Function at 0x402250
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [0x404190]
mov esi, edx
push 6
push str.EXE32
push esi
mov ebx, ecx
call edi
add esp, 0xc
test eax, eax
je 0x402485
push 6
push str.EXE64
push esi
call edi
add esp, 0xc
test eax, eax
je 0x402485
push 4
push 0x404868
push esi
call edi
add esp, 0xc
test eax, eax
je 0x402485
push 6
push str.DLL32
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x4022c2
lea edx, [eax + 1]
mov ecx, ebx
call fcn.00401c30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 6
push str.DLL64
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x4022e3
xor edx, edx
mov ecx, ebx
call fcn.00401c30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 4
push 0x404888
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x402307
mov edx, str..pdf
mov ecx, ebx
call fcn.00401da0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
push str.WORD
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x40232b
mov edx, str..doc
mov ecx, ebx
call fcn.00401da0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 6
push str.EXCEL
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x40234f
mov edx, str..xls
mov ecx, ebx
call fcn.00401da0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 4
push 0x4048cc
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x402373
mov edx, str..ppt
mov ecx, ebx
call fcn.00401da0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 7
push str.PYTHON
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x402397
mov edx, 0x4048f0
mov ecx, ebx
call fcn.00401da0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 4
push 0x4048f8
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x4023bb
mov edx, str..bat
mov ecx, ebx
call fcn.00401da0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xb
push str.POWERSHELL
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x4023df
mov edx, str..ps1
mov ecx, ebx
call fcn.00401da0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4023f0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 0x10]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40247b
mov ecx, edi
sub ecx, esi
cmp word [esi], 0x2e
jne 0x402442
nop word [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x402430
jmp 0x40245f
mov eax, 0x2e
mov word [edi], ax
nop word [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi], ax
test ax, ax
jne 0x402450
mov edx, edi
mov ecx, ebx
call fcn.00401da0
push edi
push 1
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [0x4040a0]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x208
push 8
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x402520
mov edi, dword [0x404198]
push str.C:Sample.exe
push 0x104
push esi
call edi
add esp, 0xc
push 0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
mov eax, dword [0x404180]
jne 0x4024ef
push esi
push ebx
push str._Info__Not_copy_File__s__To__s_n
push 2
call eax
add esp, 4
push eax
call fcn.00401ae0
push ebx
push 0x104
push esi
call edi
mov eax, dword [0x404180]
add esp, 0x1c
push esi
push str._Info__To_call__s_n
push 1
call eax
add esp, 4
push eax
call fcn.00401ae0
add esp, 0xc
xor edx, edx
mov ecx, esi
call fcn.00401b10
push esi
push 1
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [0x4040a0]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret