Function at 0x4aacc0
Capabilities:
Copy file
Delete file

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
lea esi, [ebp - 0x31c]
push ebx
mov ebx, eax
sub esp, 0x378
mov dword [ebp - 0x344], ecx
mov ecx, esi
call fcn.004a1c30
mov dword [ebp - 0x348], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x33c], eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x260
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.CreateFile_error__ld_n
mov dword [esp + 8], eax
xor eax, eax
cmp dword [ebp - 0x33c], 0xffffffff
setne al
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [ebp - 0x348]
mov ecx, dword [ebp - 0x33c]
xor edx, edx
mov dword [ebp - 0x354], edx
mov dword [ebp - 0x358], eax
mov dword [ebp - 0x330], eax
lea eax, [ebp - 0x330]
mov dword [ebp - 0x32c], edx
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x338]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], 0x1000000
mov dword [esp + 0x10], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0xf0005
mov dword [esp], eax
call dword [0x79e814]
sub esp, 0x1c
cmp word [ebx + 0x18], 0x10b
mov dword [ebp - 0x340], eax
je 0x4ab1f8
mov eax, dword [ebx + 0xfc]
test eax, eax
je 0x4aae07
cmp eax, 0x47
jbe 0x4aaf42
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4aaf42
mov eax, dword [ebp - 0x340]
test eax, eax
je 0x4aaf90
mov dword [ebp - 0x360], 0
lea eax, [ebp - 0x324]
mov dword [ebp - 0x350], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x348], 0
mov dword [ebp - 0x35c], 0
mov dword [ebp - 0x34c], eax
mov dword [esp + 0x14], 0x104
mov edi, dword [ebp - 0x34c]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], edi
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
sub esp, 0x18
mov dword [esp], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x79e540
call dword [sym.imp.kernel32.dll_CopyFileW]
sub esp, 0xc
mov dword [esp + 4], str.wldrtest.dll
mov edi, dword [ebp - 0x350]
mov dword [esp], edi
call dword [0x79e7d8]
lea eax, [ebp - 0x334]
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0x79e100
call dword [0x79e7e0]
sub esp, 0x10
mov edi, eax
test eax, eax
je 0x4ab208
mov eax, dword [ebp - 0x348]
xor eax, 1
cmp edi, 0xc0000142
mov dword [ebp - 0x348], eax
sete al
cmp edi, 0xc0000005
sete dl
or al, dl
jne 0x4aaf18
cmp edi, 0xc000001d
jne 0x4ab310
mov eax, 0x2c6
call fcn.0049f440
mov eax, dword [ebp - 0x344]
mov dword [esp + 4], str._u:_got_test_dll_but_expected_fallback_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x348]
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [ebp - 0x338]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x4aaf5a
mov dword [esp], eax
call ebx
sub esp, 4
mov eax, dword [ebp - 0x33c]
mov dword [esp], eax
call ebx
sub esp, 4
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [ebp - 0x340]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov dword [ebp - 0x324], 0xdeadbeef
lea eax, [ebp - 0x324]
mov dword [ebp - 0x350], eax
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x218]
mov dword [esp + 0xc], 0x10
mov dword [ebp - 0x34c], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x338]
mov dword [esp], eax
call dword [0x79e810]
sub esp, 0x14
mov dword [ebp - 0x35c], eax
mov eax, 0x273
call fcn.0049f440
mov edx, dword [ebp - 0x35c]
xor eax, eax
mov dword [esp + 4], 0x5d5818
test edx, edx
mov dword [esp + 8], edx
sete al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0x274
call fcn.0049f440
mov eax, dword [ebp - 0x324]
mov dword [esp + 4], 0x5d5880
cmp eax, 0x10
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0x275
