Function at 0x430300
Capabilities:
Copy file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x49fe8e
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x4d6720]
xor eax, esp
mov dword [esp + 0x230], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d6720]
xor eax, esp
push eax
lea eax, [esp + 0x248]
mov dword fs:[0], eax
mov esi, dword [esp + 0x258]
mov dword [esp + 0x14], 0
call fcn.00468b49
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x430364
push 0x80004005
call fcn.00401210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
push 0
lea ecx, [esp + 0x1c]
push ecx
mov ecx, 0x4d7d50
mov dword [esp + 0x258], 0
call fcn.0040d6f0
mov edx, dword [esp + 0x18]
cmp dword [edx - 0xc], 0
jne 0x430420
push 1
lea eax, [esp + 0x18]
push 0x168
push eax
call fcn.00401dd0
mov eax, dword [eax]
push 1
push 0x10
push eax
mov byte [esp + 0x268], 1
call fcn.0041d870
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
add esp, 0x18
mov byte [esp + 0x250], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4303ee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x250], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x430419
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x4307e5
call fcn.00468b49
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x43043a
push 0x80004005
call fcn.00401210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
push 1
lea ecx, [esp + 0x20]
push 0x169
push ecx
mov byte [esp + 0x25c], 2
call fcn.00401dd0
mov eax, dword [eax]
push eax
lea edx, [esp + 0x3c]
push edx
push esi
mov byte [esp + 0x268], 3
call fcn.004267f0
add esp, 0x18
cmp eax, 1
mov eax, dword [esp + 0x1c]
sete bl
add eax, 0xfffffff0
mov byte [esp + 0x250], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4304aa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebp, dword [esp + 0x2c]
test bl, bl
je 0x430791
call fcn.00469e8e
mov ecx, dword [eax + 4]
call fcn.00466efe
lea ecx, [esp + 0x3c]
push ecx
push 0x104
mov byte [esp + 0x258], 4
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4306b7
call fcn.00468b49
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4304fd
push 0x80004005
call fcn.00401210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x18]
push ecx
mov byte [esp + 0x254], 5
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x24]
push str._s_s
push eax
call fcn.00404580
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
add esp, 0x10
push 0
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x43064f
mov eax, dword [0x4d87d4]
cmp eax, 0x19000
jge 0x430565
mov eax, 0x19000
jmp 0x430571
cmp eax, 0x1f400000
jle 0x430571
mov eax, 0x1f400000
cdq
push edx
push eax
push esi
call fcn.0040cb40
add esp, 0xc
cmp eax, 0xffffffff
je 0x430641
lea ecx, [esp + 0x28]
call fcn.004016e0
lea edx, [esp + 0x30]
push edx
mov byte [esp + 0x254], 6
call fcn.004064e0
lea ecx, [esp + 0x30]
call fcn.004059a0
push eax
lea ecx, [esp + 0x34]
call fcn.00405a00
push eax
lea ecx, [esp + 0x38]
call fcn.004059d0
push eax
push ebp
lea eax, [esp + 0x38]
push str._sWOSB_EventLog__02u__02u__04u.zip
push eax
call fcn.00404580
mov ecx, dword [esp + 0x40]
push 1
push esi
push ecx
call fcn.00430220
mov edi, eax
add esp, 0x24
test edi, edi
jne 0x4305f8
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], 1
call fcn.0041f860
jmp 0x430665
lea ecx, [esp + 0x20]
call fcn.004016e0
push edi
lea edx, [esp + 0x24]
push str.CWakeOnStandbyApp::ExportEventLogFile.ZipFile__error_d
push edx
mov byte [esp + 0x25c], 7
call fcn.00404580
mov eax, dword [esp + 0x2c]
push 0xca
push eax
push 4
call fcn.0042fc90
add esp, 0x18
lea ecx, [esp + 0x20]
call fcn.0041f860
lea ecx, [esp + 0x28]
call fcn.0041f860
jmp 0x430665
push 0xc9
push str.CWakeOnStandbyApp::ExportEventLogFile.TruncateFileFromTop
push 4
jmp 0x43065d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CWakeOnStandbyApp::ExportEventLogFile.CopyFile
push 3
call fcn.0042fc90
add esp, 0xc
push esi
call fcn.0041b370
lea eax, [esi - 0x10]
add esp, 4
mov byte [esp + 0x250], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x430692
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x14], 0
jne 0x430780
call fcn.00468b49
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4306cf
push 0x80004005
call fcn.00401210
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CWakeOnStandbyApp::ExportEventLogFile.GetTempPath
push 3
call fcn.0042fc90
add esp, 0xc
jmp 0x43069d
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push 1
lea ecx, [esp + 0x20]
push 0x16a
mov bl, 8
push ecx
mov byte [esp + 0x25c], bl
call fcn.00401dd0
mov eax, dword [eax]
push ebp
push eax
lea edx, [esp + 0x28]
push str._s_n_n_s
push edx
mov byte [esp + 0x26c], 9
call fcn.00404580
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
add esp, 0x1c
mov byte [esp + 0x250], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43073e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x14]
push 0xc8
push esi
push 4
call fcn.0042fc90
push 1
push 0x10
push esi
call fcn.0041d870
lea eax, [esi - 0x10]
add esp, 0x18
mov byte [esp + 0x250], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x430780
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x27]
mov byte [esp + 0x250], 2
call fcn.0040e6e0
lea eax, [ebp - 0x10]
mov byte [esp + 0x250], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4307b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x250], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4307e0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x248]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.00482b5f
add esp, 0x240
ret