Function at 0x40bcb0
Capabilities:
Copy file
Get common file path

Disassembly:
sub esp, 0x5b8
lea eax, [esp + 0xc]
push ebx
push ebp
push esi
push edi
push 0x15e
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.wininit.ini
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x20]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
je 0x40beab
push 0x180
lea ecx, [esp + 0x20]
push 0x8109
push ecx
call dword [sym.imp.MSVCRT.dll__open]
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x40c1c3
mov edi, str._rename__r_n
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [sym.imp.MSVCRT.dll__write]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str._rename__r_n
push esi
call ebx
mov edx, eax
mov edi, str._rename__r_n
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
je 0x40bd7f
push esi
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5b8
ret
mov ebp, dword [esp + 0x5cc]
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebp
push esi
call ebx
mov edx, eax
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
je 0x40bdc3
push esi
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5b8
ret
mov edi, 0x413bc4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x413bc4
push esi
call ebx
mov edx, eax
mov edi, 0x413bc4
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
je 0x40be0a
push esi
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5b8
ret
mov ebp, dword [esp + 0x5d0]
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebp
push esi
call ebx
mov edx, eax
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
je 0x40be4e
push esi
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5b8
ret
mov edi, 0x413bc0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x413bc0
push esi
call ebx
mov edx, eax
mov edi, 0x413bc0
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push esi
cmp edx, ecx
je 0x40be95
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5b8
ret
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5b8
ret
lea eax, [esp + 0x1ac]
mov byte [esp + 0x1b], 0
push eax
push 0x104
mov byte [esp + 0x1b], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, 0x413bb4
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1ac]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1b0]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [esp + 0x1ac]
push 0x413bb0
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x14], edi
je 0x40c1c3
push 0x180
lea eax, [esp + 0x20]
push 0x8001
push eax
call dword [sym.imp.MSVCRT.dll__open]
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x40c1c3
push edi
lea ecx, [esp + 0x340]
push 0x288
push ecx
call dword [sym.imp.MSVCRT.dll_fgets]
mov ebx, dword [esp + 0x5d8]
mov ebp, dword [sym.imp.MSVCRT.dll__write]
add esp, 0xc
test eax, eax
je 0x40c0fd
mov al, byte [esp + 0x13]
test al, al
jne 0x40c093
mov al, byte [esp + 0x1b]
test al, al
jne 0x40bfbe
push 8
lea edx, [esp + 0x340]
push str._rename_
push edx
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x40c093
mov byte [esp + 0x1b], 1
jmp 0x40c093
cmp byte [esp + 0x33c], 0x5b
jne 0x40c093
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebx
push esi
call ebp
mov edx, eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jne 0x40c1d0
mov edi, 0x413bc4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x413bc4
push esi
call ebp
mov edx, eax
mov edi, 0x413bc4
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jne 0x40c1ae
mov edx, dword [esp + 0x5d0]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call ebp
mov edi, dword [esp + 0x5dc]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jne 0x40c1de
mov edi, 0x413bc0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x413bc0
push esi
call ebp
mov edx, eax
mov edi, 0x413bc0
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jne 0x40c1d0
mov byte [esp + 0x13], 1
lea edi, [esp + 0x33c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x33c]
push ecx
push eax
push esi
call ebp
mov edx, eax
lea edi, [esp + 0x348]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jne 0x40c1ae
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x33c]
push eax
push 0x288
push ecx
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0xc
test eax, eax
jne 0x40bf80
mov al, byte [esp + 0x13]
test al, al
jne 0x40c1ec
invalid
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebx
push esi
call ebp
mov edx, eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jne 0x40c1ae
mov edi, 0x413bc4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x413bc4
push esi
call ebp
mov edx, eax
mov edi, 0x413bc4
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jne 0x40c1ae
mov ebx, dword [esp + 0x5d0]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebx
push esi
call ebp
mov edx, eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jne 0x40c1ae
mov edi, 0x413bc0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x413bc0
push esi
call ebp
mov edx, eax
mov edi, 0x413bc0
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
je 0x40c1ec
push esi
call dword [sym.imp.MSVCRT.dll__close]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x5b8
ret
push esi
call dword [sym.imp.MSVCRT.dll__close]
mov edx, dword [esp + 0x18]
push edx
jmp 0x40c1ba
push esi
call dword [sym.imp.MSVCRT.dll__close]
mov ecx, dword [esp + 0x18]
push ecx
jmp 0x40c1ba
push esi
call dword [sym.imp.MSVCRT.dll__close]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 8
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5b8
ret