Function at 0x421bb0
Capabilities:
Copy file
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x44df88
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x150], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x168]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x178]
mov edx, dword [ebp + 0x2d0]
sub edx, dword [ebp + 0x2cc]
mov eax, dword [esp + 0x17c]
mov dword [esp + 0x14], ebp
add ebp, 0x2c0
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
test edx, 0xffffffc0
jne 0x421d58
lea eax, [esp + 0x12c]
push eax
sub esp, 0x1c
mov esi, esp
xor ebx, ebx
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], bl
mov eax, dword [esi + 0x18]
mov dword [esp + 0x54], esp
cmp eax, 0x10
jb 0x421c51
mov ecx, dword [edi]
jmp 0x421c53
mov ecx, edi
cmp ecx, 0x4571fc
ja 0x421c8e
cmp eax, 0x10
jb 0x421c64
mov ecx, dword [edi]
jmp 0x421c66
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x4571fc
jbe 0x421c8e
cmp eax, 0x10
jb 0x421c7a
mov edi, dword [edi]
push 0x38
mov eax, 0x4571fc
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d80
jmp 0x421cd1
cmp eax, 0x38
jae 0x421ca0
mov ecx, dword [esi + 0x14]
push ecx
push 0x38
mov ecx, esi
call fcn.004034b0
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x421cac
mov eax, dword [edi]
jmp 0x421cae
mov eax, edi
push 0x38
push 0x4571fc
push ecx
push eax
call fcn.00439429
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x38
jb 0x421cce
mov edi, dword [edi]
mov byte [edi + 0x38], bl
lea esi, [esp + 0x80]
call fcn.004016b0
mov dword [esp + 0x174], ebx
call fcn.00401ad0
mov esi, 0x10
mov byte [esp + 0x170], 1
cmp dword [eax + 0x18], esi
jb 0x421d00
mov eax, dword [eax + 4]
jmp 0x421d03
add eax, 4
mov edx, dword [esp + 0x14]
push eax
push 1
push edx
call fcn.0041d220
add esp, 0xc
cmp dword [esp + 0x144], esi
jb 0x421d2c
mov eax, dword [esp + 0x130]
push eax
call fcn.004393c9
add esp, 4
lea esi, [esp + 0x60]
mov dword [esp + 0x144], 0xf
mov dword [esp + 0x140], ebx
mov byte [esp + 0x130], bl
call fcn.00429e20
mov eax, 0x8000000a
jmp 0x4227f6
mov dword [esp + 0x128], 0xf
mov dword [esp + 0x124], 0
mov byte [esp + 0x114], 0
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x174], 2
call fcn.0042af60
mov byte [esp + 0x170], 3
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp + 0xc]
mov eax, dword [esp + 0x2c]
xor edi, edi
sar edx, 6
mov dword [esp + 0x18], edi
test edx, edx
jbe 0x421e15
lea ebx, [ebx]
mov edx, dword [esp + 0x28]
test edx, edx
jne 0x421dbc
xor ecx, ecx
jmp 0x421dc5
mov ecx, dword [esp + 0x30]
sub ecx, edx
sar ecx, 2
mov esi, eax
sub esi, edx
sar esi, 2
cmp esi, ecx
jae 0x421ddb
mov dword [eax], edi
add eax, 4
mov dword [esp + 0x2c], eax
jmp 0x421e03
mov esi, eax
cmp edx, eax
jbe 0x421de6
call fcn.004392c0
mov eax, dword [esp + 0x1c]
push esi
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x64]
push ecx
lea eax, [esp + 0x2c]
call fcn.0042bc30
mov eax, dword [esp + 0x2c]
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp + 0xc]
inc edi
sar edx, 6
mov dword [esp + 0x18], edi
cmp edi, edx
jb 0x421db0
