Function at 0x401280
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404189
mov eax, dword fs:[0]
push eax
sub esp, 0x1e4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push 0
push 0x23
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edx, esi
lea ecx, [ebp - 0x1f0]
call fcn.00402b50
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1dc]
mov eax, ecx
mov edx, dword [ebp - 0x1e0]
sub eax, edx
cmp eax, 0x1f
jb 0x401391
cmp ecx, 0xf
lea esi, [ebp - 0x1f0]
lea eax, [edx + 0x1f]
cmova esi, dword [ebp - 0x1f0]
mov dword [ebp - 0x1e0], eax
cmp esi, 0x40523b
jae 0x40133f
lea eax, [esi + edx]
cmp eax, str._ac_filesuiAndroidEmulatorEx_
jb 0x40133f
cmp esi, str._ac_filesuiAndroidEmulatorEx_
ja 0x401330
mov dword [ebp - 0x190], 0
jmp 0x401349
mov eax, esi
sub eax, str._ac_filesuiAndroidEmulatorEx_
mov dword [ebp - 0x190], eax
jmp 0x401349
mov dword [ebp - 0x190], 0x1f
lea eax, [edx + 1]
push eax
lea ecx, [esi + 0x1f]
push esi
push ecx
call sub.VCRUNTIME140.dll_memmove
push dword [ebp - 0x190]
push str._ac_filesuiAndroidEmulatorEx_
push esi
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [ebp - 0x190]
mov eax, 0x1f
sub eax, edx
push eax
lea eax, [edx + 0x40523b]
lea ecx, [esi + edx]
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x24
lea eax, [ebp - 0x1f0]
jmp 0x4013b0
push 0x1f
sub esp, 8
mov byte [ebp - 0x190], 0
lea ecx, [ebp - 0x1f0]
push dword [ebp - 0x190]
push 0x1f
call fcn.00403260
mov dword [ebp - 0x198], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1a8], xmm0
mov dword [ebp - 0x194], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x1a8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x198], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x194]
mov eax, edx
mov ecx, dword [ebp - 0x198]
sub eax, ecx
cmp eax, 4
jb 0x40143c
lea eax, [ecx + 4]
cmp edx, 0xf
mov dword [ebp - 0x198], eax
lea eax, [ebp - 0x1a8]
cmova eax, dword [ebp - 0x1a8]
mov dword [eax + ecx], 0x6578652e
mov byte [eax + ecx + 4], 0
lea eax, [ebp - 0x1a8]
jmp 0x40145d
push 4
push str..exe
mov byte [ebp - 0x190], 0
lea ecx, [ebp - 0x1a8]
push dword [ebp - 0x190]
push 4
call fcn.00402f40
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x18c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x17c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x194]
cmp ecx, 0xf
jbe 0x4014bf
mov edx, dword [ebp - 0x1a8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4014b5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40150a
push ecx
push edx
call fcn.004033e1
add esp, 8
mov dword [ebp - 0x198], 0
mov dword [ebp - 0x194], 0xf
mov byte [ebp - 0x1a8], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x1dc]
cmp ecx, 0xf
jbe 0x40151a
mov edx, dword [ebp - 0x1f0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401510
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401510
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004033e1
add esp, 8
lea eax, [ebp - 0x114]
mov dword [ebp - 0x1e0], 0
push eax
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x1dc], 0xf
mov byte [ebp - 0x1f0], 0
call fcn.00402910
mov byte [ebp - 4], 5
lea edx, [ebp - 0x18c]
cmp dword [ebp - 0x178], 0xf
mov eax, dword [ebp - 0x130]
cmova edx, dword [ebp - 0x18c]
mov esi, dword [ebp - 0x134]
sub eax, esi
mov ecx, dword [ebp - 0x17c]
push ecx
push edx
cmp ecx, eax
ja 0x4015ad
cmp dword [ebp - 0x130], 0xf
lea eax, [esi + ecx]
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x144]
cmova eax, dword [ebp - 0x144]
add esi, eax
push esi
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x17c]
add esp, 0xc
mov byte [esi + eax], 0
jmp 0x4015c6
mov byte [ebp - 0x190], 0
push dword [ebp - 0x190]
push ecx
lea ecx, [ebp - 0x144]
call fcn.00402f40
push str.InstallPath
lea ecx, [ebp - 0x1c0]
call fcn.00402910