call fcn.0049f440
mov eax, dword [ebp - 0x214]
mov dword [esp + 4], str.NtQuerySection_wrong_attr__lx_n
cmp eax, 0x1800000
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0x276
call fcn.0049f440
mov eax, dword [ebp - 0x218]
mov dword [esp + 4], 0x5d58bf
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0x277
call fcn.0049f440
mov eax, dword [ebp - 0x348]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x210]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x20c]
mov dword [esp + 4], str.NtQuerySection_wrong_size__lx_08lx____08lx_n
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x358]
mov edx, dword [ebp - 0x354]
xor eax, dword [ebp - 0x210]
xor edx, dword [ebp - 0x20c]
or eax, edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp], edi
mov eax, dword [ebp - 0x344]
mov ecx, ebx
mov edx, esi
call fcn.004a9d10
cmp word [ebx + 0x18], 0x10b
je 0x4ab4d8
mov eax, dword [ebx + 0xfc]
mov dword [ebp - 0x35c], 0
test eax, eax
je 0x4ab12b
mov eax, dword [edi + 0x10]
and eax, 1
mov dword [ebp - 0x35c], eax
mov edi, dword fs:[0x18]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
sub esp, 0xc
cmp word [ebx + 0x18], 0x20b
mov dword [ebp - 0x358], eax
jne 0x4ab2a0
mov eax, dword [ebp - 0x344]
call fcn.0049f440
mov eax, dword [ebp - 0x358]
xor ecx, ecx
test eax, eax
sete cl
mov edx, ecx
mov dword [ebp - 0x348], ecx
mov dword [esp], edx
mov dword [esp + 4], str.loading_succeeded_n
call fcn.0049fda0
mov eax, dword [ebp - 0x344]
call fcn.0049f440
mov eax, dword [edi + 0x34]
mov dword [esp + 4], 0x5d591f
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 0xc1
sete al
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x360], 0
test eax, eax
je 0x4aae4b
mov eax, dword [ebp - 0x358]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
sub esp, 4
jmp 0x4aae4b
mov eax, dword [ebx + 0xec]
jmp 0x4aadef
mov dword [esp + 8], 0x104
mov ebx, dword [ebp - 0x34c]
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x334]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
sub esp, 0xc
mov dword [esp], ebx
mov ebx, dword [sym.imp.kernel32.dll_lstrcmpiW]
mov dword [esp + 4], 0x79e540
call ebx
sub esp, 8
test eax, eax
jne 0x4ab380
mov ebx, dword [ebp - 0x348]
mov edi, dword [ebp - 0x340]
xor ebx, 1
test edi, edi
jne 0x4ab4e8
mov eax, 0x2b0
call fcn.0049f440
mov eax, dword [ebp - 0x344]
mov dword [esp], ebx
mov dword [esp + 4], str._u:_got_test_dll_but_expected_fallback_n
mov dword [esp + 8], eax
call fcn.0049fda0
mov eax, dword [ebp - 0x334]
mov dword [esp], eax
call dword [0x79e7dc]
sub esp, 4
jmp 0x4aaf42
movzx eax, word [ebx + 4]
cmp ax, 0x1c4
mov word [ebp - 0x362], ax
sete al
movzx eax, al
mov dword [ebp - 0x360], eax
mov eax, 0x29c
call fcn.0049f440
mov eax, dword [edi + 0x34]
mov edi, dword [ebp - 0x358]
xor ecx, ecx
test edi, edi
sete cl
mov dword [ebp - 0x348], ecx
je 0x4ab520
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x344]
mov dword [esp + 4], str._u:_loading_failed_err__lu_n
mov dword [esp + 8], eax
mov dword [esp], 1
call fcn.0049fda0
jmp 0x4ab1dd
mov eax, 0x2ca
call fcn.0049f440
mov ecx, dword [ebp - 0x340]
mov eax, 1
cmp ecx, edi
je 0x4ab45a
test ecx, ecx
mov ecx, dword [ebp - 0x360]
sete dl
test ecx, ecx
je 0x4ab568
test dl, dl
je 0x4ab568
cmp edi, 0xc000007b
je 0x4ab45a
cmp dword [ebx], 0x454e
jne 0x4ab458
cmp edi, 0xc000011b
jne 0x4ab458
mov edx, dword [0x8f0770]
xor eax, eax
test edx, edx
sete al
jmp 0x4ab45a
mov dword [esp + 4], 0x79e320
mov eax, dword [ebp - 0x34c]
mov dword [esp], eax
