Function at 0x412270
Capabilities:
Copy file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e1b70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebx
push ebp
push esi
lea eax, [esp + 0x28]
push edi
xor esi, esi
push eax
mov dword [esp + 0x14], esi
call fcn.00410050
mov dword [esp + 0x80], esi
push str..bak
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.00404a80
add esp, 0x10
mov ebx, 1
mov byte [esp + 0x7c], bl
mov eax, dword [eax]
push esi
push eax
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov byte [esp + 0x7c], 0
lea ecx, [esp + 0x34]
call fcn.00417490
lea ecx, [esp + 0x54]
call fcn.00411570
mov byte [esp + 0x7c], 2
push str.mail.ru
lea ecx, [esp + 0x38]
call fcn.00418470
mov byte [esp + 0x7c], 3
mov eax, dword [esp + 0x68]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x34]
push ecx
push edx
push eax
lea ecx, [esp + 0x60]
call fcn.0040eb20
push ebx
lea ecx, [esp + 0x58]
mov esi, eax
call fcn.00419fc0
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x7c], 2
lea ecx, [esp + 0x34]
call fcn.00417490
push str.yandex.ru
lea ecx, [esp + 0x38]
call fcn.00418470
mov byte [esp + 0x7c], 4
mov eax, dword [esp + 0x68]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x34]
push ecx
push edx
push eax
lea ecx, [esp + 0x60]
call fcn.0040eb20
push ebx
lea ecx, [esp + 0x58]
mov esi, eax
call fcn.00419fc0
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x7c], 2
lea ecx, [esp + 0x34]
call fcn.00417490
push str.ya.ru
lea ecx, [esp + 0x38]
call fcn.00418470
mov byte [esp + 0x7c], 5
mov eax, dword [esp + 0x68]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x34]
push ecx
push edx
push eax
lea ecx, [esp + 0x60]
call fcn.0040eb20
push ebx
lea ecx, [esp + 0x58]
mov esi, eax
call fcn.00419fc0
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x7c], 2
lea ecx, [esp + 0x34]
call fcn.00417490
push str.yandex.net
lea ecx, [esp + 0x38]
call fcn.00418470
mov byte [esp + 0x7c], 6
mov eax, dword [esp + 0x68]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0x34]
push ecx
push edx
push eax
lea ecx, [esp + 0x60]
call fcn.0040eb20
push ebx
lea ecx, [esp + 0x58]
mov esi, eax
call fcn.00419fc0
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
mov byte [esp + 0x7c], 2
lea ecx, [esp + 0x34]
call fcn.00417490
lea ecx, [esp + 0x2c]
call fcn.004173d0
test eax, eax
je 0x4128c0
mov eax, dword [esp + 0x2c]
push 0x180
push 0x8002
push eax
call fcn.0047ae0f
add esp, 0xc
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x4128c0
mov esi, eax
push esi
call fcn.004d6baf
mov ebp, eax
add esp, 4
lea ecx, [ebp + 1]
push ecx
lea ecx, [esp + 0x40]
call fcn.00411e50
mov byte [esp + 0x7c], 7
mov edx, dword [esp + 0x4c]
sub edx, dword [esp + 0x48]
jne 0x41248f
call fcn.0047a3ff
mov eax, dword [esp + 0x48]
push ebp
push eax
push esi
call fcn.0047d2a8
add esp, 0xc
cmp eax, ebp
jne 0x412881
mov ecx, dword [esp + 0x4c]
sub ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebx
cmp ebp, ecx
jb 0x4124bb
call fcn.0047a3ff
mov edx, dword [esp + 0x48]
mov byte [edx + ebp], 0
mov eax, dword [esp + 0x4c]
sub eax, dword [esp + 0x48]
mov dword [esp + 0x18], 0
jne 0x4124da
call fcn.0047a3ff
mov ecx, dword [esp + 0x48]
push ecx
lea ecx, [esp + 0x20]
call fcn.00418220
mov byte [esp + 0x7c], 8
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x54]
mov edi, dword [edx]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x68]
mov dword [esp + 0x28], edi
test eax, eax
je 0x412511
cmp eax, dword [esp + 0x54]
je 0x41251a
call fcn.0047a3ff
mov eax, dword [esp + 0x24]
cmp edi, esi
je 0x4127a5
test eax, eax
jne 0x412676
call fcn.0047a3ff
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x41253b
call fcn.0047a3ff
lea eax, [edi + 8]
push eax
lea ecx, [esp + 0x38]
call fcn.004176e0
mov byte [esp + 0x7c], 9
mov eax, dword [esp + 0x1c]
cmp dword [eax - 4], ebx
mov esi, dword [esp + 0x34]
jle 0x41256b
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [esp + 0x20]
call fcn.00401370
mov eax, dword [esp + 0x1c]
push esi
