Function at 0x4055c0
Capabilities:
Copy file
Get common file path

Disassembly:
sub esp, 0x230
or ecx, 0xffffffff
xor eax, eax
push esi
push edi
mov edi, str.null
push 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.SYSTEMCurrentControlSetServicesWinSock2DrcomPacketCapture
mov eax, ecx
mov esi, edi
mov edi, 0x417658
push reloc.WSOCK32.dll_bind
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x116
and ecx, 3
push 0x417658
rep movsb byte es:[edi], byte [esi]
push str.PathNameR
call fcn.00404f50
mov edi, 0x41bd14
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.SYSTEMCurrentControlSetServicesWinSock2DrcomPacketCapture
mov edx, ecx
mov esi, edi
mov edi, 0x417770
push reloc.WSOCK32.dll_bind
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x116
and ecx, 3
push 0x417770
rep movsb byte es:[edi], byte [esi]
push str.PathName
call fcn.00404f50
add esp, 0x30
test al, al
je 0x405670
call fcn.00405970
test al, al
jne 0x405670
pop edi
mov eax, 0xfffffffe
pop esi
add esp, 0x230
ret
mov edi, 0x41bd14
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov eax, ecx
mov esi, edi
mov edi, 0x417888
push 0x104
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [0x41bca8], 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x12c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jle 0x40579f
cmp eax, 0x104
jge 0x40579f
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [0x41bca8], 2
mov byte [esp + eax + 0x128], 0
xor esi, esi
push esi
lea edx, [esp + 0x12c]
push str.TcpIpDog
push edx
lea eax, [esp + 0x1c]
push str._s_sR_u.dll
push eax
call ebx
add esp, 0x14
lea ecx, [esp + 0x10]
push 0
push ecx
push 0x4179a0
call ebp
test eax, eax
jne 0x40571e
inc esi
cmp esi, 0xa
jl 0x4056e7
jmp 0x405742
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x417888
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
push esi
lea eax, [esp + 0x12c]
push str.TcpIpDog
push eax
lea ecx, [esp + 0x1c]
push str._s_s_u.dll
push ecx
call ebx
add esp, 0x14
lea edx, [esp + 0x10]
push 0
push edx
push 0x4179a0
call ebp
test eax, eax
jne 0x40577b
inc esi
cmp esi, 0xa
jl 0x405744
jmp 0x40579f
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4179a0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
call fcn.004054f0
add esp, 4
test eax, eax
pop ebp
pop ebx
jne 0x405808
mov edi, 0x4179a0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push 1
push str.SYSTEMCurrentControlSetServicesWinSock2DrcomPacketCapture
dec ecx
push reloc.WSOCK32.dll_bind
push ecx
push 0x4179a0
push str.PathName
call fcn.00404fc0
mov edi, 0x417888
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2DrcomPacketCapture
dec ecx
push reloc.WSOCK32.dll_bind
push ecx
push 0x417888
push str.PathNameR
call fcn.00404fc0
add esp, 0x30
xor eax, eax
pop edi
pop esi
add esp, 0x230
ret