Function at 0x401f2d
Capabilities:
Copy file
Create process on windows
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c0c
call fcn.0040e8c0
push edi
call fcn.00402fa4
test eax, eax
jne 0x4020d2
push 0x43e104
mov eax, dword [ebp + 0x10]
push eax
call fcn.0040e840
add esp, 8
test eax, eax
jne 0x401f72
push 0x43e108
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0040e840
add esp, 8
test eax, eax
je 0x401f9c
push 0x43e10c
mov edx, dword [ebp + 0x10]
push edx
call fcn.0040e840
add esp, 8
test eax, eax
jne 0x401faa
push 0x43e110
mov eax, dword [ebp + 0x10]
push eax
call fcn.0040e840
add esp, 8
test eax, eax
jne 0x401faa
push 0
push 0
push 0x43e114
call fcn.0042c3eb
mov byte [ebp - 0x199c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x199b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x199c]
push edx
call fcn.00402e3f
add esp, 8
test eax, eax
je 0x401ff9
push 8
push ecx
mov ecx, esp
mov dword [ebp - 0x1bc0], esp
lea eax, [ebp - 0x199c]
push eax
call fcn.0042186b
call fcn.00403027
add esp, 8
push 0x104
push 0
lea ecx, [ebp - 0x199c]
push ecx
call fcn.0040dff0
add esp, 0xc
lea edx, [ebp - 0x199c]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x199c]
push eax
lea ecx, [ebp - 0x19a0]
call fcn.0042186b
push 0x43e12c
push 1
lea ecx, [ebp - 0x1bc8]
push ecx
lea ecx, [ebp - 0x19a0]
call fcn.0041e6f5
push eax
call fcn.004032f0
mov byte [ebp - 0x1bc4], al
lea ecx, [ebp - 0x1bc8]
call fcn.004217fd
mov edx, dword [ebp - 0x1bc4]
and edx, 0xff
test edx, edx
je 0x402083
push 0x43e130
lea ecx, [ebp - 0x19a0]
call fcn.00421bd9
push str.setup.log
lea ecx, [ebp - 0x19a0]
call fcn.00421bd9
push 8
push ecx
mov ecx, esp
mov dword [ebp - 0x1bcc], esp
lea eax, [ebp - 0x19a0]
push eax
call fcn.00421572
call fcn.00403027
add esp, 8
mov dword [ebp - 0x1bd0], 0
lea ecx, [ebp - 0x19a0]
call fcn.004217fd
mov eax, dword [ebp - 0x1bd0]
jmp 0x402a7f
mov byte [ebp - 0x1574], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x1573]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [0x444878]
mov edx, dword [ecx]
push edx
push 0x43e140
lea eax, [ebp - 0x1574]
push eax
call fcn.0040e7e9
add esp, 0xc
push 0x442838
lea ecx, [ebp - 0x1898]
call fcn.0042186b
cmp dword [0x444874], 0
je 0x4021eb
mov dword [ebp - 0x19a4], 1
jmp 0x402140
mov ecx, dword [ebp - 0x19a4]
add ecx, 1
mov dword [ebp - 0x19a4], ecx
mov edx, dword [ebp - 0x19a4]
cmp edx, dword [0x444874]
jge 0x4021eb
push 0x43e17c
mov eax, dword [ebp - 0x19a4]
mov ecx, dword [0x444878]
mov edx, dword [ecx + eax*4]
push edx
call fcn.00416830
add esp, 8
test eax, eax
jne 0x402184
lea eax, [ebp - 0x1898]
push eax
call fcn.00401b22
add esp, 4
jmp 0x4021eb
push 0x43e180
mov ecx, dword [ebp - 0x19a4]
mov edx, dword [0x444878]
mov eax, dword [edx + ecx*4]
push eax
call fcn.0040e840
add esp, 8
test eax, eax
jne 0x4021c6
push 0x43e184
mov ecx, dword [ebp - 0x19a4]
mov edx, dword [0x444878]
mov eax, dword [edx + ecx*4]
push eax
call fcn.0040e840
add esp, 8
test eax, eax
je 0x4021e6
mov ecx, dword [ebp - 0x19a4]
mov edx, dword [0x444878]
mov eax, dword [edx + ecx*4]
add eax, 3
push eax
lea ecx, [ebp - 0x1898]
call fcn.00421986
jmp 0x4021eb