push eax
call fcn.0047a849
mov esi, eax
add esp, 8
test esi, esi
je 0x412773
nop
mov eax, dword [esp + 0x18]
add eax, ebx
cmp eax, 0x64
mov dword [esp + 0x18], eax
jg 0x412773
lea ecx, [esp + 0x34]
call fcn.004173d0
movzx edx, word [esi + eax*2]
lea edi, [esi + eax*2]
push edx
call fcn.0047ab9c
add esp, 4
test eax, eax
jne 0x412754
movzx eax, word [edi]
push eax
call fcn.0047ab86
add esp, 4
test eax, eax
jne 0x412754
cmp word [edi], 0x2d
je 0x412754
mov eax, dword [esp + 0x1c]
cmp dword [eax - 4], ebx
jle 0x4125ec
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [esp + 0x20]
call fcn.00401370
mov eax, dword [esp + 0x1c]
cmp esi, eax
je 0x412647
cmp dword [eax - 4], ebx
jle 0x412606
mov edx, dword [eax - 0xc]
push edx
lea ecx, [esp + 0x20]
call fcn.00401370
mov eax, dword [esp + 0x1c]
cmp esi, eax
jbe 0x412754
movzx eax, word [esi - 2]
push eax
call fcn.0047ab9c
add esp, 4
test eax, eax
jne 0x412754
movzx ecx, word [esi - 2]
push ecx
call fcn.0047ab86
add esp, 4
test eax, eax
jne 0x412754
cmp word [esi - 2], 0x2d
je 0x412754
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], 2
mov edi, esi
cmp dword [eax - 4], ebx
jle 0x412667
mov edx, dword [eax - 0xc]
push edx
lea ecx, [esp + 0x20]
call fcn.00401370
mov eax, dword [esp + 0x1c]
cmp edi, eax
jb 0x41267d
cmp word [edi], 0xa
je 0x41267d
sub edi, 2
jmp 0x412651
mov eax, dword [eax]
jmp 0x412531
cmp dword [eax - 4], ebx
jle 0x412693
mov eax, dword [eax - 0xc]
push eax
lea ecx, [esp + 0x20]
call fcn.00401370
mov eax, dword [esp + 0x1c]
cmp edi, eax
jae 0x4126b0
cmp dword [eax - 4], ebx
jle 0x4126ad
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [esp + 0x20]
call fcn.00401370
mov eax, dword [esp + 0x1c]
mov edi, eax
nop
cmp dword [eax - 4], ebx
jle 0x4126c6
mov edx, dword [eax - 0xc]
push edx
lea ecx, [esp + 0x20]
call fcn.00401370
mov eax, dword [esp + 0x1c]
lea ecx, [eax + ebp*2]
cmp esi, ecx
jae 0x4126d8
cmp word [esi], 0xa
je 0x4126d8
add esi, 2
jmp 0x4126b0
cmp dword [eax - 4], ebx
jle 0x4126ee
mov edx, dword [eax - 0xc]
push edx
lea ecx, [esp + 0x20]
call fcn.00401370
mov eax, dword [esp + 0x1c]
lea ecx, [eax + ebp*2]
cmp esi, ecx
jb 0x41270e
cmp dword [eax - 4], ebx
jle 0x41270b
mov edx, dword [eax - 0xc]
push edx
lea ecx, [esp + 0x20]
call fcn.00401370
mov eax, dword [esp + 0x1c]
lea esi, [eax + ebp*2]
cmp dword [eax - 4], ebx
jle 0x412724
mov eax, dword [eax - 0xc]
push eax
lea ecx, [esp + 0x20]
call fcn.00401370
mov eax, dword [esp + 0x1c]
sub esi, edi
sub edi, eax
sar esi, 1
push esi
sar edi, 1
push edi
lea ecx, [esp + 0x24]
call fcn.0040e990
mov eax, dword [esp + 0x1c]
cmp dword [eax - 4], ebx
jle 0x412751
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [esp + 0x20]
call fcn.00401370
mov eax, dword [esp + 0x1c]
lea esi, [eax - 2]
mov edx, dword [esp + 0x34]
push edx
add esi, 2
push esi
call fcn.0047a849
mov edi, dword [esp + 0x30]
mov esi, eax
add esp, 8
test esi, esi
jne 0x412580
mov byte [esp + 0x7c], 8
lea ecx, [esp + 0x34]
call fcn.00417490
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4127a1
call fcn.0047a3ff
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x41279a
call fcn.0047a3ff
mov edi, dword [edi]
jmp 0x4124fb
mov eax, dword [eax]
jmp 0x412790
cmp dword [esp + 0x18], 0x64
jle 0x4127fa
mov eax, dword [esp + 0x14]
push eax
call fcn.0048893a
add esp, 4
mov byte [esp + 0x7c], 7
lea ecx, [esp + 0x1c]
call fcn.00417490
mov byte [esp + 0x7c], 0xa
mov eax, dword [esp + 0x48]
xor esi, esi
cmp eax, esi
je 0x4127df
push eax
call fcn.0045d8c9
add esp, 4
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov byte [esp + 0x7c], 2
mov ecx, dword [esp + 0x3c]
push ecx
jmp 0x4128b8
mov esi, dword [esp + 0x14]
push 0
push esi
call fcn.0047ccca
push 0
push 0
push esi
call fcn.0047e6b5
mov eax, dword [esp + 0x30]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.0047a8aa
add esp, 0x1c
test eax, eax
jl 0x412986
mov ecx, dword [esp + 0x1c]
cmp eax, dword [ecx - 8]
jg 0x412986
mov dword [ecx - 0xc], eax
mov ecx, dword [esp + 0x1c]
