a8]
call fcn.0047d430
mov dword [ebp - 0x26ec], eax
mov eax, dword [ebp - 0x26ec]
mov dword [ebp - 0x24d8], eax
jmp 0x56dc4b
mov dword [ebp - 4], 0xd
mov byte [ebp - 4], 0x10
push 0x65c34c
lea ecx, [ebp - 0x4a8]
call fcn.0047d540
mov byte [ebp - 0x26ed], al
movzx ecx, byte [ebp - 0x26ed]
test ecx, ecx
jne 0x56dc9e
push 0x65b6d7
push 0x65c354
lea ecx, [ebp - 0x4a8]
call fcn.0047d430
mov dword [ebp - 0x26f4], eax
mov edx, dword [ebp - 0x26f4]
mov dword [ebp - 0x24d4], edx
jmp 0x56dcad
mov dword [ebp - 4], 0xd
mov byte [ebp - 4], 0x12
push 0x65c35c
lea ecx, [ebp - 0x4a8]
call fcn.0047d540
mov byte [ebp - 0x26f5], al
movzx eax, byte [ebp - 0x26f5]
test eax, eax
jne 0x56dd00
push 0x65b6ea
push 0x65c364
lea ecx, [ebp - 0x4a8]
call fcn.0047d430
mov dword [ebp - 0x26fc], eax
mov ecx, dword [ebp - 0x26fc]
mov dword [ebp - 0x24d0], ecx
jmp 0x56dd0f
mov dword [ebp - 4], 0xd
mov byte [ebp - 4], 0x14
push 0x65c36c
lea ecx, [ebp - 0x4a8]
call fcn.0047d540
mov byte [ebp - 0x26fd], al
movzx edx, byte [ebp - 0x26fd]
test edx, edx
jne 0x56dd62
push 0x65b6eb
push 0x65c374
lea ecx, [ebp - 0x4a8]
call fcn.0047d430
mov dword [ebp - 0x2704], eax
mov eax, dword [ebp - 0x2704]
mov dword [ebp - 0x25b4], eax
jmp 0x56dd71
mov dword [ebp - 4], 0xd
mov byte [ebp - 4], 0x16
push 0x65c37c
lea ecx, [ebp - 0x4a8]
call fcn.0047d540
mov byte [ebp - 0x2705], al
movzx ecx, byte [ebp - 0x2705]
test ecx, ecx
jne 0x56ddd5
push 0
push 0
push str.creation_utc
lea ecx, [ebp - 0x4a8]
call fcn.0047d330
mov dword [ebp - 0x2710], eax
mov dword [ebp - 0x270c], edx
mov edx, dword [ebp - 0x2710]
mov dword [ebp - 0x2508], edx
mov eax, dword [ebp - 0x270c]
mov dword [ebp - 0x2504], eax
jmp 0x56dde4
mov dword [ebp - 4], 0xd
mov byte [ebp - 4], 0x18
push 0x65c39c
lea ecx, [ebp - 0x4a8]
call fcn.0047d540
mov byte [ebp - 0x2711], al
movzx ecx, byte [ebp - 0x2711]
test ecx, ecx
jne 0x56de48
push 0
push 0
push str.expires_utc
lea ecx, [ebp - 0x4a8]
call fcn.0047d330
mov dword [ebp - 0x271c], eax
mov dword [ebp - 0x2718], edx
mov edx, dword [ebp - 0x271c]
mov dword [ebp - 0x2500], edx
mov eax, dword [ebp - 0x2718]
mov dword [ebp - 0x24fc], eax
jmp 0x56de57
mov dword [ebp - 4], 0xd
mov byte [ebp - 4], 0x1a
push 0x65c3b4
lea ecx, [ebp - 0x4a8]
call fcn.0047d540
mov byte [ebp - 0x271d], al
movzx ecx, byte [ebp - 0x271d]
test ecx, ecx
jne 0x56dea7
push 0
push 0x65c3bc
lea ecx, [ebp - 0x4a8]
call fcn.0047d2c0
mov dword [ebp - 0x2724], eax
mov edx, dword [ebp - 0x2724]
mov dword [ebp - 0x24f0], edx
jmp 0x56deb6
mov dword [ebp - 4], 0xd
mov byte [ebp - 4], 0x1c
push 0x65c3c4
lea ecx, [ebp - 0x4a8]
call fcn.0047d540
mov byte [ebp - 0x2725], al
movzx eax, byte [ebp - 0x2725]
test eax, eax
jne 0x56df06
push 0
push 0x65c3d0
lea ecx, [ebp - 0x4a8]
call fcn.0047d2c0
mov dword [ebp - 0x272c], eax
mov ecx, dword [ebp - 0x272c]
mov dword [ebp - 0x24ec], ecx
jmp 0x56df15
mov dword [ebp - 4], 0xd
mov byte [ebp - 4], 0x1e
push 0x65c3dc
lea ecx, [ebp - 0x4a8]
call fcn.0047d540
mov byte [ebp - 0x272d], al
movzx edx, byte [ebp - 0x272d]
test edx, edx
jne 0x56df79
push 0
push 0
push str.last_access_utc
lea ecx, [ebp - 0x4a8]
call fcn.0047d330
mov dword [ebp - 0x2738], eax
mov dword [ebp - 0x2734], edx
mov eax, dword [ebp - 0x2738]
mov dword [ebp - 0x24f8], eax
mov ecx, dword [ebp - 0x2734]
mov dword [ebp - 0x24f4], ecx
jmp 0x56df88
mov dword [ebp - 4], 0xd
mov byte [ebp - 4], 0x20
push 0x65c3fc
lea ecx, [ebp - 0x4a8]
call fcn.0047d540
mov byte [ebp - 0x2739], al
movzx edx, byte [ebp - 0x2739]
test edx, edx
jne 0x56dfd8
push 0
push str.has_expires
lea ecx, [ebp - 0x4a8]
call fcn.0047d2c0
mov dword [ebp - 0x2740], eax
mov eax, dword [ebp - 0x2740]
mov dword [ebp - 0x24e8], eax
jmp 0x56dfe7
mov dword [ebp - 4], 0xd
cmp dword [ebp - 0x24d8], 0
je 0x56e1f6
cmp dword [ebp - 0x24d4], 0
je 0x56e1f6
cmp dword [ebp - 0x25b4], 0
je 0x56e1f6
lea ecx, [ebp - 0x25d0]
call fcn.00414040
mov dword [ebp - 0x2744], eax
mov byte [ebp - 4], 0x22
lea ecx, [ebp + 0x24]
call fcn.0040e460
mov dword [ebp - 0x2748], eax
mov ecx, dword [ebp - 0x2748]
push ecx
mov edx, dword [ebp - 0x24d8]
push edx
call fcn.005bca30
add esp, 8
test eax, eax
je 0x56e1e7
mov eax, dword [ebp - 0x24d0]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x56e131
mov byte [ebp - 4], 0x23
push 0x65c414
lea ecx, [ebp - 0x4a8]
call fcn.0047d540
mov byte [ebp - 0x2749], al
movzx edx, byte [ebp - 0x2749]
test edx, edx
jne 0x56e119
mov dword [ebp - 0x25d8], 0
lea eax, [ebp - 0x25d8]
push eax
push str.encrypted_value
lea ecx, [ebp - 0x4a8]
call fcn.0047d4e0
mov dword [ebp - 0x2750], eax
mov ecx, dword [ebp - 0x2750]
mov dword [ebp - 0x25d4], ecx
push 0x1000
lea edx, [ebp - 0x24a8]
push edx
mov eax, dword [ebp - 0x25d4]
push eax
mov ecx, dword [ebp - 0x268c]
call fcn.0056b010
mov dword [ebp - 0x2754], eax
cmp dword [ebp - 0x2754], 0
je 0x56e119
lea ecx, [ebp - 0x24a8]
push ecx
call fcn.005b5990
add esp, 4
test eax, eax
jbe 0x56e119
lea edx, [ebp - 0x24a8]
push edx
lea eax, [ebp - 0x14a8]
push eax
call fcn.005b7740
add esp, 8
jmp 0x56e128
mov dword [ebp - 4], 0x22
jmp 0x56e147
mov ecx, dword [ebp - 0x24d0]
push ecx
lea edx, [ebp - 0x14a8]
push edx
call fcn.005b7740
add esp, 8
lea eax, [ebp - 0x14a8]
push eax
call fcn.005b5990
add esp, 4
test eax, eax
jbe 0x56e1e7
lea ecx, [ebp + 8]
call fcn.0040e460
mov dword [ebp - 0x2758], eax
mov ecx, dword [ebp - 0x2758]
push ecx
mov edx, dword [ebp - 0x24d4]
push edx
call fcn.005bd89d
add esp, 8
test eax, eax
jne 0x56e1e7
push 0x65c434
lea eax, [ebp - 0x14a8]
push eax
call fcn.005bd89d
add esp, 8
test eax, eax
jne 0x56e1e7
call fcn.00412530
mov dword [ebp - 0x275c], eax
push 0x65c438
mov ecx, dword [ebp - 0x275c]
push ecx
call fcn.0040d040
add esp, 8
mov dword [ebp - 0x24ac], 1
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x25d0]
call fcn.0040e3e0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x25b0]
call fcn.0056e4b0
jmp 0x56e215
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x25d0]
call fcn.0040e3e0
lea ecx, [ebp - 0x4a8]
call fcn.0047d750
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x25b0]
call fcn.0056e4b0
jmp 0x56db67
lea ecx, [ebp - 0x4a8]
call fcn.0047d7e0
lea ecx, [ebp - 0x48c]
call fcn.0047e700
cmp dword [ebp - 0x24ac], 0
setne dl
mov byte [ebp - 0x2686], dl
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x4a8]
call fcn.0047d0a0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x24cc]
call fcn.0056e340
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x48c]
call fcn.0047e630
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.0040e3e0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x24]
call fcn.0040e3e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x40]
call fcn.0040e3e0
mov al, byte [ebp - 0x2686]
jmp 0x56e2f4
jmp 0x56e2a6
mov dword [ebp - 4], 2
push str.cookie_err_unkonw
call fcn.00412530
push eax
call fcn.0040d040
add esp, 8
mov byte [ebp - 0x2687], 1
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.0040e3e0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x24]
call fcn.0040e3e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x40]
call fcn.0040e3e0
mov al, byte [ebp - 0x2687]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005b4b30
mov esp, ebp
pop ebp
ret 0x54