jmp 0x402131
mov byte [ebp - 0x1470], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x146f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x1470]
push ecx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x1898]
call fcn.004016e0
test eax, eax
je 0x4022d8
lea edx, [ebp - 0x1470]
push edx
lea ecx, [ebp - 0x1898]
call fcn.00421986
push 1
lea eax, [ebp - 0x1bd8]
push eax
lea ecx, [ebp - 0x1898]
call fcn.0041e6f5
push eax
push 0x43e188
call fcn.00403310
mov byte [ebp - 0x1bd4], al
lea ecx, [ebp - 0x1bd8]
call fcn.004217fd
mov ecx, dword [ebp - 0x1bd4]
and ecx, 0xff
test ecx, ecx
je 0x40228b
push 0x43e18c
lea ecx, [ebp - 0x1898]
call fcn.00421bd9
lea edx, [ebp - 0x19a8]
push edx
call fcn.004030ce
add esp, 4
lea ecx, [ebp - 0x19a8]
call fcn.004016e0
test eax, eax
jne 0x4022bd
lea eax, [ebp - 0x19a8]
push eax
lea ecx, [ebp - 0x1898]
call fcn.00421c15
jmp 0x4022cd
push str.GSC_TEMP
lea ecx, [ebp - 0x1898]
call fcn.00421bd9
lea ecx, [ebp - 0x19a8]
call fcn.004217fd
push ecx
mov ecx, esp
mov dword [ebp - 0x1bdc], esp
lea edx, [ebp - 0x1898]
push edx
call fcn.00421572
call fcn.00401bfd
add esp, 4
push 0
lea ecx, [ebp - 0x1898]
call fcn.00421c2d
push eax
call fcn.00401876
add esp, 4
and eax, 0xff
test eax, eax
jne 0x402342
push 0
push 0
push str.Can_not_create_temp_folder__
call fcn.0042c3eb
mov dword [ebp - 0x1be0], 0xffffffff
lea ecx, [ebp - 0x1898]
call fcn.004217fd
mov eax, dword [ebp - 0x1be0]
jmp 0x402a7f
lea ecx, [ebp - 0x111c]
call fcn.00409ef0
push 0
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x1be4], esp
lea eax, [ebp - 0x1898]
push eax
call fcn.00421572
lea ecx, [ebp - 0x111c]
call fcn.0040a7ca
cmp eax, 0x3ea
je 0x4023a3
mov dword [ebp - 0x1be8], 0xffffffff
lea ecx, [ebp - 0x111c]
call fcn.00409f76
lea ecx, [ebp - 0x1898]
call fcn.004217fd
mov eax, dword [ebp - 0x1be8]
jmp 0x402a7f
lea ecx, [ebp - 0x1898]
push ecx
lea ecx, [ebp - 0x1330]
call fcn.00421572
push 0x43e1bc
push 1
lea edx, [ebp - 0x1bf0]
push edx
lea ecx, [ebp - 0x1330]
call fcn.0041e6f5
push eax
call fcn.004032f0
mov byte [ebp - 0x1bec], al
lea ecx, [ebp - 0x1bf0]
call fcn.004217fd
mov eax, dword [ebp - 0x1bec]
and eax, 0xff
test eax, eax
je 0x402404
push 0x43e1c0
lea ecx, [ebp - 0x1330]
call fcn.00421bd9
push 0x43e1c4
lea ecx, [ebp - 0x1330]
call fcn.00421bd9
push 0
lea ecx, [ebp - 0x1330]
call fcn.00421c2d
push eax
lea ecx, [ebp - 0x1228]
call fcn.004053f0
lea ecx, [ebp - 0x1680]
call fcn.00401680
mov byte [ebp - 0x167c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x167b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x1790], 0x104
lea ecx, [ebp - 0x1790]
push ecx
lea edx, [ebp - 0x167c]
push edx
push 0x43e1d0
lea ecx, [ebp - 0x1228]
call fcn.00405bea
lea eax, [ebp - 0x1898]
push eax
lea ecx, [ebp - 0x1680]
call fcn.00421936
push 0x43e1dc
push 1
lea ecx, [ebp - 0x1bf8]
push ecx
lea ecx, [ebp - 0x1680]
call fcn.0041e6f5
push eax
call fcn.004032f0
mov byte [ebp - 0x1bf4], al
lea ecx, [ebp - 0x1bf8]
call fcn.004217fd
mov edx, dword [ebp - 0x1bf4]
and edx, 0xff
test edx, edx
je 0x4024db
push 0x43e1e0
lea ecx, [ebp - 0x1680]
call fcn.00421bd9
lea eax, [ebp - 0x167c]
