Function at 0x65cddc0
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Get file size
Move file
Query environment variable
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x30a2c
call fcn.065baa60
mov eax, dword [0x65e4e2c]
xor eax, esp
mov dword [esp + 0x30a28], eax
push ebx
push esi
push edi
call fcn.065cc6b0
test al, al
jne 0x65cde0f
push 0
push str.SymCorpUIMainWindowClass
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x65cde0f
mov dword [0x65e8984], 0xf
push 0x65d9268
jmp 0x65ce96f
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x22]
push ecx
mov word [esp + 0x24], ax
call fcn.065b84a0
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x432]
push eax
mov word [esp + 0x434], dx
call fcn.065b84a0
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x22a]
push edx
mov word [esp + 0x22c], cx
call fcn.065b84a0
add esp, 0xc
push 0x104
push 0x65e7f58
push str.windir
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x65ce960
cmp eax, 0x104
jge 0x65ce960
cmp word [0x65e8570], 0x5c
jne 0x65cdefb
cmp word [0x65e8574], 0x3f
je 0x65cdefb
push 8
lea eax, [esp + 0x1c]
push str._UNC
push eax
call fcn.065b79e9
add esp, 0xc
push 0x65e8572
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.065b767c
add esp, 0xc
push 1
push 0x65d8dc0
push 0x65e8570
call fcn.065b79e9
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push 0x104
push 0x65e8570
call fcn.065b767c
add esp, 0xc
push 0x65e8570
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x65cdf1f
mov dword [0x65e8984], 0xb
push str.The_selected_Sylink_file_does_not_exist.
jmp 0x65ce96f
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
push 0x65e8570
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x65cdf57
mov dword [0x65e8984], 0xa
push str.Could_not_open_the_selected_Sylink_file.
jmp 0x65ce96f
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffff
jbe 0x65cdfa4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, str.The_selected_Sylink_file_is_to_large.
mov eax, 9
call fcn.065cc2f0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30a28]
xor ecx, esp
call fcn.065b6645
mov esp, ebp
pop ebp
ret
push 0
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0xa3c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x65ce933
xor eax, eax
test esi, esi
jle 0x65cdfe6
lea ebx, [ebx]
movsx dx, byte [esp + eax + 0xa30]
mov word [esp + eax*2 + 0x10a30], dx
inc eax
cmp eax, esi
jl 0x65cdfd0
xor eax, eax
push edi
mov word [esp + esi*2 + 0x10a34], ax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10a30]
xor bl, bl
push ecx
mov byte [esp + 0x17], bl
call fcn.065b7c0f
add esp, 4
push str._serversettings
push eax
call fcn.065b7754
lea edx, [esp + 0x10a38]
sub edx, eax
add esp, 8
test edx, 0xfffffffe
jg 0x65ce02e
mov bl, 1
lea eax, [esp + 0x10a30]
push eax
call fcn.065b7c0f
add esp, 4
push str.__serversettings_
push eax
call fcn.065b7754
lea ecx, [esp + 0x10a38]
sub ecx, eax
add esp, 8
mov al, 1
test ecx, 0xfffffffe
jle 0x65ce063
mov al, byte [esp + 0x13]
test bl, bl
je 0x65ce922
test al, al
je 0x65ce922
mov edi, str.ImagePath
mov esi, str.SYSTEMCurrentControlSetServicesSmcService
call fcn.065cc070
push eax
lea edx, [esp + 0x1c]
push 0x104
push edx
call fcn.065b76f1
add esp, 0xc
lea eax, [esp + 0x18]
call fcn.06572540
cmp eax, 2
jbe 0x65ce11f
lea eax, [esp + 0x18]
push 0x65d90e4
push eax
call fcn.065b7754
mov esi, eax
lea ecx, [esp + 0x20]
sub ecx, esi
add esp, 8
test ecx, 0xfffffffe
jne 0x65ce0e5
mov eax, 0x65d90e4
call fcn.06572540
lea edx, [esi + eax*2]
push edx
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.065b76f1
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
call fcn.065b7c0f
add esp, 4
push str.smc.exe
push eax
call fcn.065b7754
lea edx, [esp + 0x20]
push edx
sub eax, edx
sar eax, 1
xor ecx, ecx
push 0x104
push 0x65e8160
mov word [esp + eax*2 + 0x2c], cx
call fcn.065b76f1
add esp, 0x14
mov eax, 0x65e8160
call fcn.06572540
cmp eax, 3
jae 0x65ce150
mov edi, str.smc_install_path
mov esi, str.SOFTWARESymantecSymantec_Endpoint_ProtectionSMC
call fcn.065cc070
push eax
push 0x104
push 0x65e8160
call fcn.065b76f1
add esp, 0xc
mov eax, 0x65e8160
call fcn.06572540
cmp eax, 3
jae 0x65ce181
mov edi, str.smc_install_path
mov esi, str.SOFTWARESygate_Technologies__Inc.Sygate_Personal_Firewall
call fcn.065cc070
push eax
push 0x104
push 0x65e8160
call fcn.065b76f1
add esp, 0xc
mov eax, 0x65e8160
call fcn.06572540
cmp eax, 3
jae 0x65ce1b6
mov ecx, str.The_Symantec_client_is_not_installed_on_this_system.
mov eax, 7
call fcn.065cc2f0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30a28]
xor ecx, esp
call fcn.065b6645
mov esp, ebp
pop ebp
ret
call fcn.065cc6b0
test al, al
je 0x65ce337
call fcn.065cd170
test al, al
jne 0x65ce200
push 1
call fcn.065cd220
add esp, 4
test al, al
jne 0x65ce200
mov ecx, str.Could_not_restart_the_Symantec_client.
mov eax, 4
call fcn.065cc2f0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30a28]
xor ecx, esp
call fcn.065b6645
mov esp, ebp
pop ebp
ret
push 2
lea eax, [esp + 0x1c]
push 0x65d90e4
push eax
call fcn.065b79e9
add esp, 0xc
push 0x65e8160
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.065b767c
add esp, 0xc
push 0x65d90e8
lea edx, [esp + 0x1c]
push 0x104
push edx
call fcn.065b767c
add esp, 0xc
cmp byte [0x65e7f54], 0
je 0x65ce290
push str.__p__
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.065b767c
add esp, 0xc
push 0x65e8368
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.065b767c
add esp, 0xc
push 0x65d90e4
lea edx, [esp + 0x1c]
push 0x104
push edx
call fcn.065b767c
add esp, 0xc
push str.__importSylink__
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.065b767c
add esp, 0xc
push 0x65e8570
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.065b767c
add esp, 0xc
push 0x65d90e4
lea edx, [esp + 0x1c]
push 0x104
push edx
call fcn.065b767c
lea eax, [esp + 0x24]
add esp, 0xc
push eax
call fcn.065cc1c0
add esp, 4
test eax, eax
je 0x65ce8c1
cmp eax, 0xffffffff
jne 0x65ce305
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error____d___launching_SMC_process_to_import_Sylink_file.
lea ecx, [esp + 0x638]
push ecx
jmp 0x65ce313
push eax
push str.Error____d___in_smc__importSylink.
lea edx, [esp + 0x638]
push edx
mov edx, 0x200
call fcn.06572410
add esp, 0xc
lea eax, [esp + 0x630]
mov dword [0x65e8984], 0xe
push eax
jmp 0x65ce96f
call fcn.065cd170
test al, al
je 0x65ce48c
push 2
lea ecx, [esp + 0x1c]
push 0x65d90e4
push ecx
mov byte [0x65e7f55], 1
call fcn.065b79e9
add esp, 0xc
push 0x65e7f58
lea edx, [esp + 0x1c]
push 0x104
push edx
call fcn.065b767c
add esp, 0xc
push str._system32_net
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.065b767c
add esp, 0xc
push str.__stop_smcservice
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.065b767c
lea edx, [esp + 0x24]
add esp, 0xc
push edx
call fcn.065cc1c0
add esp, 4
push 2
lea eax, [esp + 0x1c]
push 0x65d90e4
push eax
call fcn.065b79e9
add esp, 0xc
push 0x65e8160
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.065b767c
add esp, 0xc
push 0x65d90e8
lea edx, [esp + 0x1c]
push 0x104
push edx
call fcn.065b767c
add esp, 0xc
cmp byte [0x65e7f54], 0
je 0x65ce441
push str.__p__
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.065b767c
add esp, 0xc
push 0x65e8368
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.065b767c
add esp, 0xc
push 0x65d90e4
lea edx, [esp + 0x1c]
push 0x104
push edx
call fcn.065b767c
add esp, 0xc
push str.__stop
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.065b767c
lea ecx, [esp + 0x24]
add esp, 0xc
push ecx
call fcn.065cc1c0
add esp, 4
xor esi, esi
call fcn.065cd170
test al, al
je 0x65ce48c
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x50
jge 0x65ce48c
push 0x1f4
inc esi
call edi
call fcn.065cd170
test al, al
jne 0x65ce476
call fcn.065cd170
test al, al
je 0x65ce4bb
mov ecx, str.Could_not_stop_the_Smc_service.
mov eax, 6
call fcn.065cc2f0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30a28]
xor ecx, esp
call fcn.065b6645
mov esp, ebp
pop ebp
ret
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x63a]
push eax
mov word [esp + 0x63c], dx
call fcn.065b84a0
add esp, 0xc
push 0x104
mov edi, str.SEPAppDataDir
mov esi, str.SOFTWARESymantecSymantec_Endpoint_ProtectionInstalledApps
call fcn.065cc070
push eax
lea ecx, [esp + 0x638]
push ecx
call fcn.065b79e9
lea eax, [esp + 0x63c]
add esp, 0xc
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x65ce510
sub eax, edx
sar eax, 1
je 0x65ce53a
push str.DataConfig_
lea edx, [esp + 0x634]
push 0x104
push edx
call fcn.065b767c
jmp 0x65ce551
push 0x104
lea eax, [esp + 0x634]
push 0x65e8160
push eax
call fcn.065b79e9
add esp, 0xc
push 4
lea ecx, [esp + 0x224]
push 0x65d9760
push ecx
xor esi, esi
call fcn.065b79e9
add esp, 0xc
lea edx, [esp + 0x630]
push edx
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.065b76f1
add esp, 0xc
push str.sylink.
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.065b767c
add esp, 0xc
lea edx, [esp + 0x220]
push edx
push 0x104
lea eax, [esp + 0x20]
push eax
call fcn.065b767c
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
call edi
cmp eax, 0xffffffff
je 0x65ce680
cmp esi, 0x3e7
jge 0x65ce680
inc esi
cmp esi, 0xa
jge 0x65ce5e9
push 3
push 0x65d97cc
jmp 0x65ce5fe
cmp esi, 0x64
jge 0x65ce5f7
push 2
push 0x65d97d4
jmp 0x65ce5fe
push 1
push 0x65d8dc0
lea edx, [esp + 0x228]
push edx
call fcn.065b79e9
add esp, 0xc
push 0xa
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.065b7dcc
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x224]
push 0x104
push edx
call fcn.065b767c
add esp, 0xc
lea eax, [esp + 0x630]
push eax
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.065b76f1
add esp, 0xc
push str.sylink.
lea edx, [esp + 0x1c]
push 0x104
push edx
call fcn.065b767c
add esp, 0xc
lea eax, [esp + 0x220]
push eax
push 0x104
lea ecx, [esp + 0x20]
push ecx
jmp 0x65ce5b0
lea edx, [esp + 0x630]
push edx
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.065b76f1
add esp, 0xc
push 0x65d97d8
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.065b767c
add esp, 0xc
lea edx, [esp + 0x630]
push edx
lea eax, [esp + 0x42c]
push 0x104
push eax
call fcn.065b76f1
add esp, 0xc
push str.sylink.
