Function at 0x42eb70
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x459db8
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x4ec560]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xffffffffffffffff
mov ecx, 0x4ee85c
call sub.mfc140.dll_Ordinal_8442
push dword [0x4ee760]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__filelength]
add esp, 4
cmp eax, 0x1400000
jle 0x42ec2f
push dword [0x4ee760]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
add esp, 4
mov ecx, 0x4ee868
call dword [sym.imp.mfc140.dll_Ordinal_1661]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
mov ecx, 0x4ee868
push 0
call dword [sym.imp.mfc140.dll_Ordinal_1661]
push eax
mov ecx, 0x4ee864
call dword [sym.imp.mfc140.dll_Ordinal_1661]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, 0x4ee864
call dword [sym.imp.mfc140.dll_Ordinal_1661]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
call fcn.0042e960
cmp eax, 0xffffffff
jne 0x42ec2f
mov ecx, 0x4ee85c
call fcn.00437943
jmp 0x42edcf
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push 0x1000
push 0x4ee890
call fcn.00422870
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
mov ecx, 0x4ee890
add esp, 0x1c
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42ec61
sub ecx, edx
cmp byte [ecx + 0x4ee88f], 0xa
je 0x42ec9b
mov ecx, 0x4ee890
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x42ec80
mov ax, word [0x468464]
mov word [ecx], ax
mov al, byte [0x468466]
mov byte [ecx + 2], al
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [ebp - 0xc8]
call dword [sym.imp.mfc140.dll_Ordinal_316]
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov dword [ebp - 0xd4], eax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xc4]
mov dword [ebp - 0xd0], edx
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
add esp, 0xc
test eax, eax
jne 0x42ede8
lea eax, [ebp - 0xc4]
push eax
push str._Y__m__d__H:_M:_S
lea eax, [ebp - 0x90]
push 0x80
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
add esp, 0x10
lea ecx, [ebp - 0xcc]
neg eax
sbb al, al
and byte [ebp - 0x90], al
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_310]
movzx eax, word [ebp - 0x92]
push eax
push dword [ebp - 0xcc]
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea eax, [ebp - 0xc8]
push str._Thread__d__s._03d_t_t
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xcc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
push 0x4ee890
lea ecx, [ebp - 0xc8]
call dword [sym.imp.mfc140.dll_Ordinal_1696]
push 2
push 0
push dword [0x4ee760]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__lseek]
add esp, 0xc
lea ecx, [ebp - 0xc8]
call dword [sym.imp.mfc140.dll_Ordinal_5861]
push eax
push 0
lea ecx, [ebp - 0xc8]
call dword [sym.imp.mfc140.dll_Ordinal_5095]
push eax
push dword [0x4ee760]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__write]
add esp, 0xc
mov ecx, 0x4ee85c
call fcn.00437943
lea ecx, [ebp - 0xc8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004385c0
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.0042c1c0
int3