call ebx
sub esp, 8
test eax, eax
je 0x4ab590
mov eax, 0x2be
call fcn.0049f440
mov eax, 0x79e540
mov ecx, eax
shr ecx, 0x10
je 0x4ab6a0
mov dword [esp + 4], 0xffffffff
mov ebx, 0x5d3486
mov dword [esp], 0x79e540
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x4ab3ea
mov edx, 0xffffffff
mov eax, 0x79e540
call fcn.0049f230
mov ebx, eax
mov eax, dword [ebp - 0x34c]
shr eax, 0x10
je 0x4ab680
mov dword [esp + 4], 0xffffffff
mov edi, dword [ebp - 0x34c]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x5d3486
test edx, edx
jne 0x4ab42a
mov edx, 0xffffffff
mov eax, edi
call fcn.0049f230
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x344]
mov dword [esp + 4], str._u:_got_unexpected_path__s_instead_of__s_n
mov dword [esp + 8], eax
mov dword [esp], 0
call fcn.0049fda0
jmp 0x4ab285
xor eax, eax
mov ebx, dword [ebp - 0x340]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ebx
mov ebx, dword [ebp - 0x344]
mov dword [esp], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], str._u:_wrong_status__lx__lx_n
call fcn.0049fda0
mov eax, 0x2cf
call fcn.0049f440
mov eax, dword [ebp - 0x360]
mov ecx, dword [ebp - 0x348]
or eax, ecx
jne 0x4ab4b0
mov eax, dword [0x8f0770]
mov ecx, dword [ebp - 0x35c]
test eax, eax
sete al
and ecx, eax
mov eax, ecx
mov dword [esp + 0xc], edi
mov ebx, dword [ebp - 0x344]
mov dword [esp + 4], str._u:_failed_with__lx_expected_fallback_n
mov dword [esp + 8], ebx
mov dword [esp], eax
call fcn.0049fda0
jmp 0x4aaf42
mov eax, dword [ebx + 0xec]
jmp 0x4ab111
mov eax, 0x2b2
call fcn.0049f440
mov eax, dword [ebp - 0x340]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x344]
mov dword [esp + 4], str._u:_got_test_dll_but_expected_failure__lx_n
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.0049fda0
jmp 0x4ab285
mov ecx, dword [0x8f0770]
test ecx, ecx
jne 0x4ab610
mov edx, dword [ebp - 0x35c]
test edx, edx
je 0x4ab640
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x344]
mov dword [esp + 4], str._u:_loading_failed_err__lu_n
mov dword [esp + 8], eax
mov dword [esp], 1
call fcn.0049fda0
jmp 0x4aae4b
cmp edi, 0xc000007b
sete al
test byte [ebp - 0x35c], al
je 0x4ab354
test dl, dl
jne 0x4ab36c
jmp 0x4ab354
mov eax, 0x2b6
call fcn.0049f440
mov ebx, dword [ebp - 0x344]
mov dword [esp], str._u:_loaded_fallback_n
mov dword [esp + 4], ebx
call fcn.0049f7c0
mov eax, 0x2b7
call fcn.0049f440
mov eax, dword [ebp - 0x340]
mov dword [esp + 8], ebx
mov dword [esp + 4], str._u:_got_fallback_but_expected_failure__lx_n
test eax, eax
mov dword [esp + 0xc], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0x2b8
call fcn.0049f440
mov dword [esp + 8], ebx
mov dword [esp + 4], str._u:_got_fallback_but_expected_test_dll_n
mov eax, dword [ebp - 0x348]
mov dword [esp], eax
call fcn.0049fda0
jmp 0x4ab285
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x344]
mov dword [esp + 4], str._u:_loading_failed_err__lu_n
mov dword [esp + 8], eax
mov dword [esp], 0
call fcn.0049fda0
jmp 0x4aae4b
cmp word [ebp - 0x362], 0x1c4
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x344]
mov dword [esp + 4], str._u:_loading_failed_err__lu_n
mov dword [esp + 8], eax
jne 0x4ab6ba
mov dword [esp], 1
call fcn.0049fda0
mov dword [ebp - 0x360], 1
jmp 0x4aae4b
movzx eax, word [ebp - 0x34c]
mov dword [esp], 0x5d3480
mov dword [esp + 4], eax
call fcn.0049f460
jmp 0x4ab42a
movzx eax, ax
mov dword [esp], 0x5d3480
mov dword [esp + 4], eax
call fcn.0049f460
mov ebx, eax
jmp 0x4ab3ea
mov dword [esp], 0
call fcn.0049fda0
mov dword [ebp - 0x360], 0
jmp 0x4aae4b