Function at 0x401a90
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x134c
call fcn.0040e380
mov eax, dword [0x4432d4]
push ebx
push esi
mov ebx, ecx
push edi
lea esi, [ebx + 8]
push str.__________________________________Start_AddMonitor______
mov ecx, esi
mov dword [esp + 0x1358], eax
call fcn.004012b0
xor eax, eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
lea ecx, [esp + 0x10]
push ecx
mov word [esp + 0x39], ax
lea edx, [esp + 0x18]
push edx
push 0x1000
mov byte [esp + 0x43], al
lea eax, [esp + 0x35c]
push eax
xor edi, edi
push 1
push edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov byte [esp + 0x40], 0
call sub.WINSPOOL.DRV_EnumMonitorsA
test eax, eax
je 0x401e4a
cmp dword [esp + 0x10], edi
jle 0x401b37
mov ecx, dword [esp + edi*4 + 0x350]
push str.Hancom_PDF_Port_Monitor
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x401cde
mov eax, dword [esp + 0x10]
inc edi
cmp edi, eax
jl 0x401b13
push 0x434b54
mov ecx, esi
call fcn.004012b0
xor eax, eax
mov byte [esp + 0x38], 0
mov ecx, 0x40
lea edi, [esp + 0x39]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [esp + 0x140], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [ebx + 0x140]
push str.Windows_x64
push edi
call fcn.0040dc17
add esp, 8
test eax, eax
jne 0x401d0b
mov edx, dword [ebx]
push str.HNCE2PPRMON80.dll
push edx
lea eax, [esp + 0x148]
push str._sx64_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [str.Windows_x64]
mov eax, dword [0x4348c8]
mov edx, dword [0x4348c4]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x40], eax
add esp, 0x10
xor eax, eax
mov byte [esp + 0x248], 0
mov ecx, 0x41
lea edi, [esp + 0x249]
rep stosd dword es:[edi], eax
push 0x104
lea ecx, [esp + 0x24c]
push ecx
mov dword [esp + 0x34], edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + 0x248]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401c00
mov edx, dword [str.Kernel32.dll]
mov eax, dword [0x4348f4]
mov ecx, dword [0x4348f8]
mov dword [edi], edx
mov dx, word [0x4348fc]
mov dword [edi + 4], eax
lea eax, [esp + 0x248]
mov dword [edi + 8], ecx
push eax
mov word [edi + 0xc], dx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x401dda
push str.Wow64DisableWow64FsRedirection
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401cc2
lea ecx, [esp + 0x18]
push ecx
call eax
push 0x104
lea edx, [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x434b10
lea eax, [esp + 0x3c]
push eax
call edi
push str.HNCE2PPRMON80.dll
lea ecx, [esp + 0x3c]
push ecx
call edi
lea edx, [esp + 0x38]
push edx
mov ecx, esi
call fcn.004012b0
push 0
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x148]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x401dc4
push str.Wow64RevertWow64FsRedirection
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x401cff
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [esp + 0x1354]
call fcn.0040da9f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x434ad0
mov ecx, esi
call fcn.004012b0
xor eax, eax
mov ecx, dword [esp + 0x1354]
call fcn.0040da9f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x18]
push edx
call eax
jmp 0x401dda
push str.Windows_NT_x86
push edi
call fcn.0040dc17
add esp, 8
test eax, eax
jne 0x401dce
mov eax, dword [ebx]
push str.HNCE2PPRMON80.dll
push eax
lea ecx, [esp + 0x148]
push str._sx86_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x4348d4]
mov edx, dword [str.Windows_NT_x86]
mov eax, dword [0x4348d0]
add esp, 0x10
mov dword [esp + 0x30], ecx
mov dword [esp + 0x28], edx
mov dx, word [0x4348d8]
mov dword [esp + 0x2c], eax
mov al, byte [0x4348da]
push 0x104
lea ecx, [esp + 0x3c]
push ecx
mov word [esp + 0x3c], dx
mov byte [esp + 0x3e], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x434b10
lea edx, [esp + 0x3c]
push edx
call edi
push str.HNCE2PPRMON80.dll
lea eax, [esp + 0x3c]
push eax
call edi
lea ecx, [esp + 0x38]
push ecx
mov ecx, esi
call fcn.004012b0
push 0
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x401dda
push 0x434aa8
jmp 0x401e4f
push 0x434a7c
mov ecx, esi
call fcn.004012b0
lea ecx, [esp + 0x140]
push ecx
mov ecx, esi
call fcn.004012b0
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call fcn.004012b0
lea ecx, [esp + 0x1c]
push ecx
push 2
lea eax, [esp + 0x30]
push 0
mov dword [esp + 0x28], str.Hancom_PDF_Port_Monitor
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], str.HNCE2PPRMON80.dll
call sub.WINSPOOL.DRV_AddMonitorA
test eax, eax
jne 0x401e26
push 0x434a60
jmp 0x401e4f
push str.__________________________________End___AddMonitor______
mov ecx, esi
call fcn.004012b0
mov eax, 1
mov ecx, dword [esp + 0x1354]
call fcn.0040da9f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x434a38
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
push eax
call fcn.004012d0
mov ecx, dword [esp + 0x1354]
xor eax, eax
call fcn.0040da9f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret