Function at 0x4d4804
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d4d98
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4ddf71], 4
jne 0x4d4848
mov dword [0x4de1c4], 0x40c00000
mov word [0x4de1c8], 0xdac
mov word [0x4de1ca], 0x5dc
cmp byte [0x4ddf71], 3
jne 0x4d486d
mov dword [0x4de1c4], 0x4099999a
mov word [0x4de1c8], 0x8ca
mov word [0x4de1ca], 0x384
cmp byte [0x4ddf71], 2
jne 0x4d4892
mov dword [0x4de1c4], 0x40600000
mov word [0x4de1c8], 0x5dc
mov word [0x4de1ca], 0x190
cmp byte [0x4ddf71], 1
jne 0x4d48b7
mov dword [0x4de1c4], 0x4019999a
mov word [0x4de1c8], 0x4b0
mov word [0x4de1ca], 0xc8
cmp byte [0x4ddf71], 0
jne 0x4d48dc
mov dword [0x4de1c4], 0x3fe66666
mov word [0x4de1c8], 0x384
mov word [0x4de1ca], 0x32
cmp byte [0x4ddf55], 0
jne 0x4d48ff
cmp byte [0x4ddf54], 0
jne 0x4d4bf3
cmp byte [0x4ddf47], 0
jne 0x4d4bf3
cmp byte [0x4ddf84], 0
je 0x4d4922
cmp byte [0x4ddf47], 0
jne 0x4d4922
cmp dword [0x4ddf94], 0
jne 0x4d4922
mov eax, dword [ebp - 4]
call fcn.004ce0dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38c]
mov dl, 1
call fcn.0043619c
cmp byte [0x4ddf61], 0
je 0x4d494f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov dl, byte [0x4ddf61]
call fcn.0043619c
cmp byte [0x4ddf61], 0
je 0x4d496c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov dl, byte [0x4ddf61]
call fcn.0043619c
cmp byte [0x4ddf70], 0
je 0x4d4989
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
mov dl, byte [0x4ddf70]
call fcn.0043619c
mov eax, dword [ebp - 4]
call fcn.004cec78
mov al, byte [0x4ddf72]
mov byte [0x4ddf38], al
cmp byte [0x4ddf7c], 0
je 0x4d49b8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
mov dl, byte [0x4ddf7c]
call fcn.0043619c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x328]
mov dl, byte [0x4ddf87]
call fcn.0043619c
cmp byte [0x4ddf87], 0
je 0x4d4a38
mov eax, dword [0x4dded0]
call fcn.00409260
test al, al
jne 0x4d4a2a
mov edx, 0x20
mov eax, dword [0x4dded0]
call fcn.00409424
push 0
mov eax, dword [0x4dded0]
call fcn.00404748
push eax
push dword [0x4ddec8]
push 0x4d4db0
push 0x4d4dc0
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404608
mov eax, dword [ebp - 8]
call fcn.00404748
push eax
call sub.kernel32.dll_CopyFileA
mov edx, dword [0x4dded0]
mov eax, dword [ebp - 4]
call fcn.004d52d0
cmp byte [0x4ddf90], 0
je 0x4d4a84
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x358]
cmp byte [eax + 0x30], 0
jne 0x4d4a9a
cmp byte [0x4ddf45], 0
jne 0x4d4a9a
xor edx, edx
push ebp
push 0x4d4a78
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
call fcn.004879e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d4a9a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x358]
cmp byte [eax + 0x30], 0
je 0x4d4a9a
xor edx, edx
call fcn.004879e4
mov eax, dword [ebp - 4]
call fcn.004d44c0
cmp byte [0x4ddf47], 0
jne 0x4d4d6a
mov dl, 1
mov eax, dword [0x43ca04]
call fcn.0043cb04
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.0043cba4
xor ecx, ecx
mov edx, 0x4d4dd0
mov eax, ebx
call fcn.0043cce8
test al, al
je 0x4d4b4f
cmp byte [0x4ddf98], 0
je 0x4d4b25
mov edx, 0x4d4dfc
mov eax, ebx
call fcn.0043d2c0
test al, al
je 0x4d4b48
push 1