lea ecx, [esp + 0x42c]
push 0x104
push ecx
call fcn.065b767c
add esp, 0xc
lea edx, [esp + 0x220]
push edx
lea eax, [esp + 0x42c]
push 0x104
push eax
call fcn.065b767c
add esp, 0xc
lea ecx, [esp + 0x428]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x65ce72a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
lea eax, [esp + 0x18]
push eax
call edi
cmp eax, 0xffffffff
je 0x65ce774
movzx ecx, byte [0x65e7f55]
push ecx
call fcn.065cd220
add esp, 4
test al, al
je 0x65ce1da
mov ecx, str.Unable_to_backup_the_current_Sylink_file.
mov eax, 5
call fcn.065cc2f0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30a28]
xor ecx, esp
call fcn.065b6645
mov esp, ebp
pop ebp
ret
push 1
lea edx, [esp + 0x1c]
push edx
push 0x65e8570
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x65ce7c8
movzx eax, byte [0x65e7f55]
push eax
call fcn.065cd220
add esp, 4
test al, al
je 0x65ce1da
mov ecx, str.Could_not_copy_new_Sylink.xml_file.
mov eax, 3
call fcn.065cc2f0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30a28]
xor ecx, esp
call fcn.065b6645
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x630]
push ecx
lea edx, [esp + 0x1c]
push 0x104
push edx
call fcn.065b76f1
add esp, 0xc
push 0x65d97d8
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.065b767c
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
call edi
cmp eax, 0xffffffff
jne 0x65ce80f
movzx edx, byte [0x65e7f55]
push edx
jmp 0x65ce792
lea eax, [esp + 0x630]
push eax
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.065b76f1
add esp, 0xc
push str.sylink.bak
lea edx, [esp + 0x1c]
push 0x104
push edx
call fcn.065b767c
add esp, 0xc
lea eax, [esp + 0x630]
push eax
lea ecx, [esp + 0x42c]
push 0x104
push ecx
call fcn.065b76f1
add esp, 0xc
push str.sylinkex.bak
lea edx, [esp + 0x42c]
push 0x104
push edx
call fcn.065b767c
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call esi
lea ecx, [esp + 0x428]
push ecx
call esi
lea edx, [esp + 0x18]
push edx
call edi
cmp eax, 0xffffffff
jne 0x65ce8e4
lea eax, [esp + 0x428]
push eax
call edi
cmp eax, 0xffffffff
jne 0x65ce8e4
movzx ecx, byte [0x65e7f55]
push ecx
call fcn.065cd220
add esp, 4
test al, al
je 0x65ce1da
mov ecx, str.Sylink_file_has_been_successfully_replaced.
xor eax, eax
call fcn.065cc2f0
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30a28]
xor ecx, esp
call fcn.065b6645
mov esp, ebp
pop ebp
ret
movzx edx, byte [0x65e7f55]
push edx
call fcn.065cd220
add esp, 4
test al, al
je 0x65ce1da
mov ecx, str.Could_not_remove_backup_Sylink_files.
mov eax, 2
call fcn.065cc2f0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30a28]
xor ecx, esp
call fcn.065b6645
mov esp, ebp
pop ebp
ret
mov dword [0x65e8984], 8
push str.The_selected_Sylink_file_is_not_a_valid_Sylink_file.
jmp 0x65ce96f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, str.Could_not_open_the_selected_Sylink_file.
mov eax, 0xa
call fcn.065cc2f0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30a28]
xor ecx, esp
call fcn.065b6645
mov esp, ebp
pop ebp
ret
mov dword [0x65e8984], 0xd
push str.The_Symantec_Endpoint_Protection_client_cannot_get_window_path.
push 0x1ff
push 0x65e7b48
call fcn.065b76f1
mov ecx, dword [esp + 0x30a40]
add esp, 0xc
pop edi
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.065b6645
mov esp, ebp
pop ebp
ret