Function at 0x4652b0
Capabilities:
Contain obfuscated stackstrings
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ec14
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x5584
call fcn.0050f9a0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
call fcn.004638f0
mov byte [ebp - 0x268], 0
mov byte [ebp - 0x268], 0
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push esi
push str.SOFTWAREABG_Ltd.Config
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x465328
push str._BranchName
lea edi, [ebp - 0x1c]
lea ebx, [ebp - 0x268]
call fcn.00463610
add esp, 4
call fcn.00464ad0
cmp dword [0x15797d4], 0
jle 0x4659f0
push 0
call dword [sym.imp.MSVCR100.dll__time64]
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0xd4]
push edx
call dword [sym.imp.MSVCR100.dll__localtime64_s]
mov edi, dword [ebp - 0xbc]
inc edi
lea eax, [ebp - 0x3c]
push eax
call fcn.00461d90
add esp, 0xc
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x94]
push ecx
call fcn.004ee870
add esp, 8
mov byte [ebp - 4], 3
lea esi, [ebp - 0x3c]
call fcn.004150b0
mov ebx, 0x10
cmp dword [ebp - 0x80], ebx
mov eax, dword [ebp - 0x94]
jae 0x4653a5
lea eax, [ebp - 0x94]
push edi
push eax
push str._sPrn_List__d.XMI
lea edx, [ebp - 0x1268]
call fcn.00465d00
add esp, 0xc
lea edx, [ebp - 0x3c]
push edx
call fcn.00461e90
add esp, 4
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.004ee870
add esp, 8
mov byte [ebp - 4], 6
lea esi, [ebp - 0x3c]
call fcn.004150b0
cmp dword [ebp - 0x64], ebx
mov eax, dword [ebp - 0x78]
jae 0x4653ee
lea eax, [ebp - 0x78]
push edi
push eax
push str._sPrn_List__d.XMI
lea edx, [ebp - 0x2268]
call fcn.00465d00
add esp, 0xc
lea ecx, [ebp - 0x2268]
push ecx
push 0x800
lea edx, [ebp - 0x3268]
push edx
mov esi, dword [sym.imp.MSVCR100.dll_strcpy_s]
call esi
add esp, 0xc
lea eax, [ebp - 0x3268]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x465430
sub eax, edx
push str..WRK
push 0x800
lea eax, [ebp + eax - 0x326c]
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x1268]
lea ecx, [ebp - 0x5c]
call fcn.0040f980
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x5c]
push ecx
call fcn.00442430
add esp, 4
mov bl, al
mov byte [ebp - 4], 6
lea esi, [ebp - 0x5c]
call fcn.004150e0
test bl, bl
je 0x465490
lea edx, [ebp - 0x1268]
push edx
call dword [sym.imp.MSVCR100.dll_remove]
add esp, 4
lea eax, [ebp - 0x1268]
push eax
call fcn.00440d60
add esp, 4
push 0x5345e0
lea ecx, [ebp - 0x1268]
push ecx
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.MSVCR100.dll_fopen_s]
add esp, 0xc
mov edi, eax
xor esi, esi
cmp edi, esi
jne 0x465a03
cmp dword [ebp - 0x14], esi
je 0x465a03
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x40], esi
mov edi, dword [sym.imp.MSVCR100.dll_strcat_s]
mov ebx, dword [sym.imp.MSVCR100.dll_fprintf]
nop
mov eax, dword [0x15797d4]
dec eax
cmp esi, eax
jg 0x465629
cmp dword [esi*4 + 0x576170], 0
je 0x465620
push str._NODE_
push 0x1f40
lea ecx, [ebp - 0x5590]
push ecx
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
mov eax, dword [esi*4 + 0x576170]
add eax, 0x400
push str.NAME
lea ecx, [ebp - 0x5590]
call fcn.004636d0
add esp, 4
mov eax, dword [esi*4 + 0x576170]
add eax, 0xc00
push str.PORT
lea ecx, [ebp - 0x5590]
call fcn.004636d0
add esp, 4
mov eax, dword [esi*4 + 0x576170]
add eax, 0x1400
push 0x539780
lea ecx, [ebp - 0x5590]
call fcn.004636d0
add esp, 4
mov eax, dword [esi*4 + 0x576170]
add eax, 0x800