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
xor edi, edi
sar ecx, 6
test ecx, ecx
jbe 0x421e6c
sub eax, dword [esp + 0x28]
sar eax, 2
mov esi, eax
call fcn.004393a7
xor edx, edx
div esi
lea eax, [esp + 0x1c]
mov ebx, edx
call fcn.0042aff0
mov esi, eax
mov ebx, edi
lea eax, [esp + 0x1c]
call fcn.0042aff0
cmp eax, esi
je 0x421e5a
mov edx, dword [esi]
mov ecx, dword [eax]
mov dword [eax], edx
mov dword [esi], ecx
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp + 0xc]
inc edi
sar eax, 6
cmp edi, eax
mov eax, dword [esp + 0x2c]
jb 0x421e24
mov edx, dword [esp + 0x28]
mov ecx, eax
sub ecx, edx
sar ecx, 2
mov dword [esp + 0x18], 0
test ecx, ecx
jbe 0x422423
jmp 0x421e90
cmp ecx, dword [esp + 0x18]
jbe 0x422485
mov esi, edx
cmp edx, eax
jbe 0x421ea5
call fcn.004392c0
mov eax, dword [esp + 0x1c]
mov edi, eax
mov ebx, edi
mov dword [esp + 0x5c], esi
test eax, eax
jne 0x421ed0
call fcn.004392c0
xor eax, eax
mov ecx, dword [esp + 0x18]
lea esi, [esi + ecx*4]
cmp esi, dword [eax + 0x10]
ja 0x421edb
test edi, edi
je 0x421ed4
mov edi, dword [edi]
jmp 0x421ed6
mov eax, dword [eax]
jmp 0x421ebc
xor edi, edi
cmp esi, dword [edi + 0xc]
jae 0x421ee0
call fcn.004392c0
test ebx, ebx
jne 0x421f5a
call fcn.004392c0
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x421ef5
call fcn.004392c0
mov ebx, dword [esi]
mov eax, ebx
mov ecx, ebp
call fcn.0042a870
cmp dword [eax + 0x3c], 0
je 0x422403
mov esi, dword [esp + 0x34]
cmp dword [esi + 0x80], 0
je 0x421f5e
mov eax, ebx
mov ecx, ebp
call fcn.0042a870
add eax, 0x1c
cmp dword [eax + 0x14], 0
je 0x422403
cmp dword [esi + 0x80], 0
je 0x421f5e
mov eax, ebx
mov ecx, ebp
mov edi, 1
call fcn.0042a870
push 0xffffffffffffffff
add eax, 0x1c
push 0
push eax
lea ecx, [esp + 0x11c]
call fcn.00402d80
jmp 0x421fc3
mov eax, dword [ebx]
jmp 0x421eeb
mov eax, ebx
mov ecx, ebp
call fcn.0042a870
add eax, 0x1c
cmp dword [eax + 0x14], 0
je 0x421fa7
call fcn.004393a7
and eax, 0x80000001
jns 0x421f81
dec eax
or eax, 0xfffffffe
inc eax
mov eax, ebx
mov ecx, ebp
jne 0x421fab
call fcn.0042a870
push 0xffffffffffffffff
add eax, 0x1c
push 0
push eax
lea ecx, [esp + 0x11c]
call fcn.00402d80
mov edi, 1
jmp 0x421fc3
mov eax, ebx
mov ecx, ebp
call fcn.0042a870
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x11c]
call fcn.00402d80
xor edi, edi
xor eax, eax
mov ecx, 0xf
mov dword [esp + 0x144], ecx
mov dword [esp + 0x140], eax
mov byte [esp + 0x130], al
mov dword [esp + 0x160], ecx
mov dword [esp + 0x15c], eax
mov byte [esp + 0x14c], al
mov eax, dword [esp + 0x14]
mov byte [esp + 0x170], 5
mov ecx, dword [eax + 0x10]
sub ecx, dword [eax + 0xc]
mov eax, 0x7e07e07f
imul ecx
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
je 0x42248a
call fcn.004393a7
xor edx, edx
div esi
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x14]
mov dword [eax], edx
push edx
mov eax, esi
call fcn.0040f370
push 0xffffffffffffffff
add eax, 0x1c
push 0
push eax
lea ecx, [esp + 0x154]
call fcn.00402d80
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx]
push edx
mov eax, esi
call fcn.0040f370
