Function at 0x40a7d0
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0xe2c
push ebx
push ebp
push esi
mov esi, dword [esp + 0xe50]
push edi
push esi
mov dword [esp + 0x1c], 1
call fcn.00406fb0
mov ebp, eax
push 0x400
lea eax, [esp + 0x644]
push eax
push str.AppInit_DLLs
push 1
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
mov dword [esp + 0x34], ebp
call fcn.0040a5d0
mov edi, eax
add esp, 0x18
mov dword [esp + 0x14], edi
test edi, edi
je 0x40a82a
xor ecx, ecx
mov word [esp + 0x63c], cx
lea eax, [esp + 0x63c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40a834
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 4]
push edx
call fcn.00433af8
mov ebx, eax
add esp, 4
xor eax, eax
mov word [ebx], ax
lea eax, [esp + 0x63c]
mov dword [esp + 0x10], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40a865
sub eax, edx
sar eax, 1
inc eax
push eax
lea ecx, [esp + 0x640]
push ecx
push ebx
call fcn.004331a6
mov eax, dword [esp + 0xe64]
add esp, 0xc
test eax, eax
je 0x40a8ab
mov edx, dword [esp + 0xe5c]
push edx
lea ecx, [esp + 0x640]
push ecx
push eax
call fcn.004331a6
add esp, 0xc
test ebp, ebp
je 0x40a8c6
test dword [esp + 0xe44], 0x400
je 0x40a8c6
xor edx, edx
mov word [esp + 0x63c], dx
push 0x104
test esi, esi
jne 0x40a8f3
lea eax, [esp + 0x28]
push eax
call fcn.004071b0
mov edi, eax
add esp, 8
mov dword [esp + 0x14], eax
test edi, edi
je 0x40a901
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe2c
ret
lea ecx, [esp + 0x28]
push esi
push ecx
call fcn.004331a6
add esp, 0xc
test ebp, ebp
mov ebp, dword [esp + 0xe40]
je 0x40aa39
test esi, esi
jne 0x40a96c
push 1
push 1
lea edx, [esp + 0x43c]
push 0x104
push edx
call fcn.004052f0
mov edi, eax
add esp, 0x10
mov dword [esp + 0x14], edi
test edi, edi
jne 0x40a8e6
lea eax, [esp + 0x434]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40a941
sub eax, edx
sar eax, 1
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [esp + 0x438]
push str.drpreinject.dll
push edx
call fcn.004355b0
jmp 0x40a97f
push 0x104
lea eax, [esp + 0x438]
push esi
push eax
call fcn.004331a6
add esp, 0xc
push 1
push 0
lea ecx, [esp + 0x234]
push 0x104
push ecx
call fcn.004052f0
add esp, 0x10
test edi, edi
jne 0x40a8e6
lea eax, [esp + 0x22c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40a9b0
sub eax, edx
sar eax, 1
mov edx, 0x104
sub edx, eax
push edx
lea eax, [esp + 0x230]
push str.drpreinject.dll
push eax
call fcn.004355b0
add esp, 0xc
test ebp, ebp
je 0x40a9fa
push 0
lea ecx, [esp + 0x230]
push ecx
lea edx, [esp + 0x43c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x40aa08
lea eax, [esp + 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x24]
push ecx
call fcn.00404b70
add esp, 4
test eax, eax
je 0x40aa39
lea edx, [esp + 0x24]
push 0x104
push edx
call fcn.00404b70
add esp, 4
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004331a6
add esp, 0xc
push 0x2c
lea ecx, [esp + 0x28]
push ecx
push ebx
test ebp, ebp
je 0x40abf4
call fcn.00409370
add esp, 0xc
test eax, eax
je 0x40aaba
cmp dword [esp + 0x1c], 0
je 0x40aa6a
mov eax, dword [esp + 0xe44]
mov esi, 1
jmp 0x40aacd
push 0x104
push eax
lea edx, [esp + 0x234]
push edx
call fcn.004331a6
lea eax, [esp + 0x238]
push 0x2c
push eax
call fcn.00433a58
add esp, 0x14
test eax, eax
je 0x40aa98
xor ecx, ecx
mov word [eax], cx
lea edx, [esp + 0x22c]
push edx
call fcn.00404c40
xor ecx, ecx
add esp, 4
test al, al
mov eax, dword [esp + 0xe44]
sete cl
mov esi, ecx