push str.SHARE
lea ecx, [ebp - 0x5590]
call fcn.004636d0
add esp, 4
push 0x53978c
mov eax, dword [esi*4 + 0x576170]
lea ecx, [ebp - 0x5590]
call fcn.004636d0
add esp, 4
push str.UNIT
lea eax, [ebp - 0x268]
lea ecx, [ebp - 0x5590]
call fcn.004636d0
add esp, 4
mov edx, dword [esi*4 + 0x576170]
cmp byte [edx + 0x1520], 0
mov eax, 0x539798
jne 0x4655df
mov eax, 0x53979c
push 0x5397a0
lea ecx, [ebp - 0x5590]
call fcn.004636d0
add esp, 4
push str.__NODE_
push 0x1f40
lea eax, [ebp - 0x5590]
push eax
call edi
add esp, 0xc
lea ecx, [ebp - 0x5590]
push ecx
push 0x5397ac
mov edx, dword [ebp - 0x14]
push edx
call ebx
add esp, 0xc
inc dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x40], esi
jmp 0x4654e0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x1268]
push ecx
lea edx, [ebp - 0xb0]
push edx
call fcn.004efe70
add esp, 8
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x9c], 8
mov ecx, dword [ebp - 0xb0]
jae 0x46566c
lea ecx, [ebp - 0xb0]
call fcn.00443940
lea eax, [ebp - 0x3268]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.004efe70
mov byte [ebp - 4], 0x11
push eax
call fcn.0043f1c0
add esp, 0xc
mov byte [ebp - 4], 0x10
lea esi, [ebp - 0x3c]
call fcn.004150b0
push 0
lea edx, [ebp - 0x3268]
push edx
lea eax, [ebp - 0x1268]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x465838
lea ecx, [ebp - 0xcc]
push ecx
xor ecx, ecx
call fcn.004f0ed0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0x12
lea edx, [ebp - 0x3268]
push edx
lea eax, [ebp - 0x164]
push eax
call fcn.004efe70
mov edi, eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1268]
push ecx
lea edx, [ebp - 0x5c]
push edx
call fcn.004efe70
mov byte [ebp - 4], 0x14
push eax
lea eax, [ebp - 0x144]
push eax
mov edx, str.Failed_to_CopyFile_
call fcn.00413910
mov byte [ebp - 4], 0x15
push 0x52cafc
push eax
lea ecx, [ebp - 0xf0]
push ecx
call fcn.004139a0
add esp, 0x24
mov byte [ebp - 4], 0x16
lea edx, [ebp - 0x128]
push edx
mov edx, edi
mov ecx, eax
call fcn.00413a30
add esp, 4
mov byte [ebp - 4], 0x17
push 0x5397b0
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004139a0
add esp, 0xc
mov bl, 0x18
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3c]
push ecx
mov edx, esi
mov ecx, eax
call fcn.00413a30
add esp, 4
mov byte [ebp - 4], 0x19
push 0
push 0x20000000
push eax
push 0x330
push str.PrinterList::MakePrinterListXmi
call fcn.0044d970
add esp, 0x14
mov byte [ebp - 4], bl
lea esi, [ebp - 0x3c]
call fcn.004150b0
mov byte [ebp - 4], 0x17
lea esi, [ebp - 0x10c]
call fcn.004150b0
mov byte [ebp - 4], 0x16
lea esi, [ebp - 0x128]
call fcn.004150b0
mov byte [ebp - 4], 0x15
lea esi, [ebp - 0xf0]
call fcn.004150b0
mov byte [ebp - 4], 0x14
lea esi, [ebp - 0x144]
call fcn.004150b0
mov byte [ebp - 4], 0x13
lea esi, [ebp - 0x5c]
call fcn.004150b0
mov byte [ebp - 4], 0x12
lea esi, [ebp - 0x164]
call fcn.004150b0
mov byte [ebp - 4], 0x10
lea esi, [ebp - 0xcc]
call fcn.004150b0
mov byte [ebp - 4], 6
lea esi, [ebp - 0xb0]
call fcn.004150b0
mov byte [ebp - 4], 3
lea esi, [ebp - 0x78]
call fcn.004150e0
mov byte [ebp - 4], 0
lea esi, [ebp - 0x94]
call fcn.004150e0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x2268]
push edx
lea eax, [ebp - 0xcc]
push eax
call fcn.004efe70
mov byte [ebp - 4], 0x1a
push eax
call fcn.0043f1c0
add esp, 0xc
mov byte [ebp - 4], 0x10
lea esi, [ebp - 0xcc]
call fcn.004150b0
lea ecx, [ebp - 0x2268]
push ecx