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x138]
call fcn.00402d80
mov eax, dword [esp + 0x124]
test eax, eax
je 0x422143
lea esi, [eax - 1]
cmp eax, esi
ja 0x42208d
call fcn.00438391
mov eax, dword [esp + 0x124]
cmp dword [esp + 0x128], 0x10
mov ecx, dword [esp + 0x114]
jae 0x4220a5
lea ecx, [esp + 0x114]
cmp byte [ecx + esi], 0x5c
je 0x422143
or ecx, 0xffffffff
sub ecx, eax
cmp ecx, 1
ja 0x4220c5
call fcn.00438359
mov eax, dword [esp + 0x124]
lea esi, [eax + 1]
cmp esi, 0xfffffffe
jbe 0x4220d9
call fcn.00438359
mov eax, dword [esp + 0x124]
mov ecx, dword [esp + 0x128]
cmp ecx, esi
jae 0x42218d
push eax
push esi
lea ecx, [esp + 0x118]
call fcn.004034b0
mov eax, dword [esp + 0x124]
test esi, esi
jbe 0x422143
mov ecx, dword [esp + 0x114]
mov edx, 0x10
cmp dword [esp + 0x128], edx
jae 0x42211d
lea ecx, [esp + 0x114]
mov byte [ecx + eax], 0x5c
mov eax, dword [esp + 0x114]
mov dword [esp + 0x124], esi
cmp dword [esp + 0x128], edx
jae 0x42213f
lea eax, [esp + 0x114]
mov byte [eax + esi], 0
push 0
lea edx, [esp + 0x130]
push edx
or eax, 0xffffffff
lea esi, [esp + 0x118]
call fcn.00405750
cmp dword [esp + 0x128], 0x10
mov ecx, dword [esp + 0x114]
jae 0x422174
lea ecx, [esp + 0x114]
mov eax, dword [esp + 0x14]
mov esi, 0x10
cmp dword [eax + 0x25c], esi
jb 0x4221b4
mov eax, dword [eax + 0x248]
jmp 0x4221b9
test esi, esi
jne 0x4220ff
mov eax, dword [esp + 0x114]
mov dword [esp + 0x124], esi
cmp ecx, 0x10
jae 0x4221af
lea eax, [esp + 0x114]
mov byte [eax], 0
jmp 0x422143
add eax, 0x248
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x422664
mov eax, ebx
mov ecx, ebp
call fcn.0042a870
inc dword [eax + 0x38]
add eax, 0x38
mov eax, ebx
mov ecx, ebp
call fcn.0042a870
cmp dword [eax + 0x38], 3
jle 0x4223ab
mov eax, ebx
mov ecx, ebp
call fcn.0042a870
cmp dword [eax + 0x18], esi
jb 0x422200
mov eax, dword [eax + 4]
jmp 0x422203
add eax, 4
push eax
lea eax, [esp + 0x40]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x7c], esp
cmp eax, 0x10
jb 0x422232
mov ecx, dword [edi]
jmp 0x422234
mov ecx, edi
cmp ecx, str._DRTSNT
ja 0x42226f
cmp eax, 0x10
jb 0x422245
mov ecx, dword [edi]
jmp 0x422247
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, str._DRTSNT
jbe 0x42226f
cmp eax, 0x10
jb 0x42225b
mov edi, dword [edi]
push 0x3f
mov eax, str._DRTSNT
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d80
jmp 0x4222b3
cmp eax, 0x3f
jae 0x422281
mov ecx, dword [esi + 0x14]
push ecx
push 0x3f
mov ecx, esi
call fcn.004034b0
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x42228d
mov eax, dword [edi]
jmp 0x42228f
mov eax, edi
push 0x3f
push str._DRTSNT
push ecx
push eax
call fcn.00439429
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x3f
jb 0x4222af
mov edi, dword [edi]
mov byte [edi + 0x3f], 0
lea esi, [esp + 0x84]
call fcn.004016b0
mov byte [esp + 0x178], 8
call fcn.00401ad0
mov edi, 0x10
mov byte [esp + 0x174], 9
cmp dword [eax + 0x18], edi
jb 0x4222e3
mov eax, dword [eax + 4]
jmp 0x4222e6
add eax, 4
mov edx, dword [esp + 0x18]
push eax
push 1
push edx
call fcn.0041d220
add esp, 0x10
