Function at 0x4065c0
Capabilities:
Copy file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4604b3
mov eax, dword fs:[0]
push eax
sub esp, 0xae4
mov eax, dword [0x47bb04]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xa8c], ecx
mov dword [ebp - 4], 0
push 0x464c32
lea ecx, [ebp - 0xa48]
call fcn.00403f50
mov byte [ebp - 4], 1
mov dword [ebp - 0xa4c], str.USERPROFILE
mov byte [ebp - 0xa44], 0
push 0xa27
push 0
lea eax, [ebp - 0xa43]
push eax
call fcn.00445490
add esp, 0xc
push 0xa28
lea ecx, [ebp - 0xa44]
push ecx
mov edx, dword [ebp - 0xa4c]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0xa54], eax
cmp dword [ebp - 0xa54], 0
jbe 0x4066b0
cmp dword [ebp - 0xa54], 0xa28
jae 0x4066b0
lea eax, [ebp - 0xa44]
push eax
lea ecx, [ebp - 0xa58]
call fcn.00403f50
mov dword [ebp - 0xa90], eax
mov ecx, dword [ebp - 0xa90]
mov dword [ebp - 0xa94], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0xa94]
push edx
lea ecx, [ebp - 0xa48]
call fcn.004026f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa58]
call fcn.004026d0
push str._sys_acad.pgp
lea ecx, [ebp - 0xa50]
call fcn.00403f50
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0xa8c]
add eax, 0x88
push eax
lea ecx, [ebp - 0x18]
call fcn.004026b0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xa8c]
add ecx, 0x88
push ecx
lea ecx, [ebp - 0x10]
call fcn.004026b0
mov byte [ebp - 4], 5
lea edx, [ebp - 0xa50]
push edx
lea eax, [ebp + 8]
push eax
push 0x464df0
lea ecx, [ebp - 0xa48]
push ecx
lea edx, [ebp - 0xa5c]
push edx
call fcn.00403d20
add esp, 0xc
mov dword [ebp - 0xa98], eax
mov eax, dword [ebp - 0xa98]
mov dword [ebp - 0xa9c], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0xa9c]
push ecx
lea edx, [ebp - 0xa60]
push edx
call fcn.0040c6d0
add esp, 0xc
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0xaa0]
mov dword [ebp - 0xaa4], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0xaa4]
push ecx
lea edx, [ebp - 0xa64]
push edx
call fcn.0040c6d0
add esp, 0xc
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0xaac], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0xaac]
push ecx
lea ecx, [ebp - 0x18]
call fcn.004026f0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xa64]
call fcn.004026d0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa60]
call fcn.004026d0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xa5c]
call fcn.004026d0
mov byte [ebp - 0x11], 0
push ecx
mov ecx, esp
mov dword [ebp - 0xa68], esp
lea edx, [ebp - 0x18]
push edx
call fcn.004026b0
mov dword [ebp - 0xab0], eax
call fcn.004037a0
add esp, 4
mov dword [ebp - 0xab4], eax
cmp dword [ebp - 0xab4], 0
jne 0x406a3a
push ecx
mov ecx, esp
mov dword [ebp - 0xa6c], esp
lea eax, [ebp - 0x18]
push eax
call fcn.004026b0
mov dword [ebp - 0xab8], eax
mov ecx, dword [ebp - 0xa8c]
call fcn.00406aa0
lea ecx, [ebp - 0xa50]
push ecx
lea ecx, [ebp - 0x10]
call fcn.0040c0a0
push ecx
mov ecx, esp
mov dword [ebp - 0xa70], esp
lea edx, [ebp - 0x10]
push edx
call fcn.004026b0
mov dword [ebp - 0xabc], eax
call fcn.004037a0
add esp, 4
mov dword [ebp - 0xac0], eax
cmp dword [ebp - 0xac0], 0
je 0x40687f
push 1
lea ecx, [ebp - 0x18]
call fcn.00402770
push eax
lea ecx, [ebp - 0x10]
call fcn.00402770
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
setne al
mov byte [ebp - 0x11], al
push str._sysKeyMap.txt
lea ecx, [ebp - 0xa50]
call fcn.00402710
lea ecx, [ebp - 0xa50]
push ecx
lea edx, [ebp + 8]
push edx
push str.AppDataRoamingTangent_
lea eax, [ebp - 0xa48]
push eax
lea ecx, [ebp - 0xa74]
push ecx
call fcn.00403d20
add esp, 0xc
mov dword [ebp - 0xac4], eax
mov edx, dword [ebp - 0xac4]
mov dword [ebp - 0xac8], edx
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0xac8]
push eax
lea ecx, [ebp - 0xa78]
push ecx
call fcn.0040c6d0
add esp, 0xc
mov dword [ebp - 0xacc], eax
mov edx, dword [ebp - 0xacc]
mov dword [ebp - 0xad0], edx
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0xad0]
push eax
lea ecx, [ebp - 0xa7c]
push ecx
call fcn.0040c6d0
add esp, 0xc
mov dword [ebp - 0xad4], eax
mov edx, dword [ebp - 0xad4]
mov dword [ebp - 0xad8], edx
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0xad8]
push eax
lea ecx, [ebp - 0x18]
call fcn.004026f0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xa7c]
call fcn.004026d0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa78]
call fcn.004026d0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xa74]
call fcn.004026d0
push ecx
mov ecx, esp
mov dword [ebp - 0xa80], esp
lea edx, [ebp - 0x18]
push edx
call fcn.004026b0
mov dword [ebp - 0xadc], eax
call fcn.004037a0
add esp, 4
mov dword [ebp - 0xae0], eax
cmp dword [ebp - 0xae0], 0
jne 0x406a3a
lea eax, [ebp - 0xa50]
push eax
mov ecx, dword [ebp - 0xa8c]
add ecx, 0x88
push ecx
lea edx, [ebp - 0xa84]
push edx
call fcn.0040c6d0
add esp, 0xc
mov dword [ebp - 0xae4], eax
mov eax, dword [ebp - 0xae4]
mov dword [ebp - 0xae8], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0xae8]
push ecx
lea ecx, [ebp - 0x10]
call fcn.004026f0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xa84]
call fcn.004026d0
push ecx
mov ecx, esp
mov dword [ebp - 0xa88], esp
lea edx, [ebp - 0x10]
push edx
call fcn.004026b0
mov dword [ebp - 0xaec], eax
call fcn.004037a0
add esp, 4
mov dword [ebp - 0xaf0], eax
cmp dword [ebp - 0xaf0], 0
je 0x406a3a
push 1
lea ecx, [ebp - 0x18]
call fcn.00402770
push eax
lea ecx, [ebp - 0x10]
call fcn.00402770
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
setne al
mov byte [ebp - 0x11], al
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10]
call fcn.004026d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.004026d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa50]
call fcn.004026d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa48]
call fcn.004026d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004026d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00445478
mov esp, ebp
pop ebp
ret 4