Function at 0x437890
Capabilities:
Copy file
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52358e
mov eax, dword fs:[0]
push eax
sub esp, 0x494
mov eax, dword [0x58c250]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x216]
push ecx
mov dword [ebp - 0x480], 0
mov word [ebp - 0x218], ax
call fcn.004f0550
mov edx, dword [0x58c214]
mov eax, dword [edx + 0xc]
add esp, 0xc
mov ecx, 0x58c214
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x474], esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x498]
push ecx
call fcn.004b45f0
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
add esp, 4
or eax, ecx
jge 0x437943
push 0x104
lea ecx, [ebp - 0x474]
call fcn.004018b0
mov esi, dword [ebp - 0x474]
mov edx, dword [ebp - 0x498]
push 0x104
push esi
push str.LogsDir
push edx
call fcn.004b4490
add esp, 0x10
test eax, eax
jne 0x437a50
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x437a09
mov byte [ebp - 4], 1
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4379a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4379c5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4379eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f0194
mov esp, ebp
pop ebp
ret
push 0x53bb00
lea ecx, [ebp - 0x218]
push 0x104
push ecx
call fcn.004f43d5
push 0x53d708
lea edx, [ebp - 0x218]
push 0x104
push edx
call fcn.004f43d5
push str.Data_
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004f43d5
add esp, 0x24
jmp 0x437abf
test esi, esi
jne 0x437a58
xor eax, eax
jmp 0x437a75
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x437a60
sub eax, edx
sar eax, 1
js 0x437f12
cmp eax, dword [esi - 8]
jg 0x437f12
push 0x53d708
lea edx, [ebp - 0x474]
xor ecx, ecx
push str._sData_
mov dword [esi - 0xc], eax
push edx
mov word [esi + eax*2], cx
call fcn.00402550
mov esi, dword [ebp - 0x474]
lea edx, [ebp - 0x218]
add esp, 0xc
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x437ab0
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x470]
call fcn.00411460
mov byte [ebp - 4], 7
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x470]
call fcn.00401ed0
push 1
push 0x53bb00
lea ecx, [ebp - 0x470]
call fcn.00401ed0
push 0x19
push str.ClipboardClipboardFiles_
lea ecx, [ebp - 0x470]
call fcn.00401ed0
mov eax, dword [0x58e4b8]
mov edi, dword [eax]
mov dword [ebp - 0x46c], edi
cmp edi, eax
je 0x437e78
lea esi, [edi + 0xc]
push esi
lea ecx, [ebp - 0x470]
push ecx
lea edx, [ebp - 0x490]
push edx
call fcn.004316a0
mov byte [ebp - 4], 8
push esi
lea eax, [ebp - 0x470]
push eax
lea ecx, [ebp - 0x484]
push ecx
call fcn.004316a0
add esp, 0x18
mov byte [ebp - 4], 9
mov eax, dword [eax]
lea edx, [ebp - 0x468]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x484]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437b8f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp ebx, 0xffffffff
je 0x437de3
test byte [ebp - 0x468], 0x10
jne 0x437de3
mov eax, dword [esi + 4]
sub eax, 0x10
push eax
call fcn.00401500
lea ebx, [eax + 0x10]
mov dword [ebp - 0x4a0], ebx
mov byte [ebp - 4], 0xc
push 0x5c
push ebx
call fcn.004f43a7
add esp, 0xc
test eax, eax
je 0x437dc3
sub eax, ebx
sar eax, 1
mov edi, eax
cmp edi, 0xffffffff
je 0x437dbd
push str.DataCLFiles_
lea ecx, [ebp - 0x478]
call fcn.00411460
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x478]
add eax, 0xfffffff0
push eax
call fcn.00401500
add eax, 0x10
add esp, 4
mov dword [ebp - 0x47c], eax
mov byte [ebp - 4], 0xf
push edi
lea ecx, [ebp - 0x48c]
push ecx
lea ecx, [ebp - 0x4a0]
call fcn.00401b70
mov byte [ebp - 4], 0x10
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x478]
call fcn.00401ed0
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x48c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x437c62
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebx - 0xc]
push eax
push ebx
lea ecx, [ebp - 0x47c]
call fcn.00401ed0
lea ecx, [ebp - 0x478]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x49c]
push eax
call fcn.004316a0
add esp, 0xc
mov byte [ebp - 4], 0x12
mov eax, dword [eax]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edi, eax
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x49c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437cc5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test edi, edi
je 0x437cd5
cmp edi, 0xb7
jne 0x437d71
lea ecx, [ebp - 0x47c]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x488]
push eax
call fcn.004316a0
mov edi, eax
mov byte [ebp - 4], 0x14
push esi
lea ecx, [ebp - 0x470]
push ecx
lea edx, [ebp - 0x494]
push edx
call fcn.004316a0
add esp, 0x18
mov byte [ebp - 4], 0x15
mov edi, dword [edi]
mov eax, dword [eax]
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x494]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437d41
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x488]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437d67
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x480], 1
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x47c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437d97
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x478]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437dbd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp - 0x46c]
mov byte [ebp - 4], 8
add ebx, 0xfffffff0
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437de3
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x490]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437e09
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [edi + 0x15], 0
jne 0x437e66
mov ecx, dword [edi + 8]
cmp byte [ecx + 0x15], 0
jne 0x437e32
mov eax, dword [ecx]
cmp byte [eax + 0x15], 0
jne 0x437e2a
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], 0
je 0x437e20
mov dword [ebp - 0x46c], ecx
jmp 0x437e60
mov eax, dword [edi + 4]
cmp byte [eax + 0x15], 0
jne 0x437e5a
jmp 0x437e46
mov edi, dword [ebp - 0x46c]
cmp edi, dword [eax + 8]
jne 0x437e5a
mov dword [ebp - 0x46c], eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], 0
je 0x437e40
mov dword [ebp - 0x46c], eax
mov edi, dword [ebp - 0x46c]
cmp edi, dword [0x58e4b8]
jne 0x437b21
mov esi, dword [ebp - 0x474]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x470]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437e9e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437ebe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437ee1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437f07
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x480]
jmp 0x4379ed
push 0x80070057
call fcn.004013f0
int3