push str.SOFTWAREWOW6432NodeTencentMobileGamePCUI
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 6
call fcn.00402910
lea eax, [ebp - 0x1c0]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x1d8]
push eax
lea ecx, [ebp - 0x174]
call fcn.00401170
add esp, 8
mov ecx, eax
mov byte [ebp - 4], 8
mov esi, dword [ecx + 0x14]
mov eax, esi
mov edx, dword [ecx + 0x10]
sub eax, edx
cmp eax, 1
jb 0x401636
lea eax, [edx + 1]
mov dword [ecx + 0x10], eax
mov eax, ecx
cmp esi, 0xf
jbe 0x40162e
mov eax, dword [ecx]
mov word [eax + edx], 0x5c
jmp 0x401653
push 1
push 0x40523c
mov byte [ebp - 0x190], 0
push dword [ebp - 0x190]
push 1
call fcn.00402f40
mov ecx, eax
mov dword [ebp - 0x198], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1a8], xmm0
mov dword [ebp - 0x194], 0
movups xmm0, xmmword [ecx]
movups xmmword [ebp - 0x1a8], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [ebp - 0x198], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
push edi
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 9
call fcn.00402840
mov dword [ebp - 0x11c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x12c], xmm0
mov dword [ebp - 0x118], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x12c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x11c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x194]
cmp ecx, 0xf
jbe 0x40172d
mov edx, dword [ebp - 0x1a8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401723
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401826
push ecx
push edx
call fcn.004033e1
add esp, 8
mov dword [ebp - 0x198], 0
mov dword [ebp - 0x194], 0xf
mov byte [ebp - 0x1a8], 0
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x160]
cmp ecx, 0xf
jbe 0x401786
mov edx, dword [ebp - 0x174]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40177c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401826
push ecx
push edx
call fcn.004033e1
add esp, 8
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 0xf
mov byte [ebp - 0x174], 0
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x1c4]
cmp ecx, 0xf
jbe 0x4017db
mov edx, dword [ebp - 0x1d8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4017d1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401826
push ecx
push edx
call fcn.004033e1
add esp, 8
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x1c4], 0xf
mov byte [ebp - 0x1d8], 0
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x1ac]
cmp ecx, 0xf
jbe 0x401836
mov edx, dword [ebp - 0x1c0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40182c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40182c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004033e1
add esp, 8
cmp dword [edi + 0x14], 0xf
mov ecx, dword [edi + 0x10]
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 0x1ac], 0xf
mov byte [ebp - 0x1c0], 0
jbe 0x40185c
mov edi, dword [edi]
cmp ecx, 0x15
jne 0x401910
mov edx, str.AndroidEmulatorEx.exe
sub ecx, 4
jb 0x401881
nop
mov eax, dword [edi]
cmp eax, dword [edx]
jne 0x401886
add edi, 4
add edx, 4
sub ecx, 4
jae 0x401870
cmp ecx, 0xfffffffc
je 0x4018ba
mov al, byte [edi]
cmp al, byte [edx]
jne 0x4018b3
cmp ecx, 0xfffffffd
je 0x4018ba
mov al, byte [edi + 1]
cmp al, byte [edx + 1]
jne 0x4018b3
cmp ecx, 0xfffffffe
je 0x4018ba
mov al, byte [edi + 2]
cmp al, byte [edx + 2]
jne 0x4018b3
cmp ecx, 0xffffffff
je 0x4018ba
mov al, byte [edi + 3]
cmp al, byte [edx + 3]
je 0x4018ba
sbb eax, eax
or eax, 1
jmp 0x4018bc
xor eax, eax
test eax, eax
jne 0x401910
cmp dword [ebp - 0x118], 0xf
lea eax, [ebp - 0x12c]
cmova eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlink]
add esp, 4
lea ecx, [ebp - 0x12c]
cmp dword [ebp - 0x118], 0xf
lea eax, [ebp - 0x144]
cmova ecx, dword [ebp - 0x12c]
cmp dword [ebp - 0x130], 0xf
push 0
