Function at 0x409b20
Capabilities:
Copy file
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42f7df
push eax
mov dword fs:[0], esp
sub esp, 0x3dc
push ebx
push ebp
push esi
push edi
call fcn.004161e0
test eax, eax
jne 0x40a099
lea eax, [esp + 0x6c]
push eax
call fcn.00415a90
add esp, 4
mov edx, eax
mov edi, 0x4385e8
or ecx, 0xffffffff
xor eax, eax
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x3f4], ebp
push ecx
mov ecx, dword [edx + 8]
push 0x4385e8
push ecx
push ebp
mov ecx, edx
call fcn.0040c0c0
cmp eax, ebp
je 0x409bdd
lea edx, [esp + 0x4c]
push edx
call fcn.00415a90
add esp, 4
mov edx, eax
mov edi, 0x4385e4
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x3f4], 1
repne scasb al, byte es:[edi]
mov eax, dword [edx + 8]
not ecx
dec ecx
push ecx
push 0x4385e4
push eax
push ebp
mov ecx, edx
call fcn.0040c0c0
cmp eax, ebp
push 1
lea ecx, [esp + 0x50]
mov byte [esp + 0x3f8], 0
sete bl
call fcn.0040aae0
test bl, bl
je 0x409bdf
mov bl, 1
push 1
lea ecx, [esp + 0x70]
mov dword [esp + 0x3f8], 0xffffffff
call fcn.0040aae0
test bl, bl
je 0x40a099
mov edi, 0x438124
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [0x43d2a4]
push 0x438124
push ecx
push ebp
mov ecx, 0x43d29c
call fcn.0040c0c0
cmp eax, ebp
jne 0x40a099
cmp dword [0x43d2d4], ebp
jbe 0x40a099
sub esp, 0x10
mov edx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00415810
add esp, 4
lea eax, [esp + 0x2c]
push eax
call fcn.00418640
mov cl, byte [esp + 0x30]
add esp, 4
mov esi, esp
mov dword [esp + 0x24], esp
push ebp
mov dword [esp + 0x408], 2
mov byte [esi], cl
mov ecx, esi
call fcn.0040aae0
mov edx, dword [0x4313b0]
lea eax, [esp + 0x2c]
push edx
push ebp
push eax
mov ecx, esi
call fcn.0040a8e0
lea ecx, [esp + 0x3c]
push ecx
call fcn.004197c0
add esp, 0x14
mov dl, byte [esp + 0x13]
push ebp
lea ecx, [esp + 0x50]
mov byte [esp + 0x3f8], 3
mov byte [esp + 0x50], dl
call fcn.0040aae0
mov edi, 0x43817c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x43817c
lea ecx, [esp + 0x54]
call fcn.0040ad80
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x70]
push ecx
push edx
mov byte [esp + 0x400], 4
call fcn.0040baa0
push 0x43d2ac
push eax
lea eax, [esp + 0x50]
mov byte [esp + 0x408], 5
push eax
call fcn.0040baa0
add esp, 0x18
push 1
lea ecx, [esp + 0x70]
mov byte [esp + 0x3f8], 8
call fcn.0040aae0
push 1
lea ecx, [esp + 0x50]
mov byte [esp + 0x3f8], 7
call fcn.0040aae0
mov cl, byte [0x43d2fc]
sub esp, 0x10
mov esi, esp
mov dword [esp + 0x24], esp
push ebp
mov byte [esi], cl
mov ecx, esi
call fcn.0040aae0
mov edx, dword [0x4313b0]
mov ecx, esi
push edx
push ebp
push 0x43d2fc
call fcn.0040a8e0
lea eax, [esp + 0x6c]
push eax
call fcn.004197c0
add esp, 0x14
mov eax, dword [esp + 0x20]
mov byte [esp + 0x3f4], 9
cmp eax, ebp
jne 0x409d7b
mov eax, 0x4313b4
mov ecx, dword [0x43d2c0]
cmp ecx, ebp
jne 0x409d8a
mov ecx, 0x4313b4
push ebp
push eax
push ecx
call fcn.0041a1e0
add esp, 0xc
cmp eax, 1
jne 0x409fe5
call fcn.0040a0c0
push ebp
lea ecx, [esp + 0x2e0]
call fcn.00414820
mov ecx, dword [esp + 0x30]
mov byte [esp + 0x3f4], 0xa
cmp ecx, ebp
jne 0x409dc5
mov ecx, 0x4313b4
mov eax, dword [esp + 0x20]
cmp eax, ebp
jne 0x409dd2
mov eax, 0x4313b4
push ebp
push ecx
push eax
call fcn.00414920
mov edi, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
add esp, 0xc
test al, al
je 0x409f6f
mov ecx, dword [0x43d300]
cmp ecx, ebp
jne 0x409dfa
mov ecx, 0x4313b4
mov eax, dword [esp + 0x40]
cmp eax, ebp
jne 0x409e07
mov eax, 0x4313b4