push eax
lea ecx, [ebp - 0x1680]
call fcn.00421bd9
mov byte [ebp - 0x1894], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x1893]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x10c], 0x104
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x1894]
push edx
push str.SILENCE
lea ecx, [ebp - 0x1228]
call fcn.00405bea
push str.TRUE
lea eax, [ebp - 0x1894]
push eax
call fcn.00416830
add esp, 8
test eax, eax
jne 0x40255c
push 0x43e1f4
lea ecx, [ebp - 0x1894]
push ecx
call fcn.0040e200
add esp, 8
jmp 0x402572
push 0x104
push 0
lea edx, [ebp - 0x1894]
push edx
call fcn.0040dff0
add esp, 0xc
mov byte [ebp - 0x1784], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x1783]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x178c], 0x104
lea eax, [ebp - 0x178c]
push eax
lea ecx, [ebp - 0x1784]
push ecx
push str.BACKUP
lea ecx, [ebp - 0x1228]
call fcn.00405bea
mov byte [ebp - 0x132c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x132b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x43e200
mov edx, dword [ebp + 0x10]
push edx
call fcn.0040e840
add esp, 8
test eax, eax
jne 0x402620
push 0x43e204
mov eax, dword [ebp + 0x10]
push eax
call fcn.0040e840
add esp, 8
test eax, eax
jne 0x402620
push 0x43e208
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0040e840
add esp, 8
test eax, eax
jne 0x402620
push 0x43e20c
mov edx, dword [ebp + 0x10]
push edx
call fcn.0040e840
add esp, 8
test eax, eax
je 0x402634
push 0x43e210
lea eax, [ebp - 0x132c]
push eax
call fcn.0040e200
add esp, 8
push 0x43e214
lea ecx, [ebp - 0x1894]
push ecx
call fcn.00416830
add esp, 8
test eax, eax
je 0x4026e6
push 0x43e218
mov edx, dword [ebp + 0x10]
push edx
call fcn.0040e840
add esp, 8
test eax, eax
jne 0x4026a4
push 0x43e21c
mov eax, dword [ebp + 0x10]
push eax
call fcn.0040e840
add esp, 8
test eax, eax
jne 0x4026a4
push 0x43e220
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0040e840
add esp, 8
test eax, eax
jne 0x4026a4
push 0x43e224
mov edx, dword [ebp + 0x10]
push edx
call fcn.0040e840
add esp, 8
test eax, eax
je 0x4026d0
push 0x104
push 0
lea eax, [ebp - 0x1894]
push eax
call fcn.0040dff0
add esp, 0xc
push 0x43e228
lea ecx, [ebp - 0x1894]
push ecx
call fcn.0040e200
add esp, 8
jmp 0x4026e6
push 0x104
push 0
lea edx, [ebp - 0x1894]
push edx
call fcn.0040dff0
add esp, 0xc
push 0x43e22c
lea ecx, [ebp - 0x1578]
call fcn.0042186b
lea eax, [ebp - 0x1894]
push eax
lea ecx, [ebp - 0x1578]
call fcn.00421bd9
mov dword [ebp - 0x136c], 0
mov ecx, 0xe
xor eax, eax
lea edi, [ebp - 0x1368]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x136c], 0x3c
push 0
lea ecx, [ebp - 0x1680]
call fcn.00421c2d
mov dword [ebp - 0x135c], eax
mov dword [ebp - 0x1350], 5
push 0
lea ecx, [ebp - 0x1578]
call fcn.00421c2d
mov dword [ebp - 0x1358], eax
mov dword [ebp - 0x1368], 0x40
lea ecx, [ebp - 0x136c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x4027cd
mov dword [ebp - 0x1bfc], 0xffffffff
lea ecx, [ebp - 0x1578]
call fcn.004217fd
lea ecx, [ebp - 0x1680]
call fcn.004217fd
lea ecx, [ebp - 0x1228]
call fcn.00405458
lea ecx, [ebp - 0x1330]
call fcn.004217fd
lea ecx, [ebp - 0x111c]
call fcn.00409f76