cmova eax, dword [ebp - 0x144]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str._vm_100
lea ecx, [ebp - 0x15c]
call fcn.00402910
mov byte [ebp - 4], 0xf
mov eax, 0x7fffffff
mov ecx, dword [ebp - 0x11c]
sub eax, ecx
cmp eax, 1
jb 0x401cac
cmp dword [ebp - 0x118], 0xf
lea eax, [ebp - 0x12c]
push ecx
cmova eax, dword [ebp - 0x12c]
push eax
push 1
push 0x4052a0
push ecx
push dword [ebp - 0x190]
lea ecx, [ebp - 0x1d8]
call fcn.00403110
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x1c4]
mov eax, edx
mov ecx, dword [ebp - 0x1c8]
sub eax, ecx
cmp eax, 2
jb 0x4019b1
lea eax, [ecx + 2]
cmp edx, 0xf
mov dword [ebp - 0x1c8], eax
mov edx, 0x2022
lea eax, [ebp - 0x1d8]
cmova eax, dword [ebp - 0x1d8]
mov word [eax + ecx], dx
mov byte [eax + ecx + 2], 0
lea eax, [ebp - 0x1d8]
jmp 0x4019d2
push 2
push 0x40529c
mov byte [ebp - 0x190], 0
lea ecx, [ebp - 0x1d8]
push dword [ebp - 0x190]
push 2
call fcn.00402f40
mov dword [ebp - 0x1b0], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1c0], xmm0
mov dword [ebp - 0x1ac], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x1c0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1b0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x15c]
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp - 0x1c0]
call fcn.00402840
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x174], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x1ac]
movq qword [ebp - 0x164], xmm0
cmp ecx, 0xf
jbe 0x401a8c
mov edx, dword [ebp - 0x1c0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401a82
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401ad3
push ecx
push edx
call fcn.004033e1
add esp, 8
mov ecx, dword [ebp - 0x1c4]
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 0x1ac], 0xf
mov byte [ebp - 0x1c0], 0
cmp ecx, 0xf
jbe 0x401ae3
mov edx, dword [ebp - 0x1d8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401ad9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401ad9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004033e1
add esp, 8
cmp dword [ebp - 0x148], 0xf
lea ecx, [ebp - 0x15c]
push 1
cmova ecx, dword [ebp - 0x15c]
lea eax, [ebp - 0x12c]
cmp dword [ebp - 0x118], 0xf
push 0
cmova eax, dword [ebp - 0x12c]
push ecx
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0x160]
cmp ecx, 0xf
jbe 0x401b58
mov edx, dword [ebp - 0x174]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401b4e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401c81
push ecx
push edx
call fcn.004033e1
add esp, 8
mov ecx, dword [ebp - 0x148]
cmp ecx, 0xf
jbe 0x401b92
mov edx, dword [ebp - 0x15c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401b88
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401c81
push ecx
push edx
call fcn.004033e1
add esp, 8
mov ecx, dword [ebp - 0x118]
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0xf
mov byte [ebp - 0x15c], 0
cmp ecx, 0xf
jbe 0x401be7
mov edx, dword [ebp - 0x12c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401bdd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401c81
push ecx
push edx
call fcn.004033e1
add esp, 8
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
cmp ecx, 0xf
jbe 0x401c38
mov edx, dword [ebp - 0x144]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401c2e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401c81
push ecx
push edx
call fcn.004033e1
add esp, 8
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0xf
mov byte [ebp - 0x144], 0
cmp eax, 0xf
jbe 0x401c91
mov edx, dword [ebp - 0x18c]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x401c87
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401c87
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004033e1
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004033a3
mov esp, ebp
pop ebp
ret
call fcn.00401160
int3