jmp 0x40aacd
mov eax, dword [esp + 0xe44]
mov edx, 0
test al, 3
setne dl
mov esi, edx
mov ecx, eax
shr ecx, 0xc
and ecx, 1
or esi, ecx
test al, 1
jne 0x40aae3
test al, 2
je 0x40aae3
xor ebp, ebp
jmp 0x40aae8
mov ebp, 1
mov eax, ebx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40aaf0
sub eax, edx
sar eax, 1
je 0x40abe1
test esi, esi
je 0x40ab19
push 0x2c
lea edx, [esp + 0x28]
push edx
push ebx
call fcn.004094c0
add esp, 0xc
push 0x2c
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.00409370
add esp, 0xc
test eax, eax
jne 0x40abfc
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ab36
sub eax, edx
sar eax, 1
mov edx, eax
lea eax, [esp + 0x24]
lea esi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ab50
sub eax, esi
sar eax, 1
lea esi, [eax + edx + 2]
lea ecx, [esi + esi]
push ecx
call fcn.00433af8
mov edi, eax
mov eax, ebx
add esp, 4
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ab76
sub eax, edx
sar eax, 1
jne 0x40aba9
push esi
lea edx, [esp + 0x28]
push edx
push edi
call fcn.004331a6
add esp, 0xc
push ebx
call fcn.00433a7f
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x18]
add esp, 4
jmp 0x40abfc
test ebp, ebp
je 0x40abb5
mov ecx, ebx
lea eax, [esp + 0x24]
jmp 0x40abbb
lea ecx, [esp + 0x24]
mov eax, ebx
push ecx
push 0x2c
push eax
push str._s_c_s
push esi
push edi
call fcn.00432fb7
add esp, 0x18
push ebx
call fcn.00433a7f
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x18]
add esp, 4
jmp 0x40abfc
lea eax, [esp + 0x24]
push eax
call fcn.0044e898
add esp, 4
mov dword [esp + 0x10], eax
jmp 0x40abfc
call fcn.004094c0
add esp, 0xc
mov ebx, dword [esp + 0xe44]
mov ebp, dword [esp + 0x10]
test bl, 8
je 0x40ac30
mov eax, dword [esp + 0xe4c]
test eax, eax
je 0x40ac59
mov edx, ebx
push 0x2c
shr edx, 4
and edx, 1
push edx
push 1
push eax
push ebp
call fcn.00409540
add esp, 0x14
jmp 0x40ac62
test bl, 4
je 0x40ac5e
mov eax, dword [esp + 0xe48]
test eax, eax
je 0x40ac59
mov ecx, ebx
push 0x2c
shr ecx, 4
and ecx, 1
push ecx
push 0
push eax
push ebp
call fcn.00409540
add esp, 0x14
jmp 0x40ac62
mov edi, 0x57
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0xe50]
test esi, esi
je 0x40ac77
test eax, eax
jne 0x40ac77
mov dword [esi], 0xfffffffa
cmp edi, 0x57
jne 0x40ac8c
pop edi
pop esi
pop ebp
mov eax, 0x57
pop ebx
add esp, 0xe2c
ret
test eax, eax
jne 0x40aca5
test bl, 0x40
je 0x40aca5
push 0x2c
lea edx, [esp + 0x28]
push edx
push ebp
call fcn.004094c0
add esp, 0xc
cmp dword [esp + 0x1c], 0
je 0x40ad06
test ebx, 0x100
jne 0x40ac7c
mov eax, ebp
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40acc0
sub eax, edx
sar eax, 1
cmp eax, 0x1f
jbe 0x40ad06
test esi, esi
je 0x40acde
mov dword [esi], 0xfffffff9
test ebx, 0x200
je 0x40acf8
push 0x2c
lea eax, [esp + 0x28]
push eax
push ebp
call fcn.004094c0
add esp, 0xc
jmp 0x40ad06
test ebx, 0x800
je 0x40ad06
xor ecx, ecx
mov word [ebp + 0x3e], cx
lea ecx, [esp + 0x63c]
mov eax, ebp
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ad36
test dx, dx
je 0x40ad32
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ad36
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ad10
xor eax, eax
jmp 0x40ad3b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40ad58
push ebp
push str.AppInit_DLLs
push 1
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
call fcn.0040a4d0
add esp, 0x10
test eax, eax
jne 0x40ad63
push ebp
call fcn.00433a7f
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe2c
ret