Function at 0x411ffa
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x6c45ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x6d0efc
mov dword [ebp - 0x30], ecx
push esi
mov ebx, edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x412028
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push 0xa
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x629200
lea eax, [ebp - 0x2c]
push 0x14
push eax
call fcn.00412847
add esp, 0x10
mov ecx, 0x628d30
cmp byte [0x6d17d1], 0
mov eax, 0x628d2c
cmove eax, ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push eax
push 0x628d34
lea eax, [ebp - 0x2c]
push eax
call esi
mov edi, 0x6d0efc
lea eax, [ebp - 0x2c]
push edi
push 0x6cfc70
push str.pdtname
push eax
call esi
push edi
push 0x6d0a80
push str.proctype
lea eax, [ebp - 0x2c]
push eax
call esi
lea eax, [ebp - 0x2c]
sub ebx, 1
je 0x4120b9
sub ebx, 1
mov ebx, edi
push ebx
je 0x4120b2
push str.crash
jmp 0x4120c4
push str.hang
jmp 0x4120c4
mov ebx, 0x6d0efc
push ebx
push str.trycatch
push str.crashtype
push eax
call esi
push dword [0x6d0ae4]
mov edi, 0x6d57f0
push 0x629200
push edi
call fcn.00412829
add esp, 0xc
lea eax, [ebp - 0x2c]
push ebx
push edi
push str.trycatchcnt
push eax
call esi
mov edi, 0x6d17f0
mov ecx, 0x6cd264
push 0x2000
mov edx, edi
call fcn.004116dd
pop ecx
push ebx
push edi
push str.cururl
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6cfd24
push 0x628dd8
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6cfcc0
push str.pdtver
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6d09f4
push 0x628df8
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6d1780
push str.ExcptCode
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6d130c
push str.module
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6d171c
push str.modulever
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6d17a8
push 0x628e38
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6d0724
push str.osver
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6d092c
push str.iever
lea eax, [ebp - 0x2c]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x628e60
push 0xffffffffffffffff
mov edi, 0x6d57f0
push edi
call fcn.0040ce72
add esp, 0x10
lea eax, [ebp - 0x2c]
push ebx
push edi
push 0x628e68
push eax
call esi
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x41221c
cmp dword [ebx], 0
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
je 0x4121fe
push 0x6d0efc
push 0x50
push dword [ebx]
lea eax, [ebp - 0x2c]
push str.ExceptionRecord
push eax
call edi
cmp dword [ebx + 4], 0
je 0x41221c
push 0x6d0efc
push 0x2cc
push dword [ebx + 4]
lea eax, [ebp - 0x2c]
push str.ContextRecord
push eax
call edi
mov edi, 0x6d0cf4
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
call fcn.00411659
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x6d0aec
push str._s_u__d__s
push 0x104
mov ebx, 0x6d57f0
push ebx
call fcn.0040ce72
add esp, 0x1c
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
pop edi
test eax, eax
je 0x412273
push 0x6d0efc
push ebx
push str.dump
lea eax, [ebp - 0x2c]
push eax
call esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00590be8
leave
ret