push ebp
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
test eax, eax
je 0x409f6f
mov eax, dword [esp + 0x40]
cmp eax, ebp
jne 0x409e25
mov eax, 0x4313b4
push eax
call edi
mov eax, dword [0x43d300]
cmp eax, ebp
jne 0x409e36
mov eax, 0x4313b4
push eax
call fcn.004185a0
add esp, 4
test eax, eax
je 0x409f6f
mov ecx, dword [0x43d2d0]
cmp ecx, ebp
jne 0x409e56
mov ecx, 0x4313b4
mov eax, dword [0x43d300]
cmp eax, ebp
jne 0x409e64
mov eax, 0x4313b4
push ecx
push eax
lea ecx, [esp + 0x84]
mov dword [esp + 0x88], ebp
mov dword [esp + 0x84], ebp
call fcn.00415140
mov bl, 0xb
lea ecx, [esp + 0x7c]
mov byte [esp + 0x3f4], bl
call fcn.004151f0
lea ecx, [esp + 0x7c]
call fcn.00415250
mov cl, byte [0x43d2cc]
sub esp, 0x10
mov esi, esp
mov dword [esp + 0x24], esp
push ebp
mov byte [esi], cl
mov ecx, esi
call fcn.0040aae0
mov edx, dword [0x4313b0]
mov ecx, esi
push edx
push ebp
push 0x43d2cc
call fcn.0040a8e0
sub esp, 0x10
lea eax, [esp + 0x33]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
push str.ucskind
mov byte [esp + 0x41c], 0xc
call fcn.0040a5a0
mov byte [esp + 0x414], bl
call fcn.004140e0
mov cl, byte [0x43d2fc]
add esp, 0x10
mov esi, esp
mov dword [esp + 0x28], esp
push ebp
mov byte [esi], cl
mov ecx, esi
call fcn.0040aae0
mov edx, dword [0x4313b0]
mov ecx, esi
push edx
push ebp
push 0x43d2fc
call fcn.0040a8e0
sub esp, 0x10
lea eax, [esp + 0x33]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
push str.ucslocal
mov byte [esp + 0x41c], 0xd
call fcn.0040a5a0
mov byte [esp + 0x414], bl
call fcn.004140e0
mov ecx, dword [esp + 0xa0]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 0x20
mov byte [esp + 0x3f4], 0xa
push ecx
call esi
mov edx, dword [esp + 0x7c]
push edx
call esi
sub esp, 0x10
lea eax, [esp + 0x2c]
mov esi, esp
mov dword [esp + 0x28], esp
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.0040a480
push esi
call fcn.00417420
add esp, 4
lea edx, [esp + 0x33]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
push 0x4385e0
mov byte [esp + 0x41c], 0xe
call fcn.0040a5a0
mov byte [esp + 0x414], 0xa
call fcn.004140e0
mov eax, dword [esp + 0x40]
add esp, 0x20
cmp eax, ebp
jne 0x409fce
mov eax, 0x4313b4
push eax
call edi
lea ecx, [esp + 0x2dc]
mov byte [esp + 0x3f4], 9
call fcn.00414860
mov ecx, dword [esp + 0x60]
cmp ecx, ebp
je 0x40a009
mov al, byte [ecx - 1]
test al, al
je 0x409fff
cmp al, 0xff
je 0x409fff
dec al
mov byte [ecx - 1], al
jmp 0x40a009
dec ecx
push ecx
call fcn.00420ca8
add esp, 4
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x60], ebp
cmp ecx, ebp
mov dword [esp + 0x64], ebp
mov dword [esp + 0x68], ebp
je 0x40a039
mov al, byte [ecx - 1]
test al, al
je 0x40a02f
cmp al, 0xff
je 0x40a02f
dec al
mov byte [ecx - 1], al
jmp 0x40a039
dec ecx
push ecx
call fcn.00420ca8
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x40], ebp
cmp ecx, ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebp
je 0x40a069
mov al, byte [ecx - 1]
test al, al
je 0x40a05f
cmp al, 0xff
je 0x40a05f
dec al
mov byte [ecx - 1], al
jmp 0x40a069
dec ecx
push ecx
call fcn.00420ca8
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x30], ebp
cmp ecx, ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
je 0x40a099
mov al, byte [ecx - 1]
test al, al
je 0x40a08f
cmp al, 0xff
je 0x40a08f
dec al
mov byte [ecx - 1], al
jmp 0x40a099
dec ecx
push ecx
call fcn.00420ca8
add esp, 4
mov ecx, dword [esp + 0x3ec]
pop edi
pop esi
pop ebp
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0x3e8
ret