lea edx, [ebp - 0x3268]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x4659c6
lea eax, [ebp - 0x5c]
push eax
xor ecx, ecx
call fcn.004f0ed0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x2268]
push ecx
lea edx, [ebp - 0x144]
push edx
call fcn.004efe70
mov edi, eax
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x3268]
push eax
lea ecx, [ebp - 0xf0]
push ecx
call fcn.004efe70
mov byte [ebp - 4], 0x1d
push eax
lea edx, [ebp - 0x128]
push edx
mov edx, str.Failed_to_MoveFileA_
call fcn.00413910
mov byte [ebp - 4], 0x1e
push 0x52cafc
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004139a0
add esp, 0x24
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x3c]
push ecx
mov edx, edi
mov ecx, eax
call fcn.00413a30
add esp, 4
mov byte [ebp - 4], 0x20
push str._._Err
push eax
lea edx, [ebp - 0x164]
push edx
call fcn.004139a0
add esp, 0xc
mov bl, 0x21
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xcc]
push ecx
mov edx, esi
mov ecx, eax
call fcn.00413a30
add esp, 4
mov byte [ebp - 4], 0x22
push 0
push 0x20000000
push eax
push 0x33a
push str.PrinterList::MakePrinterListXmi
call fcn.0044d970
add esp, 0x14
mov byte [ebp - 4], bl
lea esi, [ebp - 0xcc]
call fcn.004150b0
mov byte [ebp - 4], 0x20
lea esi, [ebp - 0x164]
call fcn.004150b0
mov byte [ebp - 4], 0x1f
lea esi, [ebp - 0x3c]
call fcn.004150b0
mov byte [ebp - 4], 0x1e
lea esi, [ebp - 0x10c]
call fcn.004150b0
mov byte [ebp - 4], 0x1d
lea esi, [ebp - 0x128]
call fcn.004150b0
mov byte [ebp - 4], 0x1c
lea esi, [ebp - 0xf0]
call fcn.004150b0
mov byte [ebp - 4], 0x1b
lea esi, [ebp - 0x144]
call fcn.004150b0
mov byte [ebp - 4], 0x10
lea esi, [ebp - 0x5c]
jmp 0x4657f6
mov byte [ebp - 4], 6
lea esi, [ebp - 0xb0]
call fcn.004150b0
mov byte [ebp - 4], 3
lea esi, [ebp - 0x78]
call fcn.004150e0
mov byte [ebp - 4], 0
lea esi, [ebp - 0x94]
call fcn.004150e0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x5c]
push edx
xor ecx, ecx
call fcn.004f0ed0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 8
push edi
lea eax, [ebp - 0x144]
push eax
call fcn.004ef520
mov edi, eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1268]
push ecx
lea edx, [ebp - 0xf0]
push edx
call fcn.004efe70
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x128]
push eax
mov edx, str.Failed_to_open
call fcn.00413910
mov byte [ebp - 4], 0xb
push str._for_write._rc
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.004139a0
add esp, 0x24
mov byte [ebp - 4], 0xc
lea edx, [ebp - 0x3c]
push edx
mov edx, edi
mov ecx, eax
call fcn.00413a30
add esp, 4
mov byte [ebp - 4], 0xd
push 0x535120
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.004139a0
add esp, 0xc
mov bl, 0xe
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xcc]
push ecx
mov edx, esi
mov ecx, eax
call fcn.00413a30
add esp, 4
mov byte [ebp - 4], 0xf
push 0
push 0x20000000
push eax
push 0x308
push str.PrinterList::MakePrinterListXmi
call fcn.0044d970
add esp, 0x14
mov byte [ebp - 4], bl
lea esi, [ebp - 0xcc]
call fcn.004150b0
mov byte [ebp - 4], 0xd
lea esi, [ebp - 0x164]
call fcn.004150b0
mov byte [ebp - 4], 0xc
lea esi, [ebp - 0x3c]
call fcn.004150b0
mov byte [ebp - 4], 0xb
lea esi, [ebp - 0x10c]
call fcn.004150b0
mov byte [ebp - 4], 0xa
lea esi, [ebp - 0x128]
call fcn.004150b0
mov byte [ebp - 4], 9
lea esi, [ebp - 0xf0]
call fcn.004150b0
mov byte [ebp - 4], 8
lea esi, [ebp - 0x144]
call fcn.004150b0
mov byte [ebp - 4], 6
lea esi, [ebp - 0x5c]
jmp 0x465805