Function at 0x4bb3c0
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, 0x4d9294
xor eax, eax
push ebp
push 0x4bb8cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
mov eax, dword [0x4d5b0c]
cmp byte [eax], 0
jne 0x4bb8a7
mov eax, dword [0x4d5b0c]
mov byte [eax], 1
push 0x80
mov eax, dword [0x4d5f14]
push dword [eax]
mov eax, dword [0x4d588c]
push dword [eax]
push 0x4bb8e8
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404620
mov eax, dword [ebp - 0x14]
call fcn.00404760
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [0x4d5f14]
push dword [eax]
mov eax, dword [0x4d588c]
push dword [eax]
push 0x4bb8e8
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404620
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x4383ec]
call fcn.0043849c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4bb82e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4bb8f8
lea eax, [ebp - 8]
push eax
mov ecx, 0x4bb908
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx]
mov ecx, 0x4bb908
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
call fcn.00438abc
test al, al
je 0x4bb4ac
mov eax, dword [ebp - 8]
mov edx, dword [esi]
call fcn.004046ac
je 0x4bb4c1
mov eax, dword [esi]
push eax
mov ecx, 0x4bb908
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 4]
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4bb920
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx]
mov ecx, 0x4bb920
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
call fcn.00438abc
test al, al
je 0x4bb4fb
mov eax, dword [ebp - 8]
mov edx, dword [esi + 4]
call fcn.004046ac
je 0x4bb511
mov eax, dword [esi + 4]
push eax
mov ecx, 0x4bb920
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 4]
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4bb92c
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx]
mov ecx, 0x4bb92c
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
call fcn.00438abc
test al, al
je 0x4bb54b
mov eax, dword [ebp - 8]
mov edx, dword [esi + 0x18]
call fcn.004046ac
je 0x4bb561
mov eax, dword [esi + 0x18]
push eax
mov ecx, 0x4bb92c
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 4]
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4bb938
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx]
mov ecx, 0x4bb938
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
call fcn.00438abc
test al, al
je 0x4bb59b
mov eax, dword [ebp - 8]
mov edx, dword [esi + 0x10]
call fcn.004046ac
je 0x4bb5b1
mov eax, dword [esi + 0x10]
push eax
mov ecx, 0x4bb938
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 4]
push 0
mov ecx, 0x4bb944
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov ebx, eax
mov ecx, 0x4bb944
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
call fcn.00438abc
test al, al
je 0x4bb5e2
cmp bl, byte [esi + 9]
je 0x4bb5f8
mov al, byte [esi + 9]
push eax
mov ecx, 0x4bb944
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
mov ecx, 0x4bb950
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov ebx, eax
mov ecx, 0x4bb950
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
call fcn.00438abc
test al, al
je 0x4bb629
cmp bl, byte [esi + 0xa]
je 0x4bb63f
mov al, byte [esi + 0xa]
push eax
mov ecx, 0x4bb950
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
mov ecx, 0x4bb95c
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov ebx, eax
mov ecx, 0x4bb95c
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
call fcn.00438abc
test al, al
je 0x4bb670
cmp bl, byte [esi + 0xb]
je 0x4bb686
mov al, byte [esi + 0xb]
push eax
mov ecx, 0x4bb95c
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0x4bb968
lea eax, [ebp - 8]
push eax
mov ecx, 0x4bb988
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx]
mov ecx, 0x4bb988
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
call fcn.00438abc
test al, al
je 0x4bb6c3
mov eax, dword [ebp - 8]
mov edx, dword [esi + 0x24]
call fcn.004046ac
je 0x4bb6d9
mov eax, dword [esi + 0x24]
push eax
mov ecx, 0x4bb988
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 4]
push 0x1f90
mov ecx, 0x4bb994
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov ebx, eax
mov ecx, 0x4bb994
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
call fcn.00438abc
test al, al
je 0x4bb70d
cmp ebx, dword [esi + 0x28]
je 0x4bb723
mov eax, dword [esi + 0x28]
push eax
mov ecx, 0x4bb994
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x4bb9a0
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov ebx, eax
mov ecx, 0x4bb9a0
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
call fcn.00438abc
test al, al
je 0x4bb754
cmp bl, byte [esi + 8]
je 0x4bb76a
mov al, byte [esi + 8]
push eax
mov ecx, 0x4bb9a0
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4bb9ac
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx]
lea edx, [ebp - 0xc]
mov eax, dword [0x4d6070]
mov eax, dword [eax]
call fcn.004b2f44
mov ecx, 0x4bb9ac
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
call fcn.00438abc
test al, al
je 0x4bb7b3
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004046ac
je 0x4bb7c9
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x4bb9ac
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 4]
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4bb9b8
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx]
lea edx, [ebp - 0xc]
mov eax, dword [esi + 0x14]
call fcn.004b7eb0
mov ecx, 0x4bb9b8
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
call fcn.00438abc
test al, al
je 0x4bb80e
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004046ac
je 0x4bb824
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x4bb9b8
mov edx, 0x4bb914
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bb838
cmp dword [ebp - 0x10], 0
je 0x4bb846
mov eax, dword [ebp - 0x10]
call fcn.00403440
push 0
mov eax, dword [0x4d5f14]
push dword [eax]
mov eax, dword [0x4d588c]
push dword [eax]
push 0x4bb9c4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404620
mov eax, dword [ebp - 0x1c]
call fcn.00404760
push eax
mov eax, dword [0x4d5f14]
push dword [eax]
mov eax, dword [0x4d588c]
push dword [eax]
push 0x4bb8e8
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404620
mov eax, dword [ebp - 0x20]
call fcn.00404760
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [0x4d5b0c]
mov byte [eax], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb8d6
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004042b4
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004042b4
ret