lea ecx, [ebp - 0x1898]
call fcn.004217fd
mov eax, dword [ebp - 0x1bfc]
jmp 0x402a7f
cmp dword [ebp - 0x1334], 0
je 0x4027e5
push 0xffffffffffffffff
mov edx, dword [ebp - 0x1334]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.00402f20
mov dword [ebp - 0x1788], eax
mov eax, dword [ebp - 0x1334]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x108], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.00402e3f
add esp, 8
test eax, eax
je 0x40284e
mov eax, dword [ebp - 0x1788]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x1c00], esp
lea edx, [ebp - 0x108]
push edx
call fcn.0042186b
call fcn.00403027
add esp, 8
lea eax, [ebp - 0x1784]
push eax
call fcn.0040e630
add esp, 4
test eax, eax
je 0x402a0b
mov byte [ebp - 0x1aac], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x1aab]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea ecx, [ebp - 0x1aac]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [ebp - 0x1bb0], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x1baf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea edx, [ebp - 0x1bb0]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x43e230
lea eax, [ebp - 0x1bb0]
push eax
call fcn.0040e210
add esp, 8
lea ecx, [ebp - 0x1784]
push ecx
lea edx, [ebp - 0x1bb0]
push edx
call fcn.0040e210
add esp, 8
lea eax, [ebp - 0x1bb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x1bb4], eax
mov ecx, dword [ebp - 0x1bb4]
and ecx, 0xfffffffe
mov dword [ebp - 0x1bb4], ecx
mov edx, dword [ebp - 0x1bb4]
and edx, 0xfffffffd
mov dword [ebp - 0x1bb4], edx
mov eax, dword [ebp - 0x1bb4]
and al, 0xfb
mov dword [ebp - 0x1bb4], eax
mov ecx, dword [ebp - 0x1bb4]
push ecx
lea edx, [ebp - 0x1bb0]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea eax, [ebp - 0x1bb0]
push eax
lea ecx, [ebp - 0x1aac]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x402a0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1bbc], eax
lea ecx, [ebp - 0x1bb8]
call fcn.00401680
mov edx, dword [ebp - 0x1bbc]
push edx
lea eax, [ebp - 0x1bb0]
push eax
lea ecx, [ebp - 0x1aac]
push ecx
push str.Fail_to_backup__s_to__s__Error:___d_
lea edx, [ebp - 0x1bb8]
push edx
call fcn.0041ebe7
add esp, 0x14
lea ecx, [ebp - 0x1bb8]
call fcn.00401700
push eax
call fcn.004017c0
add esp, 4
mov dword [ebp - 0x1c04], 0xffffffff
lea ecx, [ebp - 0x1bb8]
call fcn.004217fd
lea ecx, [ebp - 0x1578]
call fcn.004217fd
lea ecx, [ebp - 0x1680]
call fcn.004217fd
lea ecx, [ebp - 0x1228]
call fcn.00405458
lea ecx, [ebp - 0x1330]
call fcn.004217fd
lea ecx, [ebp - 0x111c]
call fcn.00409f76
lea ecx, [ebp - 0x1898]
call fcn.004217fd
mov eax, dword [ebp - 0x1c04]
jmp 0x402a7f
call fcn.00402cf7
push ecx
mov ecx, esp
mov dword [ebp - 0x1c08], esp
lea eax, [ebp - 0x1898]
push eax
call fcn.00421572
call fcn.00401bfd
add esp, 4
mov dword [ebp - 0x1c0c], 0
lea ecx, [ebp - 0x1578]
call fcn.004217fd
lea ecx, [ebp - 0x1680]
call fcn.004217fd
lea ecx, [ebp - 0x1228]
call fcn.00405458
lea ecx, [ebp - 0x1330]
call fcn.004217fd
lea ecx, [ebp - 0x111c]
call fcn.00409f76
lea ecx, [ebp - 0x1898]
call fcn.004217fd
mov eax, dword [ebp - 0x1c0c]
pop edi
mov esp, ebp
pop ebp
ret 0x10