mov ecx, 0x4d4e10
mov edx, 0x4d4dfc
mov eax, ebx
call fcn.0043d868
mov edx, 0x4d4dfc
mov eax, ebx
call fcn.0043d2c0
test al, al
je 0x4d4b48
mov edx, 0x4d4dfc
mov eax, ebx
call fcn.0043ce0c
jmp 0x4d4b48
mov edx, 0x4d4e10
mov eax, ebx
call fcn.0043d2c0
test al, al
je 0x4d4b48
push 1
mov ecx, 0x4d4dfc
mov edx, 0x4d4e10
mov eax, ebx
call fcn.0043d868
mov eax, ebx
call fcn.0043cb74
mov eax, ebx
call fcn.00403474
mov edx, 0x20
mov eax, 0x4d4e24
call fcn.00409424
mov ecx, 0x4d4e24
mov dl, 1
mov eax, dword [0x43bab8]
call fcn.0043bb68
mov ebx, eax
cmp byte [0x4ddf99], 0
je 0x4d4baf
push 0x4d4e3c
mov ecx, 0x4d4e48
mov edx, 0x4d4e5c
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 4]
push 0x4d4e3c
mov ecx, 0x4d4e6c
mov edx, 0x4d4e5c
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 4]
jmp 0x4d4bd1
mov ecx, 0x4d4e48
mov edx, 0x4d4e5c
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x50]
mov ecx, 0x4d4e6c
mov edx, 0x4d4e5c
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x50]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x54]
mov eax, ebx
call fcn.00403474
mov edx, 3
mov eax, 0x4d4e24
call fcn.00409424
jmp 0x4d4d6a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38c]
xor edx, edx
call fcn.0043619c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
xor edx, edx
call fcn.0043619c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
xor edx, edx
call fcn.0043619c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
xor edx, edx
call fcn.0043619c
cmp byte [0x4ddf38], 0
je 0x4d4c43
mov byte [0x4ddf38], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
xor edx, edx
call fcn.0043619c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x328]
xor edx, edx
call fcn.0043619c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x354]
xor edx, edx
call fcn.0043619c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x358]
xor edx, edx
call fcn.004879e4
mov byte [0x4ddf98], 0
mov byte [0x4ddf99], 0
mov eax, dword [ebp - 4]
call fcn.004d44c0
mov al, byte [0x4ddf47]
xor al, 1
and al, byte [0x4ddf54]
je 0x4d4d6a
mov dl, 1
mov eax, dword [0x43ca04]
call fcn.0043cb04
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.0043cba4
xor ecx, ecx
mov edx, 0x4d4dd0
mov eax, ebx
call fcn.0043cce8
test al, al
je 0x4d4d02
mov edx, 0x4d4e10
mov eax, ebx
call fcn.0043d2c0
test al, al
je 0x4d4cfb
push 1
mov ecx, 0x4d4dfc
mov edx, 0x4d4e10
mov eax, ebx
call fcn.0043d868
mov eax, ebx
call fcn.0043cb74
mov eax, ebx
call fcn.00403474
mov edx, 0x20
mov eax, 0x4d4e24
call fcn.00409424
mov ecx, 0x4d4e24
mov dl, 1
mov eax, dword [0x43bab8]
call fcn.0043bb68
mov ebx, eax
mov ecx, 0x4d4e48
mov edx, 0x4d4e5c
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x50]
mov ecx, 0x4d4e6c
mov edx, 0x4d4e5c
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x50]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x54]
mov eax, ebx
call fcn.00403474
mov edx, 3
mov eax, 0x4d4e24
call fcn.00409424
mov eax, dword [ebp - 4]
call fcn.004d44c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov dl, 1
call fcn.0043619c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4d9f
lea eax, [ebp - 8]
call fcn.00404288
ret