Function at 0x4323e0
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x4d80cf
mov eax, dword fs:[0]
push eax
mov eax, 0x1158
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x1154], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5808f0]
xor eax, esp
push eax
lea eax, [esp + 0x116c]
mov dword fs:[0], eax
xor esi, esi
xor eax, eax
mov edi, ecx
mov dword [esp + 0x64], 7
mov dword [esp + 0x60], esi
mov word [esp + 0x50], ax
lea ecx, [esp + 0x18]
mov dword [esp + 0x1174], esi
call fcn.00431f10
push 1
mov byte [esp + 0x1178], 1
call fcn.004198f0
mov ecx, dword [edi + 0x50]
push ecx
push esi
call fcn.00419930
push esi
call fcn.00419910
add esp, 0x10
cmp dword [edi + 0x50], esi
jbe 0x432647
mov ebp, 1
mov ebx, 0x56d238
jmp 0x432480
lea edx, [ebp - 1]
push edx
call fcn.00419910
add esp, 4
cmp dword [edi + 0x1c], 8
jb 0x432497
mov ecx, dword [edi + 8]
jmp 0x43249a
lea ecx, [edi + 8]
mov esi, dword [ebx]
mov eax, dword [esi + 0x10]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4324c6
test dx, dx
je 0x4324c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4324c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4324a0
xor eax, eax
jmp 0x4324cb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x432635
mov dword [edi + 0x5c], esi
lea esi, [edi + 0x34]
mov dword [edi + 0x54], ebp
cmp dword [esi + 0x18], 8
jb 0x4324e7
mov eax, dword [esi + 4]
jmp 0x4324ea
lea eax, [esi + 4]
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0x18]
mov ecx, edi
call eax
test al, al
je 0x432635
push ebp
push str._k_04d
lea ecx, [esp + 0x70]
push 0x3f
push ecx
call fcn.0046a2b8
add esp, 0x10
push 0xffffffffffffffff
push 0
push esi
lea ecx, [esp + 0x58]
call fcn.0041c410
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x34]
push esi
push eax
call fcn.0042cd00
add esp, 0xc
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x1180], 2
call fcn.0041c410
mov ecx, 8
mov byte [esp + 0x1174], 1
cmp dword [esp + 0x48], ecx
jb 0x43256d
mov ecx, dword [esp + 0x34]
push ecx
call fcn.004699ce
add esp, 4
mov ecx, 8
mov eax, dword [esp + 0x50]
cmp dword [esp + 0x64], ecx
jae 0x43257b
lea eax, [esp + 0x50]
cmp dword [esi + 0x18], ecx
jb 0x432585
mov esi, dword [esi + 4]
jmp 0x432588
add esi, 4
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x432635
push 0x24
call fcn.00469e21
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x1174], 3
test eax, eax
je 0x4325cf
cmp dword [esp + 0x64], 8
mov ecx, dword [esp + 0x50]
jae 0x4325c3
lea ecx, [esp + 0x50]
push ecx
mov ecx, eax
call fcn.00424dc0
mov esi, eax
jmp 0x4325d1
xor esi, esi
cmp dword [esp + 0x64], 8
mov eax, dword [esp + 0x50]
mov byte [esp + 0x1174], 1
jae 0x4325e8
lea eax, [esp + 0x50]
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0x1c]
push esi
mov ecx, edi
call eax
test esi, esi
je 0x432607
mov ecx, esi
call fcn.00424ce0
push esi
call fcn.004699ce
add esp, 4
cmp dword [esp + 0x64], 8
mov eax, dword [esp + 0x50]
jae 0x432616
lea eax, [esp + 0x50]
push eax
call fcn.004258e0
add esp, 4
test eax, eax
jl 0x432635
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebp
call fcn.0044b870
inc ebp
lea edx, [ebp - 1]
add ebx, 4
cmp edx, dword [edi + 0x50]
jb 0x432480
xor esi, esi
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x24]
test eax, 0xfffffffc
jne 0x432685
mov eax, 0x4ec7f8
cmp dword [0x584064], esi
jne 0x432668
mov eax, 0x4ec6d8
push eax
lea ecx, [esp + 0x16c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
mov dword [0x594aac], esi
jmp 0x43272b
mov eax, 0x4ec690
cmp dword [0x584064], esi
jne 0x432697
mov eax, str.Possible_decryption_key_found:_n
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push eax
lea edx, [esp + 0x16c]
push edx
call edi
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov eax, edx
sub eax, ecx
sar eax, 2
add esp, 8
test eax, eax
jbe 0x43270f
cmp esi, eax
jb 0x4326cb
call fcn.00469df6
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx + esi*4]
push eax
lea ecx, [esp + 0xec]
push 0x4ec648
push ecx
call edi
lea edx, [esp + 0xf4]
push edx
lea eax, [esp + 0x178]
push 0x800
push eax
call fcn.004696da
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov eax, edx
sub eax, ecx
inc esi
sar eax, 2
add esp, 0x18
cmp esi, eax
jb 0x4326cb
sub edx, ecx
sar edx, 2
test edx, edx
ja 0x432721
call fcn.00469df6
mov ecx, dword [esp + 0x24]
mov ecx, dword [ecx]
mov dword [0x594aac], ecx
xor esi, esi
mov eax, dword [0x584068]
push 0x40
push 0x4e01e0
lea edx, [esp + 0x170]
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [esp + 0x24]
cmp eax, esi
je 0x432757
push eax
call fcn.004699ce
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call fcn.004699ce
add esp, 4
cmp dword [esp + 0x64], 8
jb 0x432784
mov edx, dword [esp + 0x50]
push edx
call fcn.004699ce
add esp, 4
mov ecx, dword [esp + 0x116c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1154]
xor ecx, esp
call fcn.004690b5
add esp, 0x1164
ret