Function at 0x409cd3
Capabilities:
Copy file
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x610
mov al, byte [0x41f314]
push ebx
push esi
mov ebx, dword [ebp + 0xc]
push edi
mov byte [ebp - 0x610], al
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x60f]
push dword [ebp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea esi, [ebx + 0x1a]
push esi
push str.CopyPoweroffToSystem_start__executable_s__system_poweroff_s
stosb byte es:[edi], al
call fcn.00403cd9
push esi
call fcn.0040c940
add esp, 0x10
cmp eax, 4
mov edi, str..exe
jb 0x409d3b
push edi
push esi
call fcn.0040c940
pop ecx
lea eax, [eax + ebx + 0x16]
push eax
call fcn.0040c790
pop ecx
test eax, eax
pop ecx
je 0x409d44
push edi
push esi
call fcn.0040c6b0
pop ecx
pop ecx
push 0x5c
push esi
call fcn.0040c880
pop ecx
pop ecx
test eax, eax
lea eax, [ebp - 0x10c]
push esi
push eax
jne 0x409e3b
call fcn.0040c6a0
pop ecx
xor ebx, ebx
pop ecx
push ebx
push ebx
push 3
push ebx
push 1
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
call esi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x409e77
lea eax, [ebp - 0x610]
push 0x400
push eax
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x610]
push 0x3b
mov dword [ebp - 4], eax
lea eax, [ebp - 0x610]
push eax
call fcn.0040c880
pop ecx
mov dword [ebp - 8], eax
pop ecx
mov edi, str._s_s
cmp eax, ebx
je 0x409e0e
mov eax, dword [ebp - 8]
mov byte [eax], bl
mov eax, dword [ebp + 0xc]
add eax, 0x1a
push eax
lea eax, [ebp - 0x10c]
push dword [ebp - 4]
push edi
push eax
call fcn.0040c81c
add esp, 0x10
lea eax, [ebp - 0x10c]
push ebx
push ebx
push 3
push ebx
push 1
push ebx
push eax
call esi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x409e77
mov eax, dword [ebp - 8]
push 0x3b
inc eax
push eax
mov dword [ebp - 4], eax
call fcn.0040c880
pop ecx
mov dword [ebp - 8], eax
pop ecx
jmp 0x409dbc
mov eax, dword [ebp + 0xc]
add eax, 0x1a
push eax
lea eax, [ebp - 0x10c]
push dword [ebp - 4]
push edi
push eax
call fcn.0040c81c
add esp, 0x10
lea eax, [ebp - 0x10c]
push ebx
push ebx
push 3
push ebx
push 1
push ebx
push eax
call esi
jmp 0x409e59
call fcn.0040c6a0
pop ecx
xor ebx, ebx
pop ecx
lea eax, [ebp - 0x10c]
push ebx
push ebx
push 3
push ebx
push 1
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x409e77
push 0x41b11c
push ebx
push dword [ebp + 0xc]
call fcn.00403da4
add esp, 0xc
jmp 0x409f0f
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x409ea7
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.00403ed4
pop ecx
pop ecx
jmp 0x409f0f
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x210]
push str.P0WER0FF
push eax
push str._s_s.exe
push edi
call fcn.0040c81c
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.0040c790
add esp, 0x18
test eax, eax
je 0x409f13
lea eax, [ebp - 0x10c]
push edi
push eax
push str.Copying__s_to__s
call fcn.00403cd9
add esp, 0xc
lea eax, [ebp - 0x10c]
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x409f13
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.00403ed4
pop ecx
pop ecx
push dword [ebp - 4]
call esi
xor eax, eax
jmp 0x409f42
push edi
lea eax, [ebp - 0x610]
push str.__s___service
push eax
call fcn.0040c81c
lea eax, [ebp - 0x610]
push eax
push edi
call fcn.0040c6a0
push str.CopyPoweroffToSystem_end
call fcn.00403cd9
add esp, 0x18
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret