Function at 0x4a10f0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5596e1
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x5d0074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x54], 0
call dword [sym.imp.ole32.dll_CoCreateGuid]
call fcn.00411fd0
mov ecx, eax
test ecx, ecx
je 0x4a18ed
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 2
movzx eax, byte [ebp - 0x11]
push eax
movzx eax, byte [ebp - 0x12]
push eax
movzx eax, byte [ebp - 0x13]
push eax
movzx eax, byte [ebp - 0x14]
push eax
movzx eax, byte [ebp - 0x15]
push eax
movzx eax, byte [ebp - 0x16]
push eax
movzx eax, byte [ebp - 0x17]
push eax
movzx eax, byte [ebp - 0x18]
push eax
movzx eax, word [ebp - 0x1a]
push eax
movzx eax, word [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 0x38]
push str._0.8X__0.4X__0.4X__0.2X_0.2X__0.2X_0.2X_0.2X_0.2X_0.2X_0.2X
push eax
call fcn.00417cc0
add esp, 0x34
call fcn.00411fd0
mov ecx, eax
test ecx, ecx
je 0x4a18f7
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x30], edi
mov byte [ebp - 4], 4
call fcn.00411fd0
mov ecx, eax
test ecx, ecx
je 0x4a1901
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 6
call fcn.00411fd0
mov ecx, eax
test ecx, ecx
je 0x4a190b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 8
lea eax, [ebp - 0x50]
mov ecx, dword [ebx + 0x20]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004af690
mov esi, dword [ebp - 0x50]
lea ecx, [edi - 0x10]
or ebx, 0xffffffff
mov dword [ebp - 0x2c], ecx
lea edx, [esi - 0x10]
mov dword [ebp - 0x58], edx
cmp edx, ecx
je 0x4a126e
cmp dword [ecx + 0xc], 0
lea edi, [ecx + 0xc]
jl 0x4a125f
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x4a125f
mov ecx, edx
call fcn.0040a1d0
mov dword [ebp - 0x24], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x4a1257
mov eax, dword [ebp - 0x2c]
push eax
mov edi, dword [eax]
mov ecx, dword [edi]
mov edx, dword [ecx + 4]
mov ecx, edi
call edx
mov eax, dword [ebp - 0x24]
lea edi, [eax + 0x10]
mov dword [ebp - 0x30], edi
jmp 0x4a126e
push dword [esi - 0xc]
lea ecx, [ebp - 0x30]
push esi
call fcn.004126c0
mov edi, dword [ebp - 0x30]
cmp dword [esi - 0xc], 0
jl 0x4a12bc
push 0x58b0f0
push esi
call fcn.00522cd0
add esp, 8
test eax, eax
je 0x4a12bc
sub eax, esi
sar eax, 1
jne 0x4a12bc
add esi, 8
jne 0x4a1295
xor ecx, ecx
jmp 0x4a12af
mov ecx, esi
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a12a0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x30]
call fcn.004126c0
mov edi, dword [ebp - 0x30]
lea eax, [ebp - 0x38]
push eax
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x2c]
call fcn.00490be0
mov byte [ebp - 4], 9
mov edx, eax
push 0x584bd8
lea ecx, [ebp - 0x34]
call fcn.0047a940
add esp, 8
mov byte [ebp - 4], 0xb
mov eax, ebx
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4a12ff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
mov dl, 1
lea ecx, [ebp - 0x34]
call fcn.00494c80
push str.instname_target.msi
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x40]
call fcn.0047a940
add esp, 8
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax]
add ecx, 0x24
mov esi, dword [ecx]
lea eax, [edx - 0x10]
sub esi, 0x10
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x3c], esi
cmp eax, esi
je 0x4a1386
cmp dword [esi + 0xc], 0
jl 0x4a137d
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x4a137d
mov ecx, dword [ebp - 0x24]
call fcn.0040a1d0
mov dword [ebp - 0x24], eax
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4a136f
mov esi, dword [esi]
push dword [ebp - 0x3c]
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
mov ecx, esi
call edx
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
add eax, 0x10
mov dword [esi + 0x24], eax
jmp 0x4a1389
push dword [edx - 0xc]
push edx
call fcn.004126c0
mov esi, dword [ebp - 0x28]
mov byte [ebp - 4], 0xb
mov eax, ebx
mov edx, dword [ebp - 0x40]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4a13a7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.instname_custom.mst
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x24]
call fcn.0047a940
add esp, 4
mov byte [ebp - 4], 0xf
mov ecx, dword [eax]
mov esi, dword [esi + 0x28]
sub esi, 0x10
mov dword [ebp - 0x40], esi
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x4a1421
cmp dword [esi + 0xc], 0
jl 0x4a1410
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x4a1410
mov ecx, edx
call fcn.0040a1d0
mov dword [ebp - 0x3c], eax
lea edx, [esi + 0xc]
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4a1405
mov esi, dword [esi]
push dword [ebp - 0x40]
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
mov ecx, esi
call edx
mov eax, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x28]
add eax, 0x10
mov dword [esi + 0x28], eax
jmp 0x4a1424
push dword [ecx - 0xc]
mov esi, dword [ebp - 0x28]
push ecx
lea ecx, [esi + 0x28]
call fcn.004126c0
jmp 0x4a1424
mov esi, dword [ebp - 0x28]
mov byte [ebp - 4], 0xb
mov eax, ebx
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4a1442
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push dword [esi + 0x24]
mov esi, dword [ebp - 0x44]
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4a1517
call fcn.00411fd0
mov ecx, eax
test ecx, ecx
je 0x4a1915
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [ebp - 0x48]
add eax, 0x10
mov dword [ecx], eax
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x54], 1
mov byte [ebp - 4], 8
mov eax, ebx
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4a149e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 6
mov eax, ebx
mov edx, dword [ebp - 0x58]
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4a14b9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4a14d4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4a14ef
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4a18cc
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x4a18cc
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0x1c]
sub ecx, 0x10
call fcn.0040a1d0
add eax, 0x10
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x1c]
cmp dword [eax - 0xc], 0
jne 0x4a15e3
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.004a1df0
mov byte [ebp - 4], 0x19
mov eax, dword [eax]
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x5c], eax
lea ecx, [eax - 0x10]
mov dword [ebp - 0x24], ecx
mov ecx, dword [edx + 0x1c]
sub ecx, 0x10
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x24], ecx
je 0x4a15c5
cmp dword [ecx + 0xc], 0
lea esi, [ecx + 0xc]
mov dword [ebp - 0x40], esi
mov esi, dword [ebp - 0x44]
jl 0x4a15b9
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
cmp eax, dword [ecx]
jne 0x4a15b6
mov ecx, dword [ebp - 0x24]
call fcn.0040a1d0
mov dword [ebp - 0x24], eax
mov ecx, ebx
mov eax, dword [ebp - 0x40]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4a15a8
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
add eax, 0x10
mov dword [ecx + 0x1c], eax
jmp 0x4a15c5
mov eax, dword [ebp - 0x5c]
push dword [eax - 0xc]
lea ecx, [edx + 0x1c]
push eax
call fcn.004126c0
mov byte [ebp - 4], 0x18
mov eax, ebx
mov edx, dword [ebp - 0x4c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4a15e3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00411fd0
mov ecx, eax
test ecx, ecx
je 0x4a191f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0x1b
mov eax, 0x5832fc
lea ecx, [ebp - 0x24]
test eax, 0xffff0000
jne 0x4a161b
movzx eax, ax
push eax
call fcn.00412350
jmp 0x4a1627
push 0xb
push 0x5832fc
call fcn.004126c0
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x28]
lea eax, [ecx + 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ecx + 0x24]
push eax
call fcn.004a1bc0
mov byte [ebp - 4], 0x18
mov eax, ebx
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4a165d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00411fd0
mov ecx, eax
test ecx, ecx
je 0x4a1929
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0x1e
mov eax, str.AI_PRODUCTNAME_ARP
lea ecx, [ebp - 0x24]
test eax, 0xffff0000
jne 0x4a1695
movzx eax, ax
push eax
call fcn.00412350
jmp 0x4a16a1
push 0x12
push str.AI_PRODUCTNAME_ARP
call fcn.004126c0
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x28]
lea eax, [ecx + 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ecx + 0x24]
push eax
call fcn.004a1bc0
mov byte [ebp - 4], 0x18
mov eax, ebx
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4a16d7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00411fd0
mov ecx, eax
test ecx, ecx
je 0x4a1933
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0x21
mov eax, str.ProductCode
lea ecx, [ebp - 0x24]
test eax, 0xffff0000
jne 0x4a170f
movzx eax, ax
push eax
call fcn.00412350
jmp 0x4a171b
push 0xb
push str.ProductCode
call fcn.004126c0
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x28]
add eax, 0x24
push eax
call fcn.004a1bc0
mov byte [ebp - 4], 0x18
mov eax, ebx
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4a1751
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00411fd0
mov ecx, eax
test ecx, ecx
je 0x4a193d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0x24
mov eax, str.InstanceId
lea ecx, [ebp - 0x24]
test eax, 0xffff0000
jne 0x4a1789
movzx eax, ax
push eax
call fcn.00412350
jmp 0x4a1793
push str.InstanceId
call fcn.00495630
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x28]
add eax, 0x24
push eax
call fcn.004a1bc0
mov byte [ebp - 4], 0x18
mov eax, ebx
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4a17c9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x28]
lea eax, [ecx + 0x28]
push eax
lea eax, [ecx + 0x24]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.004a1950
mov byte [ebp - 4], 0x18
mov eax, ebx
mov edx, dword [ebp - 0x4c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4a17ff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx + 0x28]
sub ecx, 0x10
call fcn.0040a1d0
mov ecx, dword [ebp - 0x48]
add eax, 0x10
mov dword [ecx], eax
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x54], 1
mov byte [ebp - 4], 0xb
mov eax, ebx
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4a183e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 8
mov eax, ebx
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4a185c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 6
mov eax, ebx
mov edx, dword [ebp - 0x58]
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4a1877
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4a1892
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4a18ad
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4a18cc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005214e1
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004126a0
push 0x80004005
call fcn.004126a0
push 0x80004005
call fcn.004126a0
push 0x80004005
call fcn.004126a0
push 0x80004005
call fcn.004126a0
push 0x80004005
call fcn.004126a0
push 0x80004005
call fcn.004126a0
push 0x80004005
call fcn.004126a0
push 0x80004005
call fcn.004126a0
int3