cmp dword [esp + 0x54], edi
jb 0x422309
mov eax, dword [esp + 0x40]
push eax
call fcn.004393c9
add esp, 4
xor esi, esi
mov byte [esp + 0x170], 5
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], esi
mov byte [esp + 0x40], 0
cmp dword [esp + 0xb0], edi
jb 0x42233d
mov ecx, dword [esp + 0x9c]
push ecx
call fcn.004393c9
add esp, 4
mov dword [esp + 0xb0], 0xf
mov dword [esp + 0xac], esi
mov byte [esp + 0x9c], 0
cmp dword [esp + 0x94], edi
jb 0x422370
mov edx, dword [esp + 0x80]
push edx
call fcn.004393c9
add esp, 4
mov dword [esp + 0x94], 0xf
mov dword [esp + 0x90], esi
mov byte [esp + 0x80], 0
cmp dword [esp + 0x78], edi
jb 0x42239d
mov eax, dword [esp + 0x64]
push eax
call fcn.004393c9
add esp, 4
mov eax, ebx
mov ecx, ebp
call fcn.0042a870
mov dword [eax + 0x3c], esi
mov esi, edi
cmp dword [esp + 0x160], esi
jb 0x4223c4
mov ecx, dword [esp + 0x14c]
push ecx
call fcn.004393c9
add esp, 4
mov byte [esp + 0x170], 3
mov dword [esp + 0x160], 0xf
mov dword [esp + 0x15c], 0
mov byte [esp + 0x14c], 0
cmp dword [esp + 0x144], esi
jb 0x422403
mov edx, dword [esp + 0x130]
push edx
call fcn.004393c9
add esp, 4
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x18]
mov ecx, eax
sub ecx, edx
inc esi
sar ecx, 2
mov dword [esp + 0x18], esi
cmp esi, ecx
jb 0x421e90
lea ecx, [esp + 0x3c]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x78], esp
push 0x2a
mov ebx, 0xf
xor edi, edi
mov dword [ecx + 0x18], ebx
mov dword [ecx + 0x14], edi
push 0x4572b8
mov byte [ecx + 4], 0
call fcn.004030c0
lea esi, [esp + 0xd8]
call fcn.004016b0
mov byte [esp + 0x174], 0xa
call fcn.00401930
mov ebp, 0x10
mov byte [esp + 0x170], 0xb
cmp dword [eax + 0x18], ebp
jb 0x42276f
mov eax, dword [eax + 4]
jmp 0x422772
call fcn.0040f8b0
lea eax, [esp + 0x3c]
push eax
sub esp, 0x1c
mov esi, esp
xor ebp, ebp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebp
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebx, 0x10
mov dword [esp + 0x78], esp
cmp eax, ebx
jb 0x4224ba
mov ecx, dword [edi]
jmp 0x4224bc
mov ecx, edi
cmp ecx, 0x457238
ja 0x4224f5
cmp eax, ebx
jb 0x4224cc
mov ecx, dword [edi]
jmp 0x4224ce
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x457238
jbe 0x4224f5
cmp eax, ebx
jb 0x4224e1
mov edi, dword [edi]
push 0x3a
mov eax, 0x457238
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d80
jmp 0x422537
cmp eax, 0x3a
jae 0x422507
mov ecx, dword [esi + 0x14]
push ecx
push 0x3a
mov ecx, esi
call fcn.004034b0
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x422512
mov eax, dword [edi]
jmp 0x422514
mov eax, edi
push 0x3a
push 0x457238
push ecx
push eax
call fcn.00439429
add esp, 0x10
mov dword [esi + 0x14], 0x3a
cmp dword [esi + 0x18], ebx
jb 0x422533
mov edi, dword [edi]
mov byte [edi + 0x3a], 0
lea esi, [esp + 0x80]
call fcn.004016b0
mov byte [esp + 0x174], 6
call fcn.00401ca0
mov byte [esp + 0x170], 7
cmp dword [eax + 0x18], ebx
jb 0x422562
mov eax, dword [eax + 4]
jmp 0x422565
add eax, 4
mov edx, dword [esp + 0x14]
push eax
push 1
push edx
call fcn.0041d220
add esp, 0xc
cmp dword [esp + 0x54], ebx
jb 0x422588