xor edx, edx
mov word [ecx + eax*2], dx
push edx
lea ecx, [esp + 0x20]
call fcn.00417810
push eax
push 0
lea ecx, [esp + 0x24]
call fcn.00417800
push eax
push esi
call fcn.0047c94b
add esp, 0xc
test eax, eax
jle 0x412873
test byte [esp + 0x10], 2
je 0x412873
or dword [esp + 0x10], 4
mov byte [esp + 0x7c], 7
lea ecx, [esp + 0x1c]
call fcn.00417490
push esi
xor edi, edi
call fcn.0048893a
add esp, 4
mov byte [esp + 0x7c], 0xc
mov eax, dword [esp + 0x48]
cmp eax, edi
je 0x4128a2
push eax
call fcn.0045d8c9
add esp, 4
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
mov byte [esp + 0x7c], 2
mov edx, dword [esp + 0x3c]
push edx
call fcn.0045d8c9
add esp, 4
lea ecx, [esp + 0x34]
call fcn.004173e0
test byte [esp + 0x10], 4
je 0x4129e9
mov bl, 0xe
mov byte [esp + 0x7c], bl
mov eax, dword [esp + 0x2c]
push eax
sub esp, 8
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x4e88c0
call fcn.00418470
mov byte [esp + 0x88], 0xf
sub esp, 8
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x4ebaf8
call fcn.00418470
mov byte [esp + 0x90], 0x10
lea ecx, [esp + 0x38]
push ecx
mov byte [esp + 0x94], bl
mov ecx, 0x530ce4
call fcn.0041d7f0
mov byte [esp + 0x80], 0x11
mov eax, dword [eax]
push eax
lea edx, [esp + 0x3c]
push edx
call fcn.00404b40
add esp, 0xc
mov byte [esp + 0x7c], bl
lea ecx, [esp + 0x24]
call fcn.00417490
mov ecx, 0x4e97fc
mov eax, 0x53032c
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412990
test dx, dx
je 0x412982
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412990
add eax, 4
add ecx, 4
test dx, dx
jne 0x412960
xor eax, eax
jmp 0x412995
push 0x80070057
call fcn.004010d0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4129d7
mov ecx, 0x4e97f4
mov eax, 0x53032c
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4129c9
test dx, dx
je 0x4129c5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4129c9
add eax, 4
add ecx, 4
test dx, dx
jne 0x4129a3
xor eax, eax
jmp 0x4129ce
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov eax, str.Mail.Ru_Agent
jne 0x4129dc
mov eax, 0x4e97bc
push 0x40
push eax
mov eax, dword [esp + 0x3c]
push eax
jmp 0x412af1
mov bl, 0x12
mov byte [esp + 0x7c], bl
mov ecx, dword [esp + 0x2c]
push ecx
sub esp, 8
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x4e88c0
call fcn.00418470
mov byte [esp + 0x88], 0x13
sub esp, 8
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x4eb9c8
call fcn.00418470
mov byte [esp + 0x90], 0x14
lea edx, [esp + 0x38]
push edx
mov byte [esp + 0x94], bl
mov ecx, 0x530ce4
call fcn.0041d7f0
mov byte [esp + 0x80], 0x15
mov eax, dword [eax]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00404b40
add esp, 0xc
mov byte [esp + 0x7c], bl
lea ecx, [esp + 0x24]
call fcn.00417490
mov ecx, 0x4e97fc
mov eax, 0x53032c
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412a96
test dx, dx
je 0x412a92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412a96
add eax, 4
add ecx, 4
test dx, dx
jne 0x412a70
xor eax, eax
jmp 0x412a9b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x412ae4
mov ecx, 0x4e97f4
mov eax, 0x53032c
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412ad6
test dx, dx
je 0x412ad2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412ad6
add eax, 4
add ecx, 4
test dx, dx
jne 0x412ab0
xor eax, eax
jmp 0x412adb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov eax, str.Mail.Ru_Agent
jne 0x412ae9
mov eax, 0x4e97bc
mov ecx, dword [esp + 0x34]
push 0x10
push eax
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [esp + 0x7c], 2
lea ecx, [esp + 0x34]
call fcn.00417490
mov byte [esp + 0x7c], 0x16
lea ecx, [esp + 0x54]
call fcn.0040f260
mov edx, dword [esp + 0x68]
push edx
call fcn.0045d8c9
mov dword [esp + 0x6c], 0
mov byte [esp + 0x80], 0
mov eax, dword [esp + 0x58]
push eax
call fcn.0045d8c9
add esp, 8
mov dword [esp + 0x7c], 0xffffffff
lea ecx, [esp + 0x2c]
call fcn.00417490
mov ecx, dword [esp + 0x74]
mov eax, dword [esp + 0x10]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret