Function at 0x401630
Capabilities:
Copy file
Query environment variable

Disassembly:
sub esp, 0x420
mov ecx, 0x4015f0
lea edx, [esp + 4]
push ebx
push esi
mov eax, dword [ecx]
push edi
mov ebx, dword [ecx + 4]
push ebp
mov dword [edx], eax
mov ebp, dword [ecx + 8]
mov al, byte [ecx + 0xc]
xor esi, esi
push 0x104
lea ecx, [esp + 0x22c]
mov dword [edx + 4], ebx
push ecx
mov dword [edx + 8], ebp
push str.windir
mov byte [edx + 0xc], al
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x401695
mov ebp, dword [esp + 0x434]
push 0x76
mov dword [0x40606c], 2
push ebp
call fcn.00401000
jmp 0x40194d
lea eax, [esp + 0x124]
lea ecx, [esp + 0x228]
push eax
push 0x401600
push ecx
call fcn.00401970
lea ecx, [esp + 0x32c]
lea edx, [esp + 0x228]
push ecx
push 0x40160c
push edx
call fcn.00401970
lea ecx, [esp + 0x124]
push 0x401618
push ecx
call fcn.004024d7
add esp, 8
mov edi, eax
test edi, edi
jne 0x401702
mov ebp, dword [esp + 0x434]
push 0x78
mov dword [0x40606c], 3
push ebp
call fcn.00401000
jmp 0x40194d
push 0
push 0
push edi
call fcn.00402420
lea eax, [esp + 0x30]
add esp, 0xc
push edi
push pe_nt_image_headers32
push eax
call fcn.0040225a
mov ebp, dword [esp + 0x440]
add esp, 0xc
test eax, eax
je 0x401788
mov ebx, 0x3b
lea eax, [esp + 0x24]
push eax
call fcn.00402366
lea eax, [esp + 0x18]
lea ecx, [esp + 0x28]
add esp, 4
push eax
push ecx
call fcn.00402308
add esp, 8
test eax, eax
mov eax, dword [0x406058]
je 0x401771
cmp byte [esp + 0x24], bl
je 0x401771
test eax, eax
jne 0x40176c
push 0x79
push ebp
call fcn.00401080
mov esi, 1
lea eax, [esp + 0x24]
push edi
push pe_nt_image_headers32
push eax
call fcn.0040225a
add esp, 0xc
test eax, eax
jne 0x401732
push edi
call fcn.004021fe
add esp, 4
test esi, esi
je 0x40194d
lea eax, [esp + 0x32c]
push 0
lea ecx, [esp + 0x128]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4017cc
mov dword [0x40606c], 4
push 0x7a
push ebp
call fcn.00401000
jmp 0x40194d
cmp dword [0x406058], 0
jne 0x4017dd
push 0x7b
push ebp
call fcn.00401080
lea eax, [esp + 0x32c]
push 0x40161c
push eax
call fcn.004024d7
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x40181c
mov dword [0x40606c], 5
cmp dword [0x406058], 0
jne 0x40194d
push 0x7c
push ebp
call fcn.00401000
jmp 0x40194d
lea eax, [esp + 0x124]
push 0x401620
push eax
call fcn.004024d7
mov dword [esp + 0x18], eax
add esp, 8
test eax, eax
jne 0x40185d
mov dword [0x40606c], 6
cmp dword [0x406058], 0
jne 0x40194d
push 0x78
push ebp
call fcn.00401000
jmp 0x40194d
push 0
push 0
push ebx
call fcn.00402420
lea eax, [esp + 0x30]
add esp, 0xc
push ebx
push pe_nt_image_headers32
push eax
call fcn.0040225a
add esp, 0xc
test eax, eax
je 0x401926
lea edi, [esp + 0x24]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0xa4]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xa4]
push ecx
call fcn.00402366
lea eax, [esp + 0x18]
lea ecx, [esp + 0xa8]
add esp, 4
push eax
push ecx
call fcn.00402308
add esp, 8
test eax, eax
je 0x4018f9
lea eax, [esp + 0x14]
lea ecx, [esp + 0xa4]
push eax
push ecx
call fcn.00402308
add esp, 8
test eax, eax
je 0x40190b
cmp byte [esp + 0xa4], 0x3b
jne 0x40190b
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.004022b5
add esp, 8
lea eax, [esp + 0x24]
push ebx
push pe_nt_image_headers32
push eax
call fcn.0040225a
add esp, 0xc
test eax, eax
jne 0x401885
mov eax, dword [esp + 0x10]
push eax
call fcn.004021fe
add esp, 4
push ebx
call fcn.004021fe
add esp, 4
cmp dword [0x406058], 0
jne 0x40194d
push 0x7d
push ebp
call fcn.00401080
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x420
ret 4