Function at 0x426934
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00426934
xor esi, esi
xor edi, edi
mov ecx, 0x151
push esi
dec ecx
jne 0x426950
push 0
push 0
push 0
push 0
mov eax, 2
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
lea ebx, [ebp - 0x9c]
push ebx
mov edx, 0x1860fc4
call fcn.0045b687
lea ebx, [esp + 0x10]
push ebx
call fcn.0045a876
mov edx, 0x1860f98
call fcn.0045b687
lea ebx, [esp + 0x10]
push ebx
call fcn.0045a876
fild qword [0x186adc4]
call fcn.0045a86f
lea ebx, [esp + 0x10]
push ebx
mov dword [ebx], eax
call fcn.00431242
push eax
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00456355
mov eax, dword [ebx + 8]
call fcn.00456355
pop eax
add esp, 0x10
mov edx, dword [ebp - 0x9c]
call fcn.0045b670
xor eax, eax
call fcn.00451592
lea ebx, [ebp - 0x9c]
call fcn.0045a876
mov edx, 0x1860fd4
call fcn.0045b687
mov edx, 0x1860fe4
call fcn.0045b687
lea ebx, [ebp - 0x9c]
push ebx
mov edx, dword [ebx]
call fcn.0045b670
call fcn.00459109
pop ebx
call fcn.0045a876
mov edx, 0x1860ff4
call fcn.0045b687
mov edx, dword [ebp - 0x9c]
call fcn.0045b670
call fcn.0045ab3a
push 0
mov ebx, esp
call fcn.0045a876
call fcn.00417148
fild dword [0x186b404]
mov eax, dword [0x45dedc]
call fcn.0045a848
fcompp
fnstsw ax
sahf
jne 0x426afd
lea ebx, [ebp - 0xa0]
mov dword [ebx], esi
push ebx
call dword [sym.imp.KERNEL32.DLL_Wow64DisableWow64FsRedirection]
mov esi, dword [ebp - 0xa0]
fldcw word [ebp - 0x10]
push 0
push 0
push 0
mov eax, 4
call fcn.004588d6
mov edx, 0x1860dc4
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [esp + 8]
call fcn.0045a938
mov edx, dword [ebp - 0x9c]
call fcn.0045b670
mov eax, 4
call fcn.0045ac7a
mov edx, 0x1860dc4
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [esp + 8]
call fcn.0045a938
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00456355
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 8
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0xa0]
mov dword [ebx], esi
push ebx
call dword [sym.imp.KERNEL32.DLL_Wow64RevertWow64FsRedirection]
mov esi, dword [ebp - 0xa0]
fldcw word [ebp - 0x10]
jmp 0x426da6
push 0
mov edx, 0x186100c
call fcn.0045b687
lea ebx, [esp]
call fcn.0045a938
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [ebp - 0xa8], eax
fild dword [0x186b388]
mov eax, dword [ebp - 0xa8]
call fcn.0045a848
fcompp
fnstsw ax
sahf
jne 0x426b4d
jmp 0x426da6
push 0
mov edx, 0x1861020
call fcn.0045b687
lea ebx, [esp]
call fcn.0045a938
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [ebp - 0xac], eax
fild dword [0x186b388]
mov eax, dword [ebp - 0xac]
call fcn.0045a848
fcompp
fnstsw ax
sahf
jne 0x426bb6
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
fldcw word [ebp - 0x10]
jmp 0x426da6
push 0
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
mov edx, dword [ebp - 0x9c]
call fcn.0045b670
mov edx, 0x185e9a0
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [esp + 0x18]
call fcn.0045a938
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov edi, eax
fild qword [0x186aa78]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
je 0x426d7f
fild dword [0x186b424]
fimul dword [0x186ab24]
call fcn.0045a86f
mov dword [ebp - 0xb4], eax
push 0
push dword [ebp - 0xb4]
lea ebx, [ebp - 0x5c8]
push ebx
mov eax, edi
push eax
call dword [ebp - 0xac]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
test eax, eax
je 0x426d73
mov eax, dword [ebp - 0xb4]
call fcn.0045a848
mov eax, dword [ebp - 0xb0]
call fcn.0045a848
fcompp
fnstsw ax
sahf
jae 0x426d73
lea ebx, [ebp - 0x5c8]
call fcn.0045b45a
mov eax, 4
call fcn.0045ac7a
lea ebx, [ebp - 0x5c8]
mov ecx, 0x514
call fcn.0045b4a3
lea ebx, [ebp - 0x5c8]
call fcn.0045b45a
mov eax, 1
mov ecx, 4
xchg ecx, eax
call fcn.004527ff
mov edx, 0x1861040
call fcn.0045b687
call fcn.0045abcf
jne 0x426d04
lea ebx, [ebp - 0x5c8]
call fcn.0045b45a
mov ecx, 5
mov eax, 0x7fffffff
call fcn.004527ff
lea ebx, [ebp - 0x5c8]
mov ecx, 0x514
call fcn.0045b4a3
lea ebx, [ebp - 0x5c8]
call fcn.0045b45a
mov edx, 0x1860dc4
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [ebp - 0x5c8]
mov ecx, 0x514
call fcn.0045b4a3
push 0
push 0
mov eax, 4
call fcn.004588d6
mov edx, 0x1860dc4
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [esp + 4]
call fcn.0045a938
lea ebx, [ebp - 0x5c8]
push ebx
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0xa0]
mov dword [ebx], esi
push ebx
call dword [sym.imp.KERNEL32.DLL_Wow64RevertWow64FsRedirection]
mov esi, dword [ebp - 0xa0]
fldcw word [ebp - 0x10]
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
fldcw word [ebp - 0x10]
call fcn.0045b4f9
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret