Function at 0x410d13
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x510
sub eax, 0x9c5a
push ebx
push esi
push edi
mov esi, ecx
je 0x410e20
sub eax, 4
je 0x410df5
sub eax, 5
je 0x410d8d
sub eax, 0x14
je 0x410d5b
sub eax, 0x1b
jne 0x411185
push dword [ebp + 8]
lea eax, [esi + 0x618]
call fcn.0041955e
jmp 0x411185
lea edi, [esi + 0x5b8]
mov eax, edi
call fcn.0040afc6
test eax, eax
jle 0x410d79
push 0x4201fc
or eax, 0xffffffff
call fcn.0040afe1
mov eax, dword [ebp + 8]
add eax, 0xc
push eax
or eax, 0xffffffff
call fcn.0040afe1
jmp 0x411185
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp dword [eax + 0xedc], ebx
jbe 0x410dd2
mov ecx, dword [esi + 0x5ac]
cmp dword [ecx + 0x3c], ebx
je 0x410dd2
mov esi, dword [esi + 0x5b0]
xor edi, edi
inc edi
jmp 0x410dbb
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
inc edi
push edi
push dword [esi + 0x93a0]
mov eax, esi
call fcn.0040575f
cmp eax, ebx
jne 0x410db0
jmp 0x411185
cmp dword [eax + 0xe94], ebx
je 0x411185
add eax, 0xc
cmp byte [eax], bl
je 0x411185
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
jmp 0x411185
lea edi, [esi + 0x5b8]
mov eax, edi
call fcn.0040afc6
test eax, eax
jle 0x410e13
push 0x4201fc
or eax, 0xffffffff
call fcn.0040afe1
mov eax, dword [ebp + 8]
add eax, 0x35b
jmp 0x410d7f
mov edi, dword [ebp + 8]
cmp dword [edi + 0xe70], 2
jne 0x410e43
lea eax, [edi + 0xd60]
push eax
mov eax, dword [esi + 0x5b0]
add eax, 0x244
call fcn.00413521
cmp dword [edi + 0xe70], 4
jne 0x410e63
lea eax, [edi + 0xd60]
push eax
mov eax, dword [esi + 0x5b0]
add eax, 0x8fe0
call fcn.00401c34
push 0x3ff
lea eax, [ebp - 0x50b]
push 0
push eax
mov byte [ebp - 0x50c], 0
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x13
pop ebx
call fcn.0040cc09
lea ebx, [edi + 0xc]
mov ecx, ebx
mov dword [ebp + 8], eax
call fcn.00409fb5
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x50c]
push 0x3ff
push eax
call sub.msvcrt.dll__snprintf
add esp, 0x10
lea eax, [ebp - 0x50c]
push eax
mov eax, esi
call fcn.004019d0
cmp dword [edi + 0xecc], 2
jne 0x410f55
push 0x104
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call sub.msvcrt.dll_memset
add esp, 0xc
mov ecx, edi
call fcn.00410cf3
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00410b44
mov eax, dword [esi + 0x5ac]
cmp dword [eax + 0x158], 0
je 0x410f38
push str.kernel32.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push str.CreateHardLinkA
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x411153
push 0
push ebx
lea ecx, [ebp - 0x10c]
push ecx
call eax
jmp 0x411153
push dword [edi + 0xec8]
lea eax, [ebp - 0x10c]
push dword [edi + 0xec4]
push eax
call fcn.0041868a
jmp 0x411153
xor ebx, ebx
cmp dword [edi + 0xedc], ebx
jbe 0x410fe4
mov eax, dword [esi + 0x5ac]
cmp dword [eax + 0x3c], ebx
je 0x410fe4
push 0x104
lea eax, [ebp - 0x10b]
push ebx
push eax
mov byte [ebp - 0x10c], bl
call sub.msvcrt.dll_memset
add esp, 0xc
mov ecx, edi
call fcn.00410cf3
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00410b44
mov ecx, dword [esi + 0x5b0]
push ebx
lea eax, [ebp - 0x10c]
push eax
push edi
call fcn.004057f6
mov eax, dword [esi + 0x5b0]
cmp dword [eax + 0x94b4], ebx
je 0x411153
push 0x17
pop ebx
call fcn.0040cc09
push 0x30
push 0x41f4e4
push eax
push dword [esi + 0x108]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x411153
cmp dword [edi + 0xe94], ebx
je 0x411153
mov eax, dword [edi + 0xe70]
cmp eax, 1
je 0x4110fe
cmp eax, 3
je 0x4110fe
push 0x104
cmp eax, 4
push ebx
lea eax, [ebp - 0x10b]
mov byte [ebp - 0x10c], bl
push eax
jne 0x41107c
call sub.msvcrt.dll_memset
add esp, 0xc
mov ecx, edi
call fcn.00410cf3
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00410b44
lea ecx, [edi + 0xc]
call fcn.00409fb5
push eax
lea eax, [edi + 0xea4]
push eax
lea eax, [ebp - 0x10c]
push eax
push dword [edi + 0xe90]
lea eax, [edi + 0xd60]
push dword [edi + 0xed0]
push eax
mov eax, dword [esi + 0x5b0]
add eax, 0x8fe0
push eax
call fcn.00401d3d
jmp 0x411153
call sub.msvcrt.dll_memset
add esp, 0xc
mov ecx, edi
call fcn.00410cf3
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00410b44
cmp dword [edi + 0xeec], 0x20
lea eax, [edi + 0xea4]
jne 0x4110ca
push ebx
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [edi + 0xc]
push eax
mov eax, dword [esi + 0x5b0]
add eax, 0x244
push eax
call fcn.00413652
jmp 0x411153
push eax
lea eax, [ebp - 0x10c]
push eax
push dword [edi + 0xe90]
lea eax, [edi + 0xd60]
push dword [edi + 0xea0]
push dword [edi + 0xe9c]
push eax
mov eax, dword [esi + 0x5b0]
add eax, 0x244
push eax
call fcn.0041381b
jmp 0x411153
push 0x104
lea eax, [ebp - 0x10b]
push ebx
push eax
mov byte [ebp - 0x10c], bl
call sub.msvcrt.dll_memset
add esp, 0xc
mov ecx, edi
call fcn.00410cf3
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00410b44
cmp dword [edi + 0xe98], ebx
lea eax, [ebp - 0x10c]
je 0x411147
push eax
lea eax, [edi + 0xc]
push eax
call fcn.00413223
jmp 0x411153
push ebx
push eax
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
cmp dword [edi + 0xe70], 2
jne 0x41116c
mov eax, dword [esi + 0x5b0]
add eax, 0x244
call fcn.004135a7
cmp dword [edi + 0xe70], 4
jne 0x411185
mov eax, dword [esi + 0x5b0]
add eax, 0x8fe0
call fcn.00401d16
pop edi
pop esi
pop ebx
leave
ret 4