Function at 0x409270
Capabilities:
Copy file
Get common file path

Disassembly:
sub esp, 0x230
or ecx, 0xffffffff
xor eax, eax
push esi
push edi
mov edi, str.null
push 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.SYSTEMCurrentControlSetServicesWinSock2DrcomPacketCapture
mov eax, ecx
mov esi, edi
mov edi, 0x4232c8
push reloc.OLEAUT32.dll_SysReAllocString
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x116
and ecx, 3
push 0x4232c8
rep movsb byte es:[edi], byte [esi]
push str.PathNameR
call fcn.00408c00
mov edi, 0x42052c
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.SYSTEMCurrentControlSetServicesWinSock2DrcomPacketCapture
mov edx, ecx
mov esi, edi
mov edi, 0x4233e0
push reloc.OLEAUT32.dll_SysReAllocString
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x116
and ecx, 3
push 0x4233e0
rep movsb byte es:[edi], byte [esi]
push str.PathName
call fcn.00408c00
add esp, 0x30
test al, al
je 0x409320
call fcn.00409630
test al, al
jne 0x409320
pop edi
mov eax, 0xfffffffe
pop esi
add esp, 0x230
ret
mov edi, 0x42052c
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov eax, ecx
mov esi, edi
mov edi, 0x4234f8
push 0x104
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [0x42950c], 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x12c]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
test eax, eax
jle 0x40944f
cmp eax, 0x104
jge 0x40944f
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov ebp, dword [sym.imp.KERNEL32.DLL_CopyFileA]
mov dword [0x42950c], 2
mov byte [esp + eax + 0x128], 0
xor esi, esi
push esi
lea edx, [esp + 0x12c]
push str.TcpIpDog
push edx
lea eax, [esp + 0x1c]
push str._s_sR_u.dll
push eax
call ebx
add esp, 0x14
lea ecx, [esp + 0x10]
push 0
push ecx
push 0x423610
call ebp
test eax, eax
jne 0x4093ce
inc esi
cmp esi, 0xa
jl 0x409397
jmp 0x4093f2
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4234f8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
push esi
lea eax, [esp + 0x12c]
push str.TcpIpDog
push eax
lea ecx, [esp + 0x1c]
push str._s_s_u.dll
push ecx
call ebx
add esp, 0x14
lea edx, [esp + 0x10]
push 0
push edx
push 0x423610
call ebp
test eax, eax
jne 0x40942b
inc esi
cmp esi, 0xa
jl 0x4093f4
jmp 0x40944f
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x423610
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
call fcn.004091a0
add esp, 4
test eax, eax
pop ebp
pop ebx
jne 0x4094b8
mov edi, 0x423610
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push 1
push str.SYSTEMCurrentControlSetServicesWinSock2DrcomPacketCapture
dec ecx
push reloc.OLEAUT32.dll_SysReAllocString
push ecx
push 0x423610
push str.PathName
call fcn.00408c70
mov edi, 0x4234f8
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2DrcomPacketCapture
dec ecx
push reloc.OLEAUT32.dll_SysReAllocString
push ecx
push 0x4234f8
push str.PathNameR
call fcn.00408c70
add esp, 0x30
xor eax, eax
pop edi
pop esi
add esp, 0x230
ret