Function at 0x409f1b
Capabilities:
Copy file
Query environment variable
Terminate process

Disassembly:
mov eax, 0x1000
call sub.ntdll.dll__alloca_probe
push ebx
push ebp
push esi
push edi
push 0x20
call fcn.0040263b
pop ecx
xor edi, edi
mov ebp, eax
push edi
push ebp
mov ebx, 0x200
push ebx
push dword [0x401144]
call fcn.00408f24
mov esi, 0x800
push esi
push dword [0x40cfe8]
call fcn.0040264f
push esi
push dword [0x40cfec]
mov dword [0x40cfe8], eax
call fcn.0040264f
push 0x9b4
push dword [0x40cfe0]
mov dword [0x40cfec], eax
call fcn.0040264f
add esp, 0x18
mov dword [0x40cfe0], eax
mov dword [eax], edi
push esi
push dword [0x40cfe8]
push edi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
push esi
push dword [0x40cfec]
mov esi, dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
push 0x4022c4
call esi
push 0x20
push 0x22
mov edi, 0x4013e0
push edi
push ebp
call fcn.0040a315
push 0x20
push 0x26
push 0x401404
push ebp
call fcn.0040a315
push 0
push edi
call fcn.0040968a
push 0x295
push ebp
push 0x40cbc4
push 0x401148
mov dword [0x40cbc0], eax
call fcn.00409cb8
push ebx
push ebp
push 0x40ca98
push 0x401430
mov dword [0x40cbc8], eax
call fcn.00409cb8
mov dword [0x40d098], eax
lea eax, [esp + 0x10]
push 0x800
push eax
push 0x4022d0
call esi
test eax, eax
jne 0x40a024
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ebx, dword [sym.imp.kernel32.dll_lstrcatW]
lea eax, [esp + 0x10]
push 0x402218
push eax
call ebx
push dword [0x40cfe8]
call dword [sym.imp.shlwapi.dll_PathFindFileNameW]
push eax
lea eax, [esp + 0x14]
push eax
call ebx
lea eax, [esp + 0x10]
push eax
push dword [0x40cfe8]
call dword [sym.imp.kernel32.dll_lstrcmpiW]
test eax, eax
lea eax, [esp + 0x10]
push eax
je 0x40a088
call fcn.004098b9
test eax, eax
jne 0x40a083
push eax
lea eax, [esp + 0x14]
push eax
push dword [0x40cfe8]
call dword [sym.imp.kernel32.dll_CopyFileW]
test eax, eax
je 0x40a08d
lea eax, [esp + 0x10]
push eax
call fcn.00409d43
mov ebx, 0x800
push ebx
call fcn.0040263b
pop ecx
push ebx
mov edi, eax
push edi
push 0x4022e0
call esi
test eax, eax
jne 0x40a0b9
push ebx
push edi
push 0x4022f0
call esi
test eax, eax
je 0x40a01c
push 0x40
call fcn.0040263b
pop ecx
push 0
push 0x20
push ebp
mov dword [0x40cff0], eax
call fcn.004026f1
push eax
call fcn.0040968a
push 0
push 0x401404
mov dword [0x40cff0], eax
call fcn.0040968a
mov esi, dword [sym.imp.kernel32.dll_lstrcpyW]
push eax
push 0x40d000
call esi
push ebx
call fcn.0040263b
pop ecx
mov ebx, eax
push edi
push ebx
call esi
push ebx
call dword [sym.imp.shlwapi.dll_PathAddBackslashW]
push dword [0x40cff0]
push ebx
call dword [sym.imp.kernel32.dll_lstrcatW]
push 0xa
pop esi
push ebx
call fcn.00409e0a
mov edi, eax
test edi, edi
je 0x40a131
push 0x3e8
dec esi
call dword [sym.imp.kernel32.dll_Sleep]
test esi, esi
jle 0x40a139
test edi, edi
jne 0x40a119
cmp esi, 1
jl 0x40a01c
mov edi, 0xe01
push edi
call fcn.0040263b
push edi
mov ebx, eax
push 0
push ebx
call fcn.004024ba
push edi
push 0x40d74a
push ebx
call fcn.004024e8
add esp, 0x1c
push 0x20
push edi
push ebx
push ebp
call fcn.0040a315
mov esi, 0x402310
push esi
push ebx
call dword [sym.imp.shlwapi.dll_StrStrA]
mov ebp, eax
test ebp, ebp
je 0x40a01c
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
mov esi, eax
mov ecx, 0xfffe00
sub ecx, esi
push ecx
call fcn.0040263b
sub ebp, ebx
mov dword [0x40cfe4], eax
push ebp
push ebx
push eax
call fcn.004024e8
mov eax, dword [0x40cfe4]
push 0x300
add eax, ebp
push 0x40cbe0
push eax
call fcn.004024e8
sub edi, ebp
lea eax, [esi + ebp]
add eax, ebx
sub edi, esi
push edi
push eax
mov eax, dword [0x40cfe4]
add eax, 0x300
add eax, ebp
push eax
call fcn.004024e8
push ebx
call fcn.00402627
add esp, 0x2c
push 0xfffffffffffffff5
call dword [sym.imp.kernel32.dll_GetStdHandle]
push 7
push 0x401630
push eax
call fcn.00402354
push 0x40cbe0
push dword [0x40cfe0]
call fcn.00409b9c
call fcn.004096cb
call fcn.0040979f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1000
ret