Function at 0x446a60
Capabilities:
Copy file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d84c7
mov eax, dword fs:[0]
push eax
sub esp, 0x408
mov eax, dword [0x50f52c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x410], ecx
push 0x104
lea ecx, [ebp - 0x114]
push ecx
push 0x4e75f4
mov dword [ebp - 0x414], eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor ebx, ebx
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], ebx
mov byte [ebp - 0x12c], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x446ad8
sub eax, edx
push eax
lea edx, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x130]
call fcn.00402840
mov dword [ebp - 4], ebx
push str.System32_vsconfig.xml
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x168]
push ecx
call fcn.00425f60
add esp, 0xc
mov byte [ebp - 4], 2
cmp dword [ebp - 0x118], 0x10
jb 0x446b2e
mov edx, dword [ebp - 0x12c]
push edx
call fcn.004b29fa
add esp, 4
push ebx
xor eax, eax
push 0x4e25d8
lea ecx, [ebp - 0x14c]
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], ebx
mov byte [ebp - 0x12c], bl
mov dword [ebp - 0x134], 7
mov dword [ebp - 0x138], ebx
mov word [ebp - 0x148], ax
call fcn.00401860
mov byte [ebp - 4], 3
push 0x23
lea ecx, [ebp - 0x14c]
push ecx
call fcn.00451cd0
push 0x1a
push str.CheckPointZoneAlarmData
lea ecx, [ebp - 0x14c]
call fcn.00401620
push str.protection.xml
lea edx, [ebp - 0x14c]
push edx
lea eax, [ebp - 0x130]
push eax
call fcn.00401b00
mov esi, eax
mov byte [ebp - 4], 4
push str.protection.xml
add edi, 0x380
lea ecx, [ebp - 0x40c]
push edi
push ecx
call fcn.00401b00
add esp, 0x18
mov byte [ebp - 4], 5
cmp dword [esi + 0x18], 8
jb 0x446bda
mov esi, dword [esi + 4]
jmp 0x446bdd
add esi, 4
cmp dword [eax + 0x18], 8
jb 0x446be8
mov eax, dword [eax + 4]
jmp 0x446beb
add eax, 4
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov byte [ebp - 4], 4
mov esi, 8
cmp dword [ebp - 0x3f4], esi
jb 0x446c14
mov edx, dword [ebp - 0x408]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
mov dword [ebp - 0x3f4], 7
mov dword [ebp - 0x3f8], ebx
mov word [ebp - 0x408], ax
mov byte [ebp - 4], 3
cmp dword [ebp - 0x118], esi
jb 0x446c48
mov ecx, dword [ebp - 0x12c]
push ecx
call fcn.004b29fa
add esp, 4
push str.osfwrules.xml
lea eax, [ebp - 0x14c]
push eax
lea ecx, [ebp - 0x130]
xor edx, edx
push ecx
mov dword [ebp - 0x118], 7
mov dword [ebp - 0x11c], ebx
mov word [ebp - 0x12c], dx
call fcn.00401b00
mov esi, eax
mov byte [ebp - 4], 6
push str.osfwrules.xml
lea edx, [ebp - 0x40c]
push edi
push edx
call fcn.00401b00
add esp, 0x18
mov byte [ebp - 4], 7
cmp dword [esi + 0x18], 8
jb 0x446ca3
mov ecx, dword [esi + 4]
jmp 0x446ca6
lea ecx, [esi + 4]
mov esi, 8
cmp dword [eax + 0x18], esi
jb 0x446cb5
mov eax, dword [eax + 4]
jmp 0x446cb8
add eax, 4
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov byte [ebp - 4], 6
cmp dword [ebp - 0x3f4], esi
jb 0x446cdc
mov eax, dword [ebp - 0x408]
push eax
call fcn.004b29fa
add esp, 4
mov edi, 7
xor ecx, ecx
mov dword [ebp - 0x3f4], edi
mov dword [ebp - 0x3f8], ebx
mov word [ebp - 0x408], cx
mov byte [ebp - 4], 3
cmp dword [ebp - 0x118], esi
jb 0x446d11
mov edx, dword [ebp - 0x12c]
push edx
call fcn.004b29fa
add esp, 4
mov edx, dword [ebp - 0x148]
xor eax, eax
mov word [ebp - 0x12c], ax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x11c], ebx
mov edi, edx
cmp eax, esi
jae 0x446d3e
lea edi, [ebp - 0x148]
mov esi, dword [ebp - 0x138]
lea edi, [edi + esi*2]
cmp edi, ebx
je 0x446d70
mov ecx, edx
cmp eax, 8
jae 0x446d58
lea ecx, [ebp - 0x148]
cmp ecx, edi
ja 0x446d70
mov ecx, edx
cmp eax, 8
jae 0x446d69
lea ecx, [ebp - 0x148]
lea ecx, [ecx + esi*2]
cmp edi, ecx
jbe 0x446d81
call fcn.004b32e0
mov eax, dword [ebp - 0x134]
mov edx, dword [ebp - 0x148]
cmp eax, 8
jb 0x4472dc
mov esi, edx
cmp edx, ebx
je 0x446dbb
mov ecx, edx
cmp eax, 8
jae 0x446d9d
lea ecx, [ebp - 0x148]
cmp ecx, esi
ja 0x446dbb
cmp eax, 8
mov eax, edx
jae 0x446dae
lea eax, [ebp - 0x148]
mov edx, dword [ebp - 0x138]
lea eax, [eax + edx*2]
cmp esi, eax
jbe 0x446dc0
call fcn.004b32e0
mov ecx, dword [ebp - 0x410]
push ecx
lea eax, [ebp - 0x14c]
push edi
mov ecx, eax
push ecx
push esi
push eax
lea ecx, [ebp - 0x184]
mov dword [ebp - 0x16c], 0xf
mov dword [ebp - 0x170], ebx
mov byte [ebp - 0x180], bl
call fcn.00441220
mov byte [ebp - 4], 8
push 0xd
push str._vsconfig.tmp
lea ecx, [ebp - 0x184]
call fcn.00408a60
push 3
xor edx, edx
push 0x4e2ed0
lea ecx, [ebp - 0x40c]
mov dword [ebp - 0x3f4], 7
mov dword [ebp - 0x3f8], ebx
mov word [ebp - 0x408], dx
call fcn.00401860
mov byte [ebp - 4], 9
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x12c]
call fcn.004306b0
mov byte [ebp - 4], 0xa
mov edi, dword [ebp - 0x414]
push eax
mov ecx, edi
call fcn.0042f7f0
mov esi, eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x12c]
call fcn.00403370
mov byte [ebp - 4], 8
cmp dword [ebp - 0x3f4], 8
jb 0x446e8a
mov ecx, dword [ebp - 0x408]
push ecx
call fcn.004b29fa
add esp, 4
xor edx, edx
mov dword [ebp - 0x3f4], 7
mov dword [ebp - 0x3f8], ebx
mov word [ebp - 0x408], dx
cmp esi, ebx
je 0x44708d
mov eax, dword [edi + 0x180]
push 6
lea esi, [edi + 0x16c]
push str.64_bit
push eax
push ebx
mov ecx, esi
call fcn.00401fe0
test eax, eax
jne 0x446fa5
lea eax, [ebp - 0x114]
mov dword [ebp - 0x3f4], 0xf
mov dword [ebp - 0x3f8], ebx
mov byte [ebp - 0x408], bl
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x446ef0
sub eax, edx
push eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x40c]
call fcn.00402840
mov byte [ebp - 4], 0xc
push 0x4e756c
lea edx, [ebp - 0x40c]
push edx
lea eax, [ebp - 0x130]
push eax
call fcn.00425f60
add esp, 0xc
mov byte [ebp - 4], 0xd
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x168]
call fcn.00402750
mov byte [ebp - 4], 0xc
mov edi, 0x10
cmp dword [ebp - 0x118], edi
jb 0x446f5e
mov ecx, dword [ebp - 0x12c]
push ecx
call fcn.004b29fa
add esp, 4
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], ebx
mov byte [ebp - 0x12c], bl
mov byte [ebp - 4], 8
cmp dword [ebp - 0x3f4], edi
jb 0x446f8f
mov edx, dword [ebp - 0x408]
push edx
call fcn.004b29fa
add esp, 4
mov dword [ebp - 0x3f4], 0xf
mov dword [ebp - 0x3f8], ebx
mov byte [ebp - 0x408], bl
mov eax, dword [esi + 0x14]
push 6
push str.32_bit
push eax
push ebx
mov ecx, esi
mov edi, 0xf
call fcn.00401fe0
test eax, eax
jne 0x44708d
lea eax, [ebp - 0x114]
mov dword [ebp - 0x3f4], edi
mov dword [ebp - 0x3f8], ebx
mov byte [ebp - 0x408], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x446fe0
sub eax, edx
push eax
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x40c]
call fcn.00402840
mov byte [ebp - 4], 0xe
push 0x4e756c
lea edx, [ebp - 0x40c]
push edx
lea eax, [ebp - 0x130]
push eax
call fcn.00425f60
add esp, 0xc
mov byte [ebp - 4], 0xf
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x168]
call fcn.00402750
mov byte [ebp - 4], 0xe
mov esi, 0x10
cmp dword [ebp - 0x118], esi
jb 0x44704e
mov ecx, dword [ebp - 0x12c]
push ecx
call fcn.004b29fa
add esp, 4
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x11c], ebx
mov byte [ebp - 0x12c], bl
mov byte [ebp - 4], 8
cmp dword [ebp - 0x3f4], esi
jb 0x44707b
mov edx, dword [ebp - 0x408]
push edx
call fcn.004b29fa
add esp, 4
mov dword [ebp - 0x3f4], edi
mov dword [ebp - 0x3f8], ebx
mov byte [ebp - 0x408], bl
call fcn.00427480
mov ecx, dword [ebp - 0x164]
mov esi, 0x10
cmp dword [ebp - 0x150], esi
jae 0x4470ab
lea ecx, [ebp - 0x164]
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x16c], esi
jae 0x4470bf
lea eax, [ebp - 0x180]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x24c
lea eax, [ebp - 0x3ec]
push ebx
push eax
mov dword [ebp - 0x3f0], ebx
call fcn.004b32f0
mov ecx, dword [ebp - 0x150]
mov edx, dword [ebp - 0x164]
add esp, 0xc
mov eax, edx
cmp ecx, esi
jae 0x4470fb
lea eax, [ebp - 0x164]
mov esi, dword [ebp - 0x154]
lea edi, [eax + esi]
cmp edi, ebx
je 0x44712c
mov eax, edx
cmp ecx, 0x10
jae 0x447115
lea eax, [ebp - 0x164]
cmp eax, edi
ja 0x44712c
mov eax, edx
cmp ecx, 0x10
jae 0x447126
lea eax, [ebp - 0x164]
add eax, esi
cmp edi, eax
jbe 0x44713d
call fcn.004b32e0
mov ecx, dword [ebp - 0x150]
mov edx, dword [ebp - 0x164]
cmp ecx, 0x10
jb 0x4472e7
mov esi, edx
cmp edx, ebx
je 0x447176
mov eax, edx
cmp ecx, 0x10
jae 0x447159
lea eax, [ebp - 0x164]
cmp eax, esi
ja 0x447176
mov eax, edx
cmp ecx, 0x10
jae 0x44716a
lea eax, [ebp - 0x164]
mov ecx, dword [ebp - 0x154]
add eax, ecx
cmp esi, eax
jbe 0x44717b
call fcn.004b32e0
mov ecx, dword [ebp - 0x410]
push ecx
lea eax, [ebp - 0x168]
push edi
mov ecx, eax
push ecx
push esi
xor edx, edx
push eax
lea ecx, [ebp - 0x1a0]
mov dword [ebp - 0x188], 7
mov dword [ebp - 0x18c], ebx
mov word [ebp - 0x19c], dx
call fcn.00425ac0
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x188], 8
mov eax, dword [ebp - 0x19c]
jae 0x4471cb
lea eax, [ebp - 0x19c]
lea edx, [ebp - 0x3f0]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x4472f2
mov esi, dword [ebp - 0x3d4]
neg esi
sbb esi, esi
not esi
and esi, dword [ebp - 0x3d0]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, 0x1000
jbe 0x4472f2
push 0xe
xor eax, eax
mov esi, 7
push str.FIREWALLACTION
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x11c], ebx
mov word [ebp - 0x12c], ax
call fcn.00401860
mov byte [ebp - 4], 0x11
xor ecx, ecx
push 0x1d
mov word [ebp - 0x408], cx
push str.Use_distributed_vsconfig.xml.
lea ecx, [ebp - 0x40c]
mov dword [ebp - 0x3f4], esi
mov dword [ebp - 0x3f8], ebx
call fcn.00401860
mov byte [ebp - 4], 0x12
lea edx, [ebp - 0x130]
push edx
lea eax, [ebp - 0x40c]
push eax
call fcn.00419d40
mov byte [ebp - 4], 0x11
mov edi, 8
cmp dword [ebp - 0x3f4], edi
jb 0x447295
mov ecx, dword [ebp - 0x408]
push ecx
call fcn.004b29fa
add esp, 4
xor edx, edx
mov dword [ebp - 0x3f4], esi
mov dword [ebp - 0x3f8], ebx
mov word [ebp - 0x408], dx
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x118], edi
jb 0x4472c5
mov eax, dword [ebp - 0x12c]
push eax
call fcn.004b29fa
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x118], esi
mov word [ebp - 0x12c], cx
lea esi, [ecx + 0x10]
jmp 0x44752d
lea esi, [ebp - 0x148]
jmp 0x446d90
lea esi, [ebp - 0x164]
jmp 0x44714c
push 0xe
xor edx, edx
mov edi, 7
push str.FIREWALLACTION
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x11c], ebx
mov word [ebp - 0x12c], dx
call fcn.00401860
mov byte [ebp - 4], 0x13
push 0x18
xor eax, eax
push str.Creating_vsconfig.xml...
lea ecx, [ebp - 0x40c]
mov dword [ebp - 0x3f4], edi
mov dword [ebp - 0x3f8], ebx
mov word [ebp - 0x408], ax
call fcn.00401860
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x130]
push ecx
lea edx, [ebp - 0x40c]
push edx
call fcn.00419d40
mov byte [ebp - 4], 0x13
mov esi, 8
cmp dword [ebp - 0x3f4], esi
jb 0x447380
mov eax, dword [ebp - 0x408]
push eax
call fcn.004b29fa
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x3f4], edi
mov dword [ebp - 0x3f8], ebx
mov word [ebp - 0x408], cx
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x118], esi
jb 0x4473b0
mov edx, dword [ebp - 0x12c]
push edx
call fcn.004b29fa
add esp, 4
mov ecx, dword [ebp - 0x410]
xor eax, eax
mov word [ebp - 0x12c], ax
mov eax, dword [ecx + 4]
push str.ReplaceOrAddTagIntoVSConfig
push eax
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x11c], ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x410], eax
cmp eax, ebx
jne 0x4473f3
call fcn.00424e10
mov esi, 0x10
jmp 0x447538
mov edx, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x148]
mov eax, ecx
cmp edx, esi
jae 0x44740b
lea eax, [ebp - 0x148]
mov esi, dword [ebp - 0x138]
lea edi, [eax + esi*2]
cmp edi, ebx
je 0x44743d
mov eax, ecx
cmp edx, 8
jae 0x447425
lea eax, [ebp - 0x148]
cmp eax, edi
ja 0x44743d
mov eax, ecx
cmp edx, 8
jae 0x447436
lea eax, [ebp - 0x148]
lea eax, [eax + esi*2]
cmp edi, eax
jbe 0x44744e
call fcn.004b32e0
mov edx, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x148]
cmp edx, 8
jb 0x447624
mov esi, ecx
cmp ecx, ebx
je 0x447488
mov eax, ecx
cmp edx, 8
jae 0x44746a
lea eax, [ebp - 0x148]
cmp eax, esi
ja 0x447488
mov eax, ecx
cmp edx, 8
jae 0x44747b
lea eax, [ebp - 0x148]
mov ecx, dword [ebp - 0x138]
lea edx, [eax + ecx*2]
cmp esi, edx
jbe 0x44748d
call fcn.004b32e0
mov ecx, dword [ebp - 0x410]
push ecx
lea eax, [ebp - 0x14c]
push edi
mov ecx, eax
push ecx
push esi
push eax
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], ebx
mov byte [ebp - 0x12c], bl
call fcn.00441220
mov byte [ebp - 4], 0x15
push 0xf
push 0x4e74d0
lea ecx, [ebp - 0x130]
call fcn.00408a60
mov eax, dword [ebp - 0x12c]
mov esi, 0x10
cmp dword [ebp - 0x118], esi
jae 0x4474f0
lea eax, [ebp - 0x12c]
push ebx
push str._securitypolicy_
push str.osfirewall
push eax
call dword [ebp - 0x410]
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x118], esi
jb 0x44751d
mov edx, dword [ebp - 0x12c]
push edx
call fcn.004b29fa
add esp, 4
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], bl
mov edi, 7
mov dword [ebp - 0x11c], ebx
call fcn.004260e0
mov byte [ebp - 4], 8
cmp dword [ebp - 0x188], 8
jb 0x447559
mov eax, dword [ebp - 0x19c]
push eax
call fcn.004b29fa
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x188], edi
mov dword [ebp - 0x18c], ebx
mov word [ebp - 0x19c], cx
mov byte [ebp - 4], 3
cmp dword [ebp - 0x16c], esi
jb 0x447589
mov edx, dword [ebp - 0x180]
push edx
call fcn.004b29fa
add esp, 4
mov dword [ebp - 0x16c], 0xf
mov dword [ebp - 0x170], ebx
mov byte [ebp - 0x180], bl
mov byte [ebp - 4], 2
cmp dword [ebp - 0x134], 8
jb 0x4475bb
mov eax, dword [ebp - 0x148]
push eax
call fcn.004b29fa
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x138], ebx
mov word [ebp - 0x148], cx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x150], esi
jb 0x4475ee
mov edx, dword [ebp - 0x164]
push edx
call fcn.004b29fa
add esp, 4
mov dword [ebp - 0x150], 0xf
mov dword [ebp - 0x154], ebx
mov byte [ebp - 0x164], bl
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b3057
mov esp, ebp
pop ebp
ret 8
lea esi, [ebp - 0x148]
jmp 0x44745d