Function at 0x4386b0
Capabilities:
Accept command line arguments
Copy file

Disassembly:
push 0x10c
mov eax, 0x4ca2e3
call fcn.0044d7c5
or dword [ebp - 0xf0], 0xffffffff
xor ebx, ebx
inc ebx
mov dword [ebp - 0xc8], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0xf0]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
cmp dword [ebp - 0xf0], ebx
jle 0x438b7c
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xcc], esp
push str._backuppdb
call fcn.00417e81
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd4], esp
push dword [esi + 4]
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00417e81
or dword [ebp - 4], 0xffffffff
call fcn.0042eb69
add esp, 0x3c
cmp eax, edi
je 0x438b0c
lea ecx, [ebp - 0x118]
call fcn.00410878
push ecx
mov ecx, esp
mov dword [ebp - 0xd0], esp
mov esi, str.Hao123Downloader.exe
push esi
mov dword [ebp - 4], ebx
call fcn.0041217e
push ecx
mov eax, esp
mov dword [ebp - 0xcc], esp
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 2
call fcn.00420283
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], bl
call fcn.00418668
push ecx
mov ecx, esp
mov dword [ebp - 0xd0], esp
mov ebx, str.Hao123Downloader.pdb
push ebx
mov byte [ebp - 4], 3
call fcn.0041217e
push ecx
mov eax, esp
mov dword [ebp - 0xcc], esp
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 4
call fcn.00420283
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 3
call fcn.00418668
push edi
push 0x20
push 3
push edi
push edi
push SysReAllocString
push dword [ebp - 0xe4]
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc8], eax
cmp eax, 0xffffffff
je 0x438acf
mov dword [ebp - 0x100], edi
xor eax, eax
lea edi, [ebp - 0xfc]
stosd dword es:[edi], eax
lea eax, [ebp - 0x100]
push eax
xor edi, edi
push edi
push edi
push dword [ebp - 0xc8]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push dword [ebp - 0xc8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0xec]
call fcn.00423a87
push 0x502868
lea ecx, [ebp - 0xc8]
call fcn.0040fd3c
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 6
call fcn.00423afa
cmp eax, edi
je 0x43886c
mov eax, dword [eax]
mov dword [ebp - 0xdc], eax
jmp 0x438873
or dword [ebp - 0xdc], 0xffffffff
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0xec]
call fcn.00423afa
cmp eax, edi
je 0x438894
mov eax, dword [eax + 4]
mov dword [ebp - 0xd4], eax
jmp 0x43889b
or dword [ebp - 0xd4], 0xffffffff
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0xec]
call fcn.00423afa
cmp eax, edi
je 0x4388bc
mov eax, dword [eax + 8]
mov dword [ebp - 0xcc], eax
jmp 0x4388c3
or dword [ebp - 0xcc], 0xffffffff
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xec]
call fcn.00423afa
cmp eax, edi
je 0x4388d9
mov edi, dword [eax + 0xc]
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0xec]
call fcn.00423afa
test eax, eax
je 0x4388f2
mov eax, dword [eax + 0x10]
inc eax
jmp 0x4388f4
xor eax, eax
push dword [ebp - 0xdc]
lea ecx, [ebp - 0xec]
push dword [ebp - 0xd4]
push dword [ebp - 0xcc]
push edi
push eax
call fcn.00423b4f
push eax
lea eax, [ebp - 0xc8]
push str._04d__02d__02d__02d_02d_02d
push eax
call fcn.0041182d
push 0
lea edi, [ebp - 0xcc]
call fcn.0042a11d
mov eax, edi
push eax
lea eax, [ebp - 0xdc]
push str.pdbbackupHao123Downloader_
push eax
mov byte [ebp - 4], 7
call fcn.00429e17
push 0x4d159c
push eax
lea eax, [ebp - 0xd4]
push eax
mov byte [ebp - 4], 8
call fcn.004114f0
add esp, 0x38
mov ecx, esp
mov dword [ebp - 0xd0], esp
lea edx, [ebp - 0xc8]
push edx
push eax
push ecx
mov byte [ebp - 4], 9
call fcn.0041ef94
add esp, 8
mov eax, esp
mov dword [ebp - 0xe0], esp
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0xa
call fcn.00420283
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 9
call fcn.00418668
mov ecx, dword [ebp - 0xd4]
add ecx, 0xfffffff0
call fcn.0040f083
mov ecx, dword [ebp - 0xdc]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xd
call fcn.0040f083
lea eax, [ebp - 0xd8]
push eax
call fcn.0042a26a
pop ecx
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0xe0], esp
push esi
call fcn.0041217e
mov eax, dword [ebp - 0xd8]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0xf4], esp
mov esi, esp
mov byte [ebp - 4], 0xe
push eax
call fcn.0040f61d
add eax, 0x10
mov dword [esi], eax
pop ecx
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0xd
call fcn.00418668
push dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push dword [ebp - 0xe4]
call esi
mov ecx, dword [ebp - 0xd0]
add ecx, 0xfffffff0
call fcn.0040f083
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0xf4], esp
push ebx
call fcn.0041217e
mov eax, dword [ebp - 0xd8]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0xe0], esp
mov edi, esp
push eax
mov byte [ebp - 4], 0xf
call fcn.0040f61d
add eax, 0x10
mov dword [edi], eax
pop ecx
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0xd
call fcn.00418668
push dword [eax]
push dword [ebp - 0xf8]
call esi
mov ecx, dword [ebp - 0xd0]
add ecx, 0xfffffff0
call fcn.0040f083
mov ecx, dword [ebp - 0xd8]
add ecx, 0xfffffff0
call fcn.0040f083
mov ecx, dword [ebp - 0xcc]
add ecx, 0xfffffff0
call fcn.0040f083
mov ecx, dword [ebp - 0xc8]
add ecx, 0xfffffff0
call fcn.0040f083
xor edi, edi
mov ecx, dword [ebp - 0xf8]
add ecx, 0xfffffff0
mov dword [ebp - 0xc8], edi
call fcn.0040f083
mov ecx, dword [ebp - 0xe4]
add ecx, 0xfffffff0
call fcn.0040f083
lea ecx, [ebp - 0x118]
call fcn.00410276
mov ecx, dword [ebp - 0x108]
add ecx, 0xfffffff0
call fcn.0040f083
jmp 0x438b7c
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xf4], esp
push str._postdata
call fcn.00417e81
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xe0], esp
push dword [esi + 4]
mov dword [ebp - 4], 0x10
call fcn.00417e81
or dword [ebp - 4], 0xffffffff
call fcn.0042eb69
add esp, 0x3c
cmp eax, edi
je 0x438b7c
call fcn.00435d04
push str.hao123downloader_post_data_finish
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
cmp esi, edi
je 0x438b76
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc8], edi
mov eax, dword [ebp - 0xc8]
call fcn.0044d848
ret