mov eax, dword [esp + 0x40]
push eax
call fcn.004393c9
add esp, 4
mov esi, 0xf
mov dword [esp + 0x54], esi
mov dword [esp + 0x50], ebp
mov byte [esp + 0x40], 0
cmp dword [esp + 0xb0], ebx
jb 0x4225b3
mov ecx, dword [esp + 0x9c]
push ecx
call fcn.004393c9
add esp, 4
mov dword [esp + 0xb0], esi
mov dword [esp + 0xac], ebp
mov byte [esp + 0x9c], 0
cmp dword [esp + 0x94], ebx
jb 0x4225e2
mov edx, dword [esp + 0x80]
push edx
call fcn.004393c9
add esp, 4
mov dword [esp + 0x94], esi
mov dword [esp + 0x90], ebp
mov byte [esp + 0x80], 0
cmp dword [esp + 0x78], ebx
jb 0x42260b
mov eax, dword [esp + 0x64]
push eax
call fcn.004393c9
add esp, 4
cmp dword [esp + 0x160], ebx
jb 0x422624
mov ecx, dword [esp + 0x14c]
push ecx
call fcn.004393c9
add esp, 4
mov byte [esp + 0x170], 3
mov dword [esp + 0x160], esi
mov dword [esp + 0x15c], ebp
mov byte [esp + 0x14c], 0
cmp dword [esp + 0x144], ebx
jb 0x422423
mov edx, dword [esp + 0x130]
push edx
call fcn.004393c9
add esp, 4
jmp 0x422423
mov esi, dword [esp + 0x34]
mov dword [esi + 0x78], edi
push 0xffffffffffffffff
xor edi, edi
push edi
lea eax, [esp + 0x134]
push eax
lea ecx, [esi + 0x3c]
call fcn.00402d80
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x118]
push ecx
lea ecx, [esi + 0x58]
call fcn.00402d80
cmp dword [esi + 0x80], edi
jne 0x4226ae
push 0xffffffffffffffff
push edi
lea edx, [esp + 0x150]
push edx
lea ecx, [esi + 0x20]
call fcn.00402d80
mov eax, ebx
mov ecx, ebp
mov dword [esi + 0x74], ebx
call fcn.0042a870
mov esi, 0x10
mov dword [eax + 0x38], edi
cmp dword [esp + 0x160], esi
jb 0x4226db
mov eax, dword [esp + 0x14c]
push eax
call fcn.004393c9
add esp, 4
mov ebx, 0xf
mov dword [esp + 0x160], ebx
mov dword [esp + 0x15c], edi
mov byte [esp + 0x14c], 0
cmp dword [esp + 0x144], esi
jb 0x42270f
mov ecx, dword [esp + 0x130]
push ecx
call fcn.004393c9
add esp, 4
mov eax, dword [esp + 0x28]
mov dword [esp + 0x144], ebx
mov dword [esp + 0x140], edi
mov byte [esp + 0x130], 0
cmp eax, edi
je 0x422736
push eax
call fcn.004393c9
add esp, 4
mov edx, dword [esp + 0x1c]
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
call fcn.004393c9
add esp, 4
cmp dword [esp + 0x128], esi
jb 0x422768
mov eax, dword [esp + 0x114]
push eax
call fcn.004393c9
add esp, 4
xor eax, eax
jmp 0x4227f6
add eax, 4
mov edx, dword [esp + 0x14]
push eax
push 1
push edx
call fcn.0041d220
add esp, 0xc
cmp dword [esp + 0x54], ebp
jb 0x422795
mov eax, dword [esp + 0x40]
push eax
call fcn.004393c9
add esp, 4
lea esi, [esp + 0xb8]
mov dword [esp + 0x54], ebx
mov dword [esp + 0x50], edi
mov byte [esp + 0x40], 0
call fcn.00429e20
mov eax, dword [esp + 0x28]
cmp eax, edi
je 0x4227bf
push eax
call fcn.004393c9
add esp, 4
mov ecx, dword [esp + 0x1c]
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
call fcn.004393c9
add esp, 4
cmp dword [esp + 0x128], ebp
jb 0x4227f1
mov edx, dword [esp + 0x114]
push edx
call fcn.004393c9
add esp, 4
mov eax, 0x80004005
mov ecx, dword [esp + 0x168]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x150]
xor ecx, esp
call fcn.00438dc1
add esp